Legal
Third-party notices
Everything aptEDMS ships to a browser, runs on a server, or invokes as a separate process, with the licence it is used under. Listed so that a security or procurement review can check the claim rather than take it.
Shipped to the browser
Vendored into the repository under js/vendor/ and served
from this origin. Nothing is loaded from a CDN: the site ships
script-src 'self', and widening that policy for every
page in order to load one library is a trade not worth making.
| Component | Version | Licence | Used for |
|---|---|---|---|
| PDF.js | — | Apache-2.0 | Rendering drawings and documents in the viewer |
| pdf-lib | — | MIT | Writing markup back into a PDF |
| three.js | r180 | MIT | The 3D model viewer |
| GSAP | 3.15.0 | GSAP standard licence | The lifecycle sequence on the home page only |
GSAP is free of charge, including every plugin that used to sit behind
Club GreenSock, and its standard licence permits commercial use on a
public site with no subscription. It is the one entry here not under an
OSI-approved licence: the
package ships no LICENSE file and its licence field is a
URL rather than an SPDX identifier. Ownership rests with Webflow. It is
loaded by the home page alone and reaches neither the application nor
the API.
Server dependencies
All permissive, no copyleft, nothing to disclose. The API runs on Node.js and PostgreSQL.
| Component | Licence | Used for |
|---|---|---|
| fastify, @fastify/cors, @fastify/jwt | MIT | The HTTP layer and authentication |
| pg | MIT | PostgreSQL driver |
| bcryptjs | MIT | Password hashing |
| pdf-lib | MIT | Server-side PDF assembly and stamping |
| @prisma/client, @prisma/adapter-pg | Apache-2.0 | Database access |
| fast-jwt | Apache-2.0 | Token signing and verification |
| @aws-sdk/client-s3, @aws-sdk/s3-request-presigner | Apache-2.0 | Object storage and presigned upload and download |
Typefaces
Three faces, each under the SIL Open Font License 1.1, which permits commercial use and embedding. They are requested from Google Fonts, which is the only external host this site contacts.
| Face | Licence | Role |
|---|---|---|
| Archivo | SIL OFL 1.1 | Display and headings |
| Inter | SIL OFL 1.1 | Body text and interface |
| IBM Plex Mono | SIL OFL 1.1 | Document numbers, revisions, dates and codes |
Invoked as separate processes
Drawing and model conversion runs as separate executables. Nothing in aptEDMS links against them, so their copyleft terms do not reach this codebase — a distinction that matters for two of the three.
| Tool | Licence | Used for |
|---|---|---|
| GNU LibreDWG (dwg2dxf) | GPL-3.0 | Reading DWG into DXF |
| ezdxf | MIT | DXF to PDF, with a BSD-licensed matplotlib backend |
| IfcConvert (IfcOpenShell) | LGPL-3.0 | IFC to GLB for the model viewer |
Running these as a hosted service carries no distribution duty. Shipping a container image to a customer for on-premises use would carry the usual GPL and LGPL obligations for the two bundled binaries — offer their source, allow replacement. Nothing in the aptEDMS codebase itself is affected either way.
Deliberately avoided
Recorded because an absence should be traceable to a decision rather than look like an oversight.
- PyMuPDF — AGPL. Its network clause reaches a hosted service.
- QCAD Professional — paid licence.
- ODA File Converter — non-commercial use only.
- Autodesk Platform Services — paid per conversion.
If you are reviewing this for procurement and something here is missing or has changed, tell us and this page gets a new revision rather than a quiet edit.