Sebastien Rousseau
Get in touch ›

Enterprise governance & trust

Built to be audited.

Provenance, licensing, and governance for the open-source payments and post-quantum libraries — the evidence a vendor-risk or compliance review needs, in one place.

See the case studies

Provenance

Evidence, not assurances.

Software bill of materials

A CycloneDX SBOM is generated and validated in CI on every build. Download sbom.cdx.json.

Build provenance (SLSA)

The deployed SBOM carries a signed build-provenance attestation. Verify it yourself:

gh attestation verify sbom.cdx.json \
  --owner sebastienrousseau

Signed publications

Every article is Sigstore-signed and dated, so a reader can prove authorship and integrity independently.

Licensing

Free to use, fork, and audit.

LibraryScopeLicense
pain001ISO 20022 pain.001 generationApache-2.0 / MIT
pacs008ISO 20022 pacs.008 FI-to-FI transferApache-2.0 / MIT
KyberLibML-KEM (CRYSTALS-Kyber, NIST FIPS 203)Apache-2.0 / MIT
BankStatementParserStructured statement parsingApache-2.0 / MIT

Every library is permissively licensed and runs on your own infrastructure — no proprietary translator between your systems and the clearing network, no vendor lock-in.

Governance

The single-maintainer question, answered honestly.

These libraries are authored and maintained by one person. For regulated adoption that raises a fair bus-factor question, so here is the mitigation, stated plainly rather than hidden:

  • Open source, permissively licensed. Apache-2.0 / MIT means your organisation can fork, vendor, and continue maintaining the code independently of the original author.
  • Reproducible, signed releases. SBOM, SLSA provenance, and Sigstore signing let you verify exactly what you run.
  • Inspectable, not a black box. Every library ships as a reference implementation with tests and documentation.
  • Foundation stewardship is the stated direction. The intent for the payments libraries is to pursue neutral stewardship (for example FINOS or the Linux Foundation) to add multi-maintainer redundancy. This is a roadmap intent, not a completed donation.

Recognition

Conferred, not claimed.

Every item below links to a dated, externally verifiable artefact.