Open source
DocAccessible opens, repairs, and validates documents using 76 open source projects that we did not write and do not own. This page names every one of them, with the version we run, the license it carries, and a link to its source. It is written for the maintainers as much as for procurement.
Why this page exists
Document accessibility work is only possible because a long line of people solved the hard parts first and gave the result away. Reading a PDF's object model, recovering text from a scan, deciding whether a file conforms to PDF/UA: none of that is our invention. We assemble it, we run it carefully, and we are answerable for the result, but the engines belong to the people listed below.
Most acknowledgement pages are a wall of names typed once and never revisited. This one is built from the repository. Python versions and licenses were read from the installed distribution metadata, Node versions and licenses from the resolved packages in the lockfile, and service versions from the pinned image tags in the deployment file. Every source link was requested and confirmed to resolve before it was published. The inventory was last verified on August 28, 2026.
If you are here for procurement rather than curiosity, the license column is the one you want, and the license obligations section states what we do about copyleft. Commercial vendors that receive data are a different question, answered on the subprocessor page.
17 projects
These projects do the part of the work customers actually pay for. A PDF is opened, its structure is read or rebuilt, its text is recovered, and the result is validated. None of that machinery is ours.
| Project | Version | License | What it does here |
|---|---|---|---|
| pikepdfgithub.com/pikepdf/pikepdf | 10.5.1 | MPL-2.0 | Reads and writes the PDF object model. Every tag structure we add to a PDF is written through pikepdf, in place, without redrawing the page. |
| QPDFgithub.com/qpdf/qpdf | libqpdf, via pikepdf | Apache-2.0 | The C++ engine underneath pikepdf. It is the reason a rewritten file stays structurally valid instead of merely opening in one viewer. |
| pdfminer.sixgithub.com/pdfminer/pdfminer.six | 20260107 | MIT | Lays out the page to recover reading order when a PDF has no usable tags, and re-reads the text layer when we score how much meaning survived a conversion. |
| veraPDFgithub.com/veraPDF/veraPDF-library | 1.30.2 | GPL-3.0 or MPL-2.0 | The PDF/UA validator behind every machine conformance result we report. We run it as a pinned service and publish its findings unmodified. |
| OCRmyPDFgithub.com/ocrmypdf/OCRmyPDF | 17.8.1 | MPL-2.0 | Recovers a real text layer from a scanned PDF and writes it back as invisible text, leaving the scanned image exactly as it was. |
| Tesseract OCRgithub.com/tesseract-ocr/tesseract | in the OCR image | Apache-2.0 | The recognition engine inside OCRmyPDF. We ship English, Spanish, French, and German language data in the image rather than downloading it at runtime. |
| Ghostscriptgithub.com/ArtifexSoftware/ghostpdl | in the OCR image | AGPL-3.0 | PDF rasterization and normalization inside the OCR service. It arrives as an OCRmyPDF dependency rather than something our code calls directly. |
| python-docxgithub.com/python-openxml/python-docx | 1.2.0 | MIT | Reads Word files so an authored DOCX keeps its real headings, lists, and table structure instead of being flattened into paragraphs. |
| ReportLabgithub.com/MrBitBucket/reportlab-mirror | 4.4.10 | BSD | Generates PDF output where a document has to be produced rather than repaired. |
| fpdf2github.com/py-pdf/fpdf2 | 2.8.7 | LGPL-3.0-only | A second PDF writer, used where a small tagged file has to be built from scratch. |
| fontToolsgithub.com/fonttools/fonttools | 4.62.1 | MIT | Reads embedded font programs so text encoded with a broken or custom glyph map can still be recovered as real characters instead of mojibake. |
| Liberation Fontsgithub.com/liberationfonts/liberation-fonts | bundled | SIL OFL 1.1 | Metric-compatible fonts shipped with the API so a repaired PDF can embed a real font rather than depend on whatever the reader substitutes. |
| Pillowgithub.com/python-pillow/Pillow | 12.3.0 | MIT-CMU | Reads and normalizes images extracted from a document before they are described or re-embedded. |
| lxmlgithub.com/lxml/lxml | 6.1.0 | BSD-3-Clause | XML and HTML parsing across extraction, tag trees, and generated output. |
| defusedxmlgithub.com/tiran/defusedxml | 0.7.1 | PSF-2.0 | Parses XML that came from somewhere else, including validator reports, without exposing the parser to entity expansion attacks. |
| langdetectgithub.com/Mimino666/langdetect | 1.0.9 | MIT | Detects document language so the output carries a correct language attribute instead of an assumed one. |
| axe-coregithub.com/dequelabs/axe-core | 4.12.1 | MPL-2.0 | Runs against our own pages in the end-to-end suite, so an accessibility product is itself tested for accessibility on every change. |
26 projects
The API, the job queue that runs remediation off the request path, and the data layer underneath both.
