Trust and data protection

Features of this installation

These points can be checked in the source code, and are covered by tests.

No storage

Your invoice is checked in memory and then discarded. There is no database, no file storage and no cache for invoice contents.

Proven by: The verification service does not write anything to the hard drive; there is no persistence layer.

No passing on to third parties

No external service is called during the check — no cloud API, no translation service, no analysis tool. The check runs completely locally against the installed rules and regulations.

Proven by: Checking needs only the locally installed CEN, Peppol and KoSIT rule sets.

No use of AI

The check is deterministic: XML Schema and Schematron rules. No language model reads your invoice, and the same document always produces the same result.

Proven by: The verification service does not contain any AI dependency; Rules are XSD and Schematron.

No cookies, no tracking

This site does not set cookies or load third-party analytics, advertising or font services. There is nothing you have to agree to.

Proven by: No set cookie header and no external resources in the delivered HTML.

Hardened XML parsing

External entities, DTD processing and network access are disabled when reading the invoice. This eliminates XXE attacks and reloading of remote resources.

Proven by: The parser runs with resolve_entities=False, load_dtd=False and no_network=True.

No registration necessary

Checking needs no account and no email address. No personal data is collected, because none is needed.

Proven by: The checking API needs no authentication.

Limited file size

Uploads are limited to 10MB so that a single upload cannot block the service.

Proven by: The limit is enforced in the browser and in the verification service.

Fixed rulebook versions

Checks run against fixed versions of the official rule sets. Every result names the rule sets and their versions, so a finding can be reproduced later.

Proven by: The rule sets are locked with SHA-256; the version appears in every result.

Rule list generated from the rule sets

The list of error codes on this page is generated directly from the official Schematron sources. It therefore cannot deviate from what the validator actually checks.

Proven by: The rules list is created during build from the same files that the validator runs.

Official validation basis

The basis is the public validation material from CEN (EN 16931), OpenPEPPOL (BIS Billing 3.0) and KoSIT (XRechnung). Anyone who wants to verify a check can download the same files.

Proven by: All policy sources are public and documented in the repository.

About this installation

Hosted in the EUnot set

No hosting region is configured for this installation.

Data protection according to GDPRnot set

The data protection notice has not yet been saved for this installation.

Order processing contractnot set

An order processing contract has not yet been stored for this installation.

Subprocessorsnot set

The list of sub-processors is not yet stored for this installation.

Report security vulnerabilitiesnot set

No safety contact has yet been saved for this installation.

Contact us

Questions about a result, a correction to a rule page, or a bug in the check: email us. We read everything, and we answer when the answer is not already on the site.

[email protected]

Accessibility

Target: WCAG 2.2 level AA and EN 301 549.

Checked on every push: axe-core against the page types taken from the sitemap, and against the validator in every state, at 320 px width and at 200% zoom. Plus manual checks of keyboard operation, focus, target sizes, text spacing, reduced motion and the skip link.

Limits: automated checks cover only part of the criteria. No testing with real screen readers by disabled users has taken place. A sample of the URLs in the sitemap is checked, not every page individually.