Trust & Compliance
Compliance
This page lays out what "EN 16931-compliant" means — the standards versions we pin to, the validators we run before sending, the formats we ship per jurisdiction, and our retention defaults.
What "EN 16931-compliant" means here
Scribo emits invoices conforming to EN 16931-1:2017 with the relevant national CIUS (German XRechnung 3.0.2 / ZUGFeRD 2.3.x; French Factur-X EN 16931; Belgian Peppol BIS 3.0; Spanish Facturae). We pin explicit versions; the EN 16931-1:2026 revision is approved but its syntax bindings (CII D25A + UBL 2.5) are pending TC 434 vote in July 2026, and KoSIT's XRechnung 4.0 is not yet production-ready.
Validators we run
Invopop hosted EN 16931 validator — runs at generate-time on every invoice. Output that fails the rule set never reaches the user.
Additional reference validators (Mustang for ZUGFeRD, KoSIT's XRechnung Validator for German B2G, veraPDF for PDF/A-3) are on the CI roadmap and will be enabled as format coverage broadens.
Supported formats
Retention
- Sender + invoice content: indefinite by default, consistent with §147 AO (10-year retention for financial documents in Germany).
- Recipient PII: held under Art. 6(1)(f) Legitimate Interests. Recipients have a transparency endpoint and can request erasure independently.
- Magic-link tokens: 5-minute TTL, single-use.
- Sessions, rate-limit buckets, idempotency cache: ephemeral; expire by their own TTLs (24h–30d).
Standards version pinning
Scribo pins to specific standards versions to make compliance claims traceable. Migration to newer versions is reactive — we move when both Invopop ships the workflow and a national mandate enforces the new version, whichever comes first.
- EN 16931-1: 2017 (the :2026 revision's syntax bindings vote in July 2026)
- XRechnung: 3.0.2 (4.0 pre-release expected mid-2026, not production-ready)
- ZUGFeRD / Factur-X: 2.3.x
- Peppol BIS Billing: 3.0 (Nov 2025 release)
Contact
Compliance questions: compliance@causaprima.ai. Operated by Causa Prima Germany GmbH, Munich.