| Project | Version | License | What it does here |
|---|---|---|---|
| FastAPIgithub.com/fastapi/fastapi | 0.139.0 | MIT | The HTTP API that the web application and the free tools talk to. |
| Starlettegithub.com/Kludex/starlette | 1.3.1 | BSD-3-Clause | The ASGI foundation underneath FastAPI: routing, middleware, and request handling. |
| Uvicorngithub.com/Kludex/uvicorn | 0.45.0 | BSD-3-Clause | The ASGI server that runs both the API and the OCR sidecar. |
| Pydanticgithub.com/pydantic/pydantic | 2.13.3 | MIT | Validates every request, job payload, and audit report, which is why a malformed document cannot quietly become a malformed result. |
| pydantic-settingsgithub.com/pydantic/pydantic-settings | 2.14.2 | MIT | Typed configuration, so a misconfigured deployment fails at boot instead of at the first upload. |
| SQLModelgithub.com/fastapi/sqlmodel | 0.0.38 | MIT | The database models shared between the API and the worker. |
| SQLAlchemygithub.com/sqlalchemy/sqlalchemy | 2.0.49 | MIT | The query and session layer underneath SQLModel. |
| Alembicgithub.com/sqlalchemy/alembic | 1.18.4 | MIT | Schema migrations, applied as their own deployment step before any new code serves traffic. |
| psycopggithub.com/psycopg/psycopg | 3.3.3 | LGPL-3.0-only | The PostgreSQL driver used by both the API and the worker, including connection handling. |
| Taskiqgithub.com/taskiq-python/taskiq | 0.12.2 | MIT | The task queue that runs conversion, tagging, and validation in a worker, so a slow document never blocks a request. |
| taskiq-redisgithub.com/taskiq-python/taskiq-redis | 1.2.2 | MIT | The broker and result backend that connects Taskiq to Valkey. |
| redis-pygithub.com/redis/redis-py | 7.4.0 | MIT | The client library used to reach the Valkey instance. |
| HTTPXgithub.com/encode/httpx | 0.28.1 | BSD-3-Clause | The async HTTP client that calls the validator and OCR services. |
| aiohttpgithub.com/aio-libs/aiohttp | 3.14.1 | Apache-2.0 and MIT | An additional async HTTP stack used inside parts of the worker path. |
| boto3github.com/boto/boto3 | 1.42.93 | Apache-2.0 | The S3-compatible client for private object storage. |
| SlowAPIgithub.com/laurentS/slowapi | 0.1.9 | MIT | Rate limiting, which is what keeps the free tools free and available rather than drained by one caller. |
| structloggithub.com/hynek/structlog | 25.5.0 | MIT or Apache-2.0 | Structured logs, so an incident can be traced by job and document rather than by grep. |
| orjsongithub.com/ijl/orjson | 3.11.8 | MPL-2.0 and (Apache-2.0 or MIT) | Fast JSON serialization for large audit and block payloads. |
| bcryptgithub.com/pyca/bcrypt | 5.0.0 | Apache-2.0 | Hashing for passwords and for share-link secrets. |
| cryptographygithub.com/pyca/cryptography | 49.0.0 | Apache-2.0 or BSD-3-Clause | The primitives underneath TLS and token handling. |
| python-multipartgithub.com/Kludex/python-multipart | 0.0.32 | Apache-2.0 | Parses multipart uploads, which is the first code any customer document meets. |
| zipstream-nggithub.com/pR0Ps/zipstream-ng | 1.9.2 | LGPL-3.0-only | Streams export archives to the browser without buffering a whole workspace to disk first. |
| python-slugifygithub.com/un33k/python-slugify | 8.0.4 | MIT | URL-safe slugs for documents, collections, and workspaces. |
| email-validatorgithub.com/JoshData/python-email-validator | 2.3.0 | Unlicense | Address validation on invitations and account email. |
| Sentry SDK for Pythongithub.com/getsentry/sentry-python | 2.58.0 | MIT | Error reporting from the API and the worker, with PII capture disabled and customer content scrubbed. |
| Anthropic SDK for Pythongithub.com/anthropics/anthropic-sdk-python | 0.96.0 | MIT | The client for AI-assisted image description and fidelity comparison. The SDK is open source; the API behind it is not. |
16 projects
The marketing site, the product interface, the document editor, and the free tools all run on the same React application.
