Third-party software
Ksefly is built on other people’s work. Below is what travels with the app and with our service, and under which licence. If something is not here, it is because we do not ship it — the last section says plainly what stays on our side.
The iPhone app
Stripe Terminal iOS SDK 5.7.0 — Copyright (c) 2018– Stripe, Inc. — MIT License. The SDK’s licence file adds a sentence we repeat because it is part of it: “Use of this SDK is subject to the Stripe Terminal Terms: https://stripe.com/terminal/legal”.
It is the only third-party library in the app, and it is not a choice: a contactless payment on
iPhone is read by the system, and only a certified payment provider’s SDK is permitted to decrypt
that read. The version is pinned exactly (exactVersion) rather than by range — in code that
drives a card reader, a silent version change between two builds of the same commit is not a
convenience.
The app’s other packages — Models, AppSecurity, KSeFKit, Persistence, DesignSystem —
are ours. Apple’s frameworks (SwiftUI, SwiftData, StoreKit, ProximityReader, LocalAuthentication,
CoreLocation and the other system frameworks) are part of the platform and need no separate
notice; Apple’s trademarks are credited separately, in the attribution block.
The backend service
Direct dependencies, at the versions in the project files:
| Package | Version | Licence |
|---|---|---|
| Azure.Extensions.AspNetCore.Configuration.Secrets | 1.3.2 | MIT |
| Azure.Identity | 1.21.0 | MIT |
| Azure.Monitor.OpenTelemetry.Exporter | 1.8.1 | MIT |
| FluentValidation | 11.11.0 | Apache-2.0 |
| FluentValidation.DependencyInjectionExtensions | 11.11.0 | Apache-2.0 |
| Microsoft.AspNetCore.Authentication.JwtBearer | 10.0.0 | MIT |
| Microsoft.AspNetCore.OpenApi | 10.0.0 | MIT |
| Microsoft.EntityFrameworkCore | 10.0.0 | MIT |
| Microsoft.Extensions.DependencyInjection.Abstractions | 10.0.0 | MIT |
| Microsoft.Extensions.Http | 10.0.0 | MIT |
| Microsoft.Extensions.Logging.Abstractions | 10.0.0 | MIT |
| Microsoft.Extensions.Options.ConfigurationExtensions | 10.0.0 | MIT |
| Microsoft.OpenApi | 2.7.5 | MIT |
| Npgsql.EntityFrameworkCore.PostgreSQL | 10.0.0 | PostgreSQL License |
| OpenTelemetry.Exporter.OpenTelemetryProtocol | 1.16.0 | Apache-2.0 |
| OpenTelemetry.Extensions.Hosting | 1.16.0 | Apache-2.0 |
| OpenTelemetry.Instrumentation.AspNetCore | 1.16.0 | Apache-2.0 |
| OpenTelemetry.Instrumentation.Http | 1.16.0 | Apache-2.0 |
| Serilog.AspNetCore | 8.0.3 | Apache-2.0 |
| System.IdentityModel.Tokens.Jwt | 8.2.1 | MIT |
The service runs on .NET 10 / ASP.NET Core (Microsoft, MIT) and on PostgreSQL (PostgreSQL License), as the Azure Database for PostgreSQL service.
Those packages pull in dependencies of their own, which ship with the service too — among them Azure.Core, Azure.Security.KeyVault.Secrets, Microsoft.Identity.Client, the Microsoft.IdentityModel family, the Npgsql driver, the Serilog sinks, the OpenTelemetry core, and the Microsoft.Extensions.* and System.* packages. In the dependency graph restored for this repository every one of them is MIT, Apache-2.0 or the PostgreSQL License — there is no copyleft and no commercially restricted licence in it.
