Back to Services
Specialized Engineering · Compliance

ZATCA-Oriented E-Invoicing Integration

B2B e-invoicing middleware engineered around Saudi Arabia's ZATCA Phase 1 & 2 regulatory framework, tested and validated against the FATOORA sandbox environment.

The Compliance Hurdle

Expanding your SaaS or ERP into Saudi Arabia requires strict adherence to ZATCA Phase 2 mandates. Implementing cryptographic signatures (ECDSA), SHA-256 hashing, and UBL 2.1 XML serialization drains months of core product engineering time.

The Middleware Solution

A clean API middleware layer. Your application sends standard invoice JSON, and our middleware converts it to compliant UBL 2.1 XML, signs it with your ECDSA certificate, generates the cryptographic QR code, and connects directly to the FATOORA portal.

Capabilities

What This Integration Handles

UBL 2.1 XML Generation

Transforms standard invoice JSON records into strictly valid UBL 2.1 XML with all required ZATCA tax categories.

ECDSA Cryptographic Stamping

Generates SHA-256 invoice hashes and ECDSA digital signatures using onboarded CSID security certificates.

Cryptographic QR Code Generation

Encodes seller name, VAT number, timestamp, totals, hash, and ECDSA signature into compliant TLV Base64 QR strings.

FATOORA Sandbox Validation

Automates end-to-end invoice submission, error diagnostics, and clearance receipts against ZATCA's sandbox API.

Architecture

Compliance Architecture & Cryptography

ECDSA PKI Signatures

Asymmetric cryptography using secp256k1 elliptic curve pairs with strict X.509 certificate handling.

UBL 2.1 XML Serialization

Validates schemas against official OASIS UBL 2.1 invoice standards and ZATCA business validation rules.

Sandbox Validation

Pre-flight validation routines to verify schema compliance and signature validity before deployment.

Toolchain: Python · FastAPI · cryptography.hazmat · lxml · ZATCA FATOORA Sandbox APIs · Docker.
Real Shipped Proof

ExportShield Pro: Validated Against ZATCA Sandbox

ExportShield Pro is an active B2B compliance application developed by Ahsaan. It transforms invoice payloads into UBL 2.1 XML with ECDSA cryptographic stamping and has been tested directly against the official ZATCA FATOORA sandbox environment.

Frequently Asked Questions

What is the difference between ZATCA Phase 1 and Phase 2?

Phase 1 requires generating electronic invoices with QR codes and tax stamps without live transmission. Phase 2 (Integration Phase) mandates cryptographic ECDSA signatures, invoice hashing, UBL 2.1 XML serialization, and direct API submission to ZATCA's FATOORA portal for clearance or reporting.

Do I have