# X-Road: a data exchange layer with a governance body attached > X-Road is the Nordic institute's open source data exchange layer, a standardised and interoperable way for public organisations to expose services to one another, and the unusual part is that the software is MIT licensed while the ecosystem around it is governed, audited and operated by a foundation. The next major version is called Spaceship and its first production release is scheduled for December 2026. **nordic-institute/X-Road** — Source code of the X-Road® data exchange layer software - Repository: https://github.com/nordic-institute/X-Road - Website: https://x-road.global - Stars: 869 · Forks: 274 - Language: Java - License: NOASSERTION - Published: 2026-10-20 · Updated: 2026-10-20 · Language: en - Canonical page: https://hysenlabs.com/projects/nordic-institute-x-road ## What X-Road is X-Road is open source software and an ecosystem solution that provides unified and secure data exchange between organisations, and the Data Exchange Layer itself is described as a standardised, cohesive, collaborative, interoperable and secure data exchange layer. The stated purpose is to give service providers a new kind of opportunity to make themselves visible in services directed at citizens, businesses and civil servants, and the claim is that combining many different services and data sources into an entity is easy and cost efficient. The benefits it lists are specific: better quality of existing services and products, new types of service innovation, savings in infrastructure, archiving and other costs, standardised data security and privacy protection, and easy implementation with data access through interfaces, since after connecting, all the included services are available. So it is closer to a federated public API layer than to a middleware product. ## The licence split between code and ecosystem The source code of X-Road is published under the MIT open source licence, and X-Road is free of charge and can be implemented by any organisation. That is a strong statement, and it sits alongside a set of documents in the repository root that show the rest of the picture: a LICENSE file, a TRADEMARK.md, a CLA.md for the contributor licence agreement, a SECURITY.md and a CODE_OF_CONDUCT.md. The GitHub licence field itself carries a custom classification GitHub cannot label, which is worth noting because the MIT statement in the README is about the source code specifically, not about the name, the marks or the process. The README also carries an overview image and a logo file, and a publiccode.yml file, which is the Open Source Initiative's file for public-interest-oriented licensing declarations. ## Governance is a first-class part of the product What makes X-Road different from an ordinary open source integration project is that governance is described in the same document as the code. X-Road Governance Authorities and Operators can register their X-Road ecosystem with NIIS, the Nordic Institute for Interoperability Solutions, and the product registration process is described on the project website. The support disclaimer then lists the activities NIIS undertakes with regard to the core software: management, development, verification and audit of the source code, administration of documentation, administration of business and technical requirements, conducting development, developing and implementing principles of licensing and distribution, providing second-line support for NIIS members, and international cooperation. So the core is community-developed and MIT licensed, while the governance of the standard, the requirements and the distribution principles are administered by an institute. ## The ecosystem around the core Three surrounding structures are named, and each addresses a different need. X-Road Technology Partners are enterprises providing support and consultation services, with examples given: deploying independent X-Road instances, developing X-Road extensions and X-Road-compatible services, and integrating information systems with X-Road. The X-Road Community is described as the global community of users, and it is for anyone interested in X-Road, framed around learning from others and sharing skills and experiences about creating better digital services, both technically and business-wise. The X-Road Academy provides online training for developers, users, operators, consultants and service providers, and for anyone willing to learn more about X-Road. The repository topics list data-exchange, integration, open-source and hacktoberfest, which is a small signal about how outside contributions arrive. ## Building and installing it The build instructions live in the source tree, at src/BUILD.md, and the local installation is scripted with Ansible. X-Road central servers, configuration proxies and security servers can be automatically installed with the Ansible scripts in the ansible subdirectory, with the instructions in the development/ansible/README.md. That set of components names the architecture in a way most documentation does not: there is a central server, a configuration proxy per organisation, and a security server, and the Ansible role automates the three of them together. The repository layout backs this up with a deployment directory, a development directory, a sidecar directory and a scripts directory alongside src, plus a usage_scenario.yml file and a .githooks directory. ## X-Road 8 Spaceship and the December 2026 date The next major version is called X-Road 8 Spaceship, and the README gives two dates that matter to anyone planning an adoption. The first production release is scheduled for December 2026, and X-Road 8 is already available for testing with the X-Road 8.0.0 Beta 2 release, whose release notes are hosted in the project's wiki. The default branch of the repository is develop rather than main, which fits a project whose release line is coordinated across several organisations and where a new major version is on its way. The README also records a Digital Public Goods verified badge since 2020, which is an independent assessment of the project's public-interest orientation and a reasonable proxy for how the funding and governance have held up over that period. ## Where X-Road is the wrong choice Four limits apply. It is a public sector infrastructure project, so adopting it means joining an ecosystem with membership, governance authorities and operator obligations rather than just adding a dependency, and the cost of that is organisational rather than technical. The interoperability it buys is interoperability with other X-Road participants, so it is only worth the setup if your peers are on it, and a private sector integration with a handful of partners does not need the apparatus. The source code is MIT but the ecosystem is not a free-for-all: the name and marks are handled separately, the requirements and licensing principles are administered centrally, and the release train is coordinated, which means your upgrade timing is not entirely yours. And the security and privacy claims are claims about a standard with a specific configuration, not about a library, so the operational burden of running a security server and a configuration proxy is part of what you are adopting. ## Conclusion Use X-Road when you are building a public sector integration that has to be interoperable with other organisations' services rather than merely technically connected, because the layer is a standard with a governance process rather than a library you wire in. Do not treat it as a general-purpose API gateway, since its security model, its member structure and its governance are all part of the product. Verify first which X-Road version your peers run, because X-Road 8 Spaceship is scheduled for its first production release in December 2026 while the beta line is already available for testing, that you read the licensing terms for the parts you are not taking from the MIT licensed source, since the repository keeps separate trademark and contribution agreement documents, and who in your organisation holds the operator and governance roles. ## FAQ ### What is X-Road? It is an open source software and ecosystem solution providing unified and secure data exchange between organisations, and the Data Exchange Layer is a standardised, interoperable and secure data exchange layer for services directed at citizens, businesses and civil servants. ### Under what licence is the X-Road source code published? The source code is published under the MIT open source licence, and the README states that X-Road is free of charge and can be implemented by any organisation. The repository also carries separate trademark and contributor licence agreement documents. ### How is X-Road installed on a local machine? X-Road central servers, configuration proxies and security servers can be automatically installed with the Ansible scripts in the ansible subdirectory, with the instructions in the development/ansible/README.md. Build instructions for the source are in src/BUILD.md. ### What is X-Road 8 Spaceship and when does it ship? It is the next major version of X-Road, with its first production release scheduled for December 2026. It is already available for testing with the X-Road 8.0.0 Beta 2 release, whose notes are in the project wiki. ### Who maintains the X-Road core software? The Nordic Institute for Interoperability Solutions handles management, development, verification and audit of the source code, administration of documentation and of business and technical requirements, licensing and distribution principles, second-line support for its members, and international cooperation. The repository default branch is develop. ## Sources - [Issues](https://github.com/nordic-institute/X-Road/issues) - [nordic-institute/X-Road on GitHub](https://github.com/nordic-institute/X-Road) - [Project website](https://x-road.global) - [README](https://github.com/nordic-institute/X-Road/blob/develop/README.md) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/nordic-institute-x-road