What "EN 16931-compliant" means here
Scribo emits invoices conforming to EN 16931-1:2017 with the relevant national CIUS (German XRechnung 3.0.2 / ZUGFeRD 2.3.x; French Factur-X EN 16931; Belgian Peppol BIS 3.0; Spanish Facturae). We pin explicit versions; the EN 16931-1:2026 revision is approved but its syntax bindings (CII D25A + UBL 2.5) are pending TC 434 vote in July 2026, and KoSIT's XRechnung 4.0 is not yet production-ready.
Validators we run
- Invopop hosted validator — runs at generate-time on every invoice.
- Mustang (Apache 2.0, the ZUGFeRD developers' reference validator) — runs in CI on every committed fixture.
- KoSIT XRechnung Validator — runs in CI on every German B2G fixture. Authoritative for federal procurement.
- veraPDF — verifies PDF/A-3 conformance on every shipped fixture.
Supported formats
What Scribo does NOT do
- Tax advice. The tax category code (S/Z/E/AE/K/G/O per EN 16931) is picked by the user. Scribo highlights plausible candidates and renders the matching legal clause; it never pre-selects. Tax advice is illegal in Germany for anyone without a Steuerberater certification (§74-§78 StBerG); Scribo respects this.
- Peppol AP / French Plateforme Agréée certification. Both are 12-18 month accreditation processes (ISO 27001 + SecNumCloud-grade hosting). Scribo routes through Invopop, which holds the certifications.
- Outbound delivery. Scribo returns a download URL; the sender delivers the invoice (email, upload to PA, etc.). Phase 2 wires delivery via Invopop's submission workflows.
Sub-processors
- Invopop (Madrid, Spain) — generation, format conversion, validator, post-MVP delivery to regulators.
- OpenAI — when you use the conversational web UI, your invoice content is processed through an OpenAI chat model to drive the conversation.
- Resend — magic-link verification email delivery from
mail.invoice.causaprima.ai. - Google Cloud (EU regions) — generated invoice PDFs are stored in a private, KMS-encrypted GCS bucket scoped to your tenant.
- Cloudflare Turnstile — anti-abuse on first generate per IP.
Retention
- Sender + invoice content: indefinite by default, consistent with §147 AO (10-year retention for financial documents in Germany). Deletion on request via the dashboard.
- Recipient PII: held under Art. 6(1)(f) Legitimate Interests. Recipients have a transparency endpoint and can request erasure independently.
- Magic-link tokens: 5-minute TTL, single-use.
- Sessions, rate-limit buckets, idempotency cache: ephemeral; expire by their own TTLs (24h–30d).
Standards version pinning
Scribo pins to specific standards versions to make compliance claims traceable. Migration to newer versions is reactive — we move when both Invopop ships the workflow and a national mandate enforces the new version, whichever comes first.
- EN 16931-1: 2017 (the :2026 revision's syntax bindings vote in July 2026)
- XRechnung: 3.0.2 (4.0 pre-release expected mid-2026, not production-ready)
- ZUGFeRD / Factur-X: 2.3.x
- Peppol BIS Billing: 3.0 (Nov 2025 release)
Contact
Compliance questions: compliance@causaprima.ai. Operated by Causa Prima Germany GmbH, Munich.