ZATCA-Oriented E-Invoicing Integration
B2B e-invoicing middleware engineered around Saudi Arabia's ZATCA Phase 1 & 2 regulatory framework, tested and validated against the FATOORA sandbox environment.
The Compliance Hurdle
Expanding your SaaS or ERP into Saudi Arabia requires strict adherence to ZATCA Phase 2 mandates. Implementing cryptographic signatures (ECDSA), SHA-256 hashing, and UBL 2.1 XML serialization drains months of core product engineering time.
The Middleware Solution
A clean API middleware layer. Your application sends standard invoice JSON, and our middleware converts it to compliant UBL 2.1 XML, signs it with your ECDSA certificate, generates the cryptographic QR code, and connects directly to the FATOORA portal.
What This Integration Handles
Transforms standard invoice JSON records into strictly valid UBL 2.1 XML with all required ZATCA tax categories.
Generates SHA-256 invoice hashes and ECDSA digital signatures using onboarded CSID security certificates.
Encodes seller name, VAT number, timestamp, totals, hash, and ECDSA signature into compliant TLV Base64 QR strings.
Automates end-to-end invoice submission, error diagnostics, and clearance receipts against ZATCA's sandbox API.
Compliance Architecture & Cryptography
ECDSA PKI Signatures
Asymmetric cryptography using secp256k1 elliptic curve pairs with strict X.509 certificate handling.
UBL 2.1 XML Serialization
Validates schemas against official OASIS UBL 2.1 invoice standards and ZATCA business validation rules.
Sandbox Validation
Pre-flight validation routines to verify schema compliance and signature validity before deployment.
ExportShield Pro: Validated Against ZATCA Sandbox
ExportShield Pro is an active B2B compliance application developed by Ahsaan. It transforms invoice payloads into UBL 2.1 XML with ECDSA cryptographic stamping and has been tested directly against the official ZATCA FATOORA sandbox environment.
Frequently Asked Questions
What is the difference between ZATCA Phase 1 and Phase 2?
Phase 1 requires generating electronic invoices with QR codes and tax stamps without live transmission. Phase 2 (Integration Phase) mandates cryptographic ECDSA signatures, invoice hashing, UBL 2.1 XML serialization, and direct API submission to ZATCA's FATOORA portal for clearance or reporting.
Do I have to re-architect my existing ERP or billing database?
No. We build a standalone middleware service that accepts your existing invoice JSON payloads, handles all cryptographic signing and XML conversions in the background, and forwards clearance responses back to your system.
How do you test compliance before connecting to real tax systems?
We validate all generated invoices, signatures, and cryptographic stamps against the official ZATCA FATOORA Developer Sandbox portal using test CSR certificates.
How are cryptographic keys and CSID certificates managed?
Cryptographic private keys are securely generated (secp256k1 / prime256v1) and kept strictly isolated in secret vaults or KMS; they never leave your infrastructure.
Expanding into the Saudi market?
Let's integrate ZATCA Phase 2 compliance into your software with fixed scope and tested sandbox validation.