Pain001 is free open-source software, dual-licensed Apache-2.0 or MIT, maintained in a personal capacity. There is no paid tier, no sales team and no one to call: everything a bank's review needs is published, so the review can be done without talking to anyone.
What the evidence pack holds#
One ZIP, rebuilt with every release, with no form in front of it:
- the CycloneDX SBOM of the release;
- SLSA build provenance and the Sigstore attestation, with step-by-step verification commands;
- the signed tag and SHA256SUMS of every release file;
- the OpenSSF Scorecard result;
- security.txt and the vulnerability disclosure policy;
- a data-handling statement: no network calls, no telemetry, no hosted service;
- a DORA ICT third-party evidence map, from each question to the artefact that answers it, with no claim of compliance;
- a licence summary (Apache-2.0 or MIT);
- a pre-filled security questionnaire, CAIQ-lite style, as a spreadsheet;
- the support and maintenance policy below;
- the accessibility statement.
Free resources for your team#
| Resource | What it gives you |
|---|---|
| Maintenance policy | Fixes, including security fixes, ship in the next release. There is no long-term-support line at present. |
| Build your own bank profile | A step-by-step guide and tooling (template, validator, examples), so your team turns the bank's usage guideline into a validated profile in-house, with the data never leaving your network. Public, non-confidential profiles may be contributed to the repository. |
| Open integration recipes | ERP or TMS CSV export to pain.001 mapping, batch and API pipeline patterns, pain.002 handling, and camt.052, camt.053 and camt.054 reconciliation through pain001[camt]. Contributions welcome. |
Maintenance policy#
- Fixes, including security fixes, ship in the next release and arrive by upgrading. There is no long-term-support line at present.
- Security reports are acknowledged within 5 working days as a goal, not a guarantee.
- There is no SLA and no out-of-hours cover.
What this is not#
No hosted service, no telemetry, no paid tier, no SLA and no certification. Nothing on this page certifies Pain001 against any regulation, and none of it replaces your own assessment.
Need paid help?#
Pain001's licence lets any firm support it commercially. The project has no commercial partners and takes no fees or referrals.
Contact#
Report a vulnerability through security.txt. Ask everything else in GitHub issues. The address contact@pain001.com is for confidential security matters only.
Questions a review asks#
Will this be maintained in three years?
It has been maintained since 2023, with signed, reproducible releases under a permissive licence, a published maintenance policy and an open governance model. Anyone can fork it or support it.
What does support cost?
Nothing. There is no paid tier. The maintenance policy says what to expect, and the licence lets any firm offer commercial support independently.
Will my bank accept the file?
Pain001 checks the ISO 20022 schema and the scheme rulebook. Your bank's own rules are a third layer: build a private profile with the guide and validate against it before you send a test file to the bank.