Open-source acknowledgements
Effective 13 September 2026
regulation10.ae is built on open-source software, and we would rather say so plainly than leave it implied. This page names the direct production dependencies of the platform, the licence each one carries and a link to its source. Development and test tooling that never ships to you is not listed here, with thanks all the same.
1. The frameworks that carry the site
| Project | Version | Licence | What it does here |
|---|---|---|---|
| Next.js | 15.5.21 | MIT | The application framework: routing, rendering and the build pipeline |
| React | 19.2.7 | MIT | The UI runtime, with react-dom for rendering and hydration |
| Tailwind CSS | 3.4.19 | MIT | The styling system every design token resolves through |
| React Flow (@xyflow/react) | 12.11.5 | MIT | Renders the governance and monitoring flow canvases; its on-canvas attribution mark is left visible by choice |
2. MIT licensed
| Project | Version | Licence | What it does here |
|---|---|---|---|
| @anthropic-ai/sdk | 0.100.1 | MIT | Client for the Claude API behind the assistant and drafting features |
| @azure/communication-email | 1.1.0 | MIT | Transactional email delivery |
| @azure/cosmos | 4.9.3 | MIT | Client for Azure Cosmos DB, the primary datastore |
| @azure/identity | 4.13.1 | MIT | Managed-identity credential acquisition |
| @azure/storage-blob | 12.33.0 | MIT | Blob storage for uploaded and generated evidence artefacts |
| @napi-rs/canvas | 1.0.8 | MIT | Server-side canvas rendering for Open Graph share cards |
| argon2 | 0.44.0 | MIT | Password and token hashing across authentication and recovery codes |
| clsx | 2.1.1 | MIT | Conditional class-name construction |
| driver.js | 1.8.0 | MIT | The in-product guided tour |
| echarts-for-react | 3.0.6 | MIT | React binding for Apache ECharts |
| embla-carousel-react | 8.6.0 | MIT | Carousel primitives |
| Framer Motion | 11.18.2 | MIT | Page transitions and component motion |
| otplib | 13.4.1 | MIT | TOTP generation and verification for two-factor authentication |
| PDFKit | 0.15.2 | MIT | PDF generation for exported compliance artefacts |
| node-qrcode | 1.5.4 | MIT | QR codes for authenticator enrolment |
| React Hook Form | 7.75.0 | MIT | Form state and validation wiring |
| react-markdown | 10.1.0 | MIT | Safe rendering of Markdown answers from the assistant |
| stripe-node | 17.7.0 | MIT | Subscription billing and checkout |
| tailwind-merge | 2.6.1 | MIT | Conflict resolution for merged utility class lists |
| vanilla-cookieconsent | 3.1.0 | MIT | The cookie consent banner and preference store |
| Zod | 3.25.76 | MIT | Schema validation at every system boundary |
3. Apache-2.0 licensed
| Project | Version | Licence | What it does here |
|---|---|---|---|
| class-variance-authority | 0.7.1 | Apache-2.0 | Type-safe variant definitions for the UI primitives |
| Apache ECharts | 6.1.0 | Apache-2.0 | The charting engine behind dashboards and scorecards. Its NOTICE file is preserved upstream: NOTICE |
4. Other licences
| Project | Version | Licence | What it does here |
|---|---|---|---|
| Lucide | 0.460.0 | ISC | The icon set used throughout the product |
| Auth.js (next-auth) | 5.0.0-beta.32 | ISC | Session handling and the authentication layer |
| JSZip | 3.10.1 | MIT (dual-licensed MIT OR GPL-3.0-or-later; the MIT arm is elected) | ZIP assembly for bundled evidence exports |
JSZip is dual-licensed and we elect its MIT arm; the note is stated here once so it never has to be rediscovered.
5. Typefaces
- BDO Grotesk (LCTipografi) and Geist Mono (Vercel) are self-hosted at build time and used under the SIL Open Font License 1.1.
- Sentient (Indian Type Foundry) sets our headings. It is free of charge but it is NOT open source: it is used under the ITF Free Font License, which grants commercial use and self-hosting while reserving all other rights to the foundry. It is credited here for completeness, not as an open-source component.
- The Dubai W23 typeface (Dubai Executive Council and Monotype) renders our share-card images. It is a licensed typeface, not open source, and is credited here for completeness.
6. Imagery
The photography on regulation10.ae is AI-generated. Every frame in the hero and the industry cards was made with Midjourney rather than photographed: no person, office or place shown is real, and none of them depicts Exec X AI, its staff or a customer. The WebP encoding that compresses these files for delivery also strips the synthetic-media marker the generator embeds in them, so the disclosure is made here in words instead.
7. Corrections
This list is reviewed with each release. If you believe we have used your work without crediting it, or credited it incorrectly, write to hello@regulation10.ae and we will correct the page.