Evidence for reviewers

These pages are for a bank’s risk, security or procurement reviewer who needs to approve Pain001 without talking to anyone. Each statement links to the code, workflow or file that shows it. Pain001 claims no certification and no compliance with any regulation; it publishes the evidence for your own assessment.

Each release from 0.0.85 attaches pain001-<version>-evidence-pack.zip with these documents, the maintenance policy, the security policy, the release’s SBOM, provenance and checksums, the OpenSSF Scorecard result and a pre-filled security questionnaire (CSV, one row per question with its answer and evidence).

• Data handling
• Verify a release
• DORA evidence map
• Licence summary