Compliance

Laws and standards judge the documents an organization distributes and the processes that produce them, not the library that renders them. No package makes an application compliant on its own. TX Text Control .NET Server provides building blocks for many requirements: archivable and accessible PDF documents, electronic invoices, digital signatures and document processing on your own servers. Your application supplies the rest. Developers and the people who answer compliance questions about an application can see for each requirement which side provides what.

At a Glance

Archiving With PDF/A

PDF/A, standardized as ISO 19005, is the PDF format for long-term archiving: a PDF/A document contains everything that's needed to display it, including its fonts. Since version 34.0, saving with StreamType AdobePDFA creates PDF/A-3a documents with a tagged structure. PDF/A doesn't allow encryption, but a PDF/A document can be digitally signed. PDF/A describes the rules and the code.

Accessibility With PDF/UA

PDF/UA, standardized as ISO 14289, defines accessible PDF documents that assistive technologies such as screen readers can present. A document can conform to PDF/A-3a and PDF/UA at the same time. TX Text Control generates the tagged structure and the PDF/UA metadata when it saves. The document provides what only its author knows: a title, descriptions of images, tables and links in their DescriptiveText properties, heading levels and table header rows. A document without them has a structure but isn't fully accessible, as PDF/UA explains. The TXTextControl.PDF.Validation package checks the result in code, as a step in your pipeline, as PDF Validation shows.

Text Control's articles name these accessibility laws:

• Section 508 in the United States requires federal agencies to make their electronic and information technology accessible. Its refresh aligned the standards with WCAG 2.0, and contractors of federal agencies are typically required to meet them.
• Title II of the ADA in the United States: a rule of the Department of Justice requires state and local governments to meet WCAG 2.1 AA, with compliance dates of April 24, 2026, for larger and April 26, 2027, for smaller governments.
• The European Accessibility Act has applied since June 2025. It's based on the standard EN 301 549 and also applies to companies outside the European Union that serve customers in it.

Neither the ADA nor the European Accessibility Act names PDF/UA explicitly. The blog articles Why PDF/UA and PDF/A-3a Matter: Accessibility, Archiving, and Legal Compliance and AI Generated PDFs, PDF/UA, and Compliance Risk: Why Accessible Document Generation Must Be Built Into the Pipeline in C# .NET describe the laws and how accessible documents fit into a document pipeline.

For the accessibility of its web components, Text Control offers a Voluntary Product Accessibility Template (VPAT), the document that records how a product meets the revised Section 508 standards. The blog article Download VPAT for Section 508 and Web Accessibility Compliance links the download.

Electronic Invoices

Electronic invoices in the ZUGFeRD and Factur-X formats are PDF/A-3 documents with the invoice data embedded as XML; XRechnung XML can be embedded the same way. TX Text Control creates the readable invoice and embeds the XML, which comes from your ERP system or an e-invoicing library. Create an Electronic Invoice in Attachments shows the code.

In Germany, businesses have had to be able to receive electronic invoices for domestic B2B transactions since January 1, 2025, and transitional rules apply to sending them, as the blog article Electronic Invoicing will Become Mandatory in Germany in 2025 describes. The XML of an invoice is plain text and easy to change. Signing the PDF/A-3 document makes changes to the pages and to the embedded XML detectable, as Why Structured E-Invoices Still Need Tamper Protection using C# and .NET explains.

Electronic Signatures

Legal frameworks describe electronic signatures by their level of assurance: in the European Union, the eIDAS regulation defines simple, advanced and qualified electronic signatures, and in the United States, the ESIGN Act and the UETA apply. PAdES and Electronic Signature Levels introduces the levels. Which level a signature reaches depends on the whole process: TX Text Control captures electronic signatures in the Document Viewer and applies digital signatures on the server, while your application issues or selects the certificates, identifies the signers and records the evidence.

HIPAA doesn't prohibit electronic signatures and has no specific rules for them. According to the blog article HIPAA Compliant Electronic and Digital Signatures, a signing process for health information needs authorization of the signers, for example with two-step authentication, document integrity, audit trails with timestamps and signature hashes, and control over the documents. Digital Signatures in this section describes these parts of a signing process.

Data Protection

TX Text Control runs in your environment and needs no Internet connection or license server, and Text Control states that it doesn't access, process or store customer data unless this is explicitly agreed upon in a separate contract. Where Documents Are Processed in Security Overview lists where each part processes documents and which optional features send data elsewhere. The blog article When to Generate Documents Server-Side Instead of Client-Side: A Focus on Data Security relates server-side generation to the GDPR and HIPAA.

Processing on your own servers doesn't establish compliance by itself. Data Protection and Review in AI Integration makes this point for local language models: authentication, authorization, encrypted transport, retention, logging, backups and the security of the operating system remain your responsibility.

The Cyber Resilience Act

The EU Cyber Resilience Act, Regulation (EU) 2024/2847, aims to protect consumers and businesses that buy software or hardware products with digital elements. According to the European Commission, it entered into force on December 10, 2024. Manufacturers have had to report actively exploited vulnerabilities since September 11, 2026, and the main obligations apply from December 11, 2027.

For the TX Text Control NuGet packages of version 34.0 and later, Text Control provides signed SBOMs in the CycloneDX format, which list the components of each package. SBOM describes what they contain and how to get them.

Text Control as a Supplier

• ISO/IEC 27001. Text Control started the certification of its information security management in 2025, for its offices in Germany and the United States, as the blog article Text Control Begins ISO/IEC 27001 Certification Process to Strengthen Information Security announced. According to its latest statements, the certification is still in progress and planned to be completed by the end of 2026.
• Development. Text Control states that all core development of TX Text Control takes place in-house in Germany, as the blog article Software Origin, Compliance, and Trust: Made in Germany describes.
• Documentation for audits. On request, Text Control provides documentation for procurement, compliance and audit processes and answers security questionnaires. Contact the Text Control sales team.
• License agreements. The license agreements of TX Text Control .NET Server and the company details are on the Legal Notices page.

Next Steps

• SBOM: the signed SBOMs of the TX Text Control packages.
• Digital Signatures: the security of signing processes, from the private key to the audit trail.
• PDF/UA: create accessible PDF documents.
• Document Security: protect the content of documents with passwords, permissions and redaction.