| Project | Version | License | What it does here |
|---|---|---|---|
| Next.jsgithub.com/vercel/next.js | 16.2.10 | MIT | The application framework: routing, server rendering, and the build. |
| Reactgithub.com/react/react | 19.2.5 | MIT | The interface layer, including the block editor where a document's structure is corrected by hand. |
| TypeScriptgithub.com/microsoft/TypeScript | 5.9.3 | Apache-2.0 | Types across the whole web codebase, checked in CI on every commit. |
| Tailwind CSSgithub.com/tailwindlabs/tailwindcss | 4.2.4 | MIT | The styling system behind every page on this site, this one included. |
| PostCSSgithub.com/postcss/postcss | 8.5.17 | MIT | The CSS pipeline Tailwind runs through when the site is built. |
| Better Authgithub.com/better-auth/better-auth | 1.6.23 | MIT | Sessions, sign-in, organizations, and invitations. |
| node-postgresgithub.com/brianc/node-postgres | 8.20.0 | MIT | The PostgreSQL client used by the web tier for auth and portal reads. |
| Lucidegithub.com/lucide-icons/lucide | 0.469.0 | ISC | Every icon on the site, marked decorative so a screen reader is not asked to announce it. |
| Sonnergithub.com/emilkowalski/sonner | 2.0.7 | MIT | Toast notifications for save, upload, and job state. |
| clsxgithub.com/lukeed/clsx | 2.1.1 | MIT | Builds conditional class name strings across the shared component library. |
| tailwind-mergegithub.com/dcastil/tailwind-merge | 2.6.1 | MIT | Resolves conflicting Tailwind classes so a component override behaves predictably. |
| class-variance-authoritygithub.com/joe-bell/cva | 0.7.1 | Apache-2.0 | Variant definitions for the shared button and control components. |
| Standard Webhooksgithub.com/standard-webhooks/standard-webhooks | 1.0.0 | MIT | Verifies signatures on inbound billing webhooks. |
| PostHog JSgithub.com/PostHog/posthog-js | 1.407.5 | Apache-2.0 and MIT | Product analytics in the browser, loaded only after consent. |
| PostHog Nodegithub.com/PostHog/posthog-js-lite | 5.46.1 | MIT | Server-side event capture and feature flags. |
| Sentry SDK for JavaScriptgithub.com/getsentry/sentry-javascript | 10.65.0 | MIT | Browser and server error reporting for the Next.js application. |
8 projects
These are whole systems, not libraries. Each one runs as its own container inside our infrastructure, and each one replaces a managed service we would otherwise rent.
| Project | Version | License | What it does here |
|---|---|---|---|
| PostgreSQLgithub.com/postgres/postgres | 17 | PostgreSQL License | The database of record for accounts, documents, jobs, versions, and audit history. |
| Valkeygithub.com/valkey-io/valkey | 8 | BSD-3-Clause | The queue broker and cache. We run the community fork rather than the relicensed original. |
| MinIOgithub.com/minio/minio | RELEASE.2025-09-07 | AGPL-3.0 | Private S3-compatible object storage for uploaded and generated files. |
| MinIO Clientgithub.com/minio/mc | RELEASE.2025-08-13 | AGPL-3.0 | Creates the buckets and access policies on first boot, so private storage is never left open by default. |
| ClamAVgithub.com/Cisco-Talos/clamav | 1.4 | GPL-2.0 | Scans every uploaded file before the pipeline is allowed to open it. |
| veraPDF RESTgithub.com/veraPDF/veraPDF-rest | 1.30.2 | GPL-3.0 or MPL-2.0 | The service wrapper that exposes veraPDF validation over HTTP. Pinned by image digest so the validator cannot change under a mutable tag. |
| Docker Composegithub.com/docker/compose | v2 | Apache-2.0 | Defines the whole stack as one file, which is also how a new environment is stood up. |
| Coolifygithub.com/coollabsio/coolify | self-hosted | Apache-2.0 | The deployment platform. Open source infrastructure hosting an open source stack. |
9 projects
Nothing ships without passing through these. They are the reason a change to the tagging pipeline cannot quietly break the editor.