The complete package list in the release artifact (48 entries, reproduced from the
Ksefly.Api.deps.json produced by dotnet publish on 26 August 2026): Azure.Core 1.61.0, Azure.Extensions.AspNetCore.Configuration.Secrets 1.5.2, Azure.Identity 1.21.0, Azure.Monitor.OpenTelemetry.Exporter 1.8.3, Azure.Security.KeyVault.Secrets 4.11.0, FluentValidation.DependencyInjectionExtensions 12.1.1, FluentValidation 12.1.1, Microsoft.AspNetCore.Authentication.JwtBearer 10.0.11, Microsoft.AspNetCore.OpenApi 10.0.11, Microsoft.Bcl.AsyncInterfaces 10.0.9, Microsoft.Bcl.Cryptography 10.0.2, Microsoft.EntityFrameworkCore.Abstractions 10.0.11, Microsoft.EntityFrameworkCore.Relational 10.0.11, Microsoft.EntityFrameworkCore 10.0.11, Microsoft.Extensions.DependencyModel 10.0.0, Microsoft.Identity.Client.Extensions.Msal 4.84.2, Microsoft.Identity.Client 4.84.2, Microsoft.IdentityModel.Abstractions 8.22.0, Microsoft.IdentityModel.JsonWebTokens 8.22.0, Microsoft.IdentityModel.Logging 8.22.0, Microsoft.IdentityModel.Protocols.OpenIdConnect 8.19.2, Microsoft.IdentityModel.Protocols 8.19.2, Microsoft.IdentityModel.Tokens 8.22.0, Microsoft.OpenApi 2.12.2, Npgsql.EntityFrameworkCore.PostgreSQL 10.0.3, Npgsql 10.0.3, OpenTelemetry.Api.ProviderBuilderExtensions 1.18.0, OpenTelemetry.Api 1.18.0, OpenTelemetry.Exporter.OpenTelemetryProtocol 1.18.0, OpenTelemetry.Extensions.Hosting 1.18.0, OpenTelemetry.Instrumentation.AspNetCore 1.18.0, OpenTelemetry.Instrumentation.Http 1.18.0, OpenTelemetry.PersistentStorage.Abstractions 1.0.3, OpenTelemetry.PersistentStorage.FileSystem 1.0.3, OpenTelemetry 1.18.0, Serilog.AspNetCore 10.0.0, Serilog.Extensions.Hosting 10.0.0, Serilog.Extensions.Logging 10.0.0, Serilog.Formatting.Compact 3.0.0, Serilog.Settings.Configuration 10.0.0, Serilog.Sinks.Console 6.1.1, Serilog.Sinks.Debug 3.0.0, Serilog.Sinks.File 7.0.0, Serilog 4.3.0, System.ClientModel 1.15.0, System.IdentityModel.Tokens.Jwt 8.22.0, System.Memory.Data 10.0.9, System.Security.Cryptography.ProtectedData 4.5.0.
Every one of them is under the MIT, Apache-2.0 or PostgreSQL License; the graph contains no
copyleft licences and no commercial-restriction licences. The list is regenerated from the
artifact whenever this notice is updated.
The ksefly.app website
The site is built with Astro 5.12 (MIT) and the @astrojs/sitemap 3.4 integration (MIT).
Both are build tools: the built site sends no third-party code to the browser — the build
output contains not one library .js file, the stylesheet is ours, and the text renders in system
font stacks (-apple-system, system-ui, ui-monospace and their fallbacks). We load no
webfont and embed no font file, so there is no font licence to name here.
Marks and artwork that are not software
- The “Download on the App Store” badge (Polish and English) — Apple’s official asset from Apple Marketing Tools, used unaltered, per Apple’s identity guidelines.
- The “Powered by Stripe” badge — Stripe’s official asset from Stripe’s brand assets, used unaltered, in exactly one place in the app.
- The Contactless Symbol — a trademark of EMVCo, LLC, used with permission; it is credited by Apple’s disclaimer that accompanies contactless payments taken with the phone.
These assets are not licensed to us — they belong to their owners and may be used only in the ways and places those owners permit. They may never be redrawn, recoloured or reproduced by hand.
Public register data
PKD/NACE division names, legal-form names and the bank directory recognised from an account number come from public information (GUS, the Ministry of Finance). The Ministry’s published FA(3) schemas are in the repository as test material only; the schema the service validates a document against before sending is our own subset. These are data, not software, and carry no licence that could be quoted here.
What we do NOT ship — and therefore is not listed above
- XcodeGen (MIT, Copyright (c) 2018 Yonas Kolb) — generates the Xcode project at build time. It is vendored in the repository but is not part of the app.
- Test libraries — xunit and its modules (Apache-2.0), Microsoft.NET.Test.Sdk (MIT), Microsoft.AspNetCore.Mvc.Testing (MIT), Microsoft.EntityFrameworkCore.Sqlite (MIT) and SQLitePCLRaw (Apache-2.0). They compile into the test projects only.
- Microsoft.EntityFrameworkCore.Design (MIT) — the design-time migrations tool, marked
PrivateAssets=allin the project file, so it is deliberately not published with the service.
If any of them ever reaches a released artefact, its place is in the tables above, not here.