| Project | Version | License | What it does here |
|---|---|---|---|
| uvgithub.com/astral-sh/uv | 0.11.7 | Apache-2.0 or MIT | Resolves and installs Python dependencies from a frozen lockfile, in the image and in CI. |
| Ruffgithub.com/astral-sh/ruff | 0.15.11 | MIT | Lints and formats the Python codebase, including the security rule set. |
| pytestgithub.com/pytest-dev/pytest | 9.0.3 | MIT | The backend test suite, including the round-trip checks that gate automatic PDF tagging. |
| Vitestgithub.com/vitest-dev/vitest | 3.2.6 | MIT | The web unit test suite, run on every commit before a build is allowed. |
| Playwrightgithub.com/microsoft/playwright | 1.59.1 | Apache-2.0 | End-to-end tests across Chromium, Firefox, and WebKit, including the accessibility checks that run against our own pages. |
| jsdomgithub.com/jsdom/jsdom | 25.0.1 | MIT | The DOM implementation the web unit tests run against. |
| ESLintgithub.com/eslint/eslint | 9.39.4 | MIT | Static analysis for the web codebase, wired to the framework rule set. |
| Prettiergithub.com/prettier/prettier | 3.8.3 | MIT | Formatting, so review comments are about behavior rather than whitespace. |
| pnpmgithub.com/pnpm/pnpm | 9.15.0 | MIT | The package manager and workspace tool for the JavaScript side of the repository. |
Taking copyleft software seriously is part of using it. These are the commitments that come with the components above.
pikepdf, OCRmyPDF, axe-core, orjson, fpdf2, psycopg, and zipstream-ng carry MPL-2.0 or LGPL-3.0 terms. We use them as published libraries and do not patch them in place. If we ever have to modify one of those files, the license requires us to publish that modified file, and we will.
MinIO and Ghostscript are AGPL-3.0. Both run as their own services inside our infrastructure rather than being linked into application code, and neither is redistributed to customers. Their source is published by their own authors at the repositories linked above.
The Liberation font files shipped inside the API image carry their SIL Open Font License text alongside them, because a font that travels into a customer's repaired PDF has to travel with its license.
The veraPDF and OCR services are pinned by image digest rather than by a mutable tag. A maintainer's release can never be silently swapped underneath a validation result we have already published to a customer.
A credit page that quietly counts commercial software as open source is a marketing page. These are the components a reader could reasonably mistake, named on purpose.
Used for animation on this site and free to use, but published under the GreenSock standard license rather than an OSI-approved open source license. It is not counted in the inventory above.
The Python SDK is MIT licensed and credited above. The model service it calls is a commercial API.
Their client SDKs are open source and credited above. The hosted services we send data to are commercial products, and are listed on the subprocessor page instead.
We run your code against a corpus of real public sector documents, which is a good way to find the file that breaks something. If your project is listed above and you want a reproduction case, a failing document, or the numbers we have on how a specific version behaved, ask and we will send them. The contact form reaches a person.
If something on this page is wrong, that is a defect and we want to hear about it. Wrong license, outdated version, a project named the way we happen to type it rather than the way its maintainers write it, a repository that has since moved: tell us and it gets corrected.
Our own conversion research is published rather than kept as a competitive asset, for the same reason. The research program and the PDF-to-HTML benchmark set out the method and the corpus, so a claim we make about conversion quality can be argued with instead of taken on faith.
The same standard applies to what we build on top: the free tools state what they can and cannot prove, the benchmark publishes its corpus, and an automated pass is never presented as a conformance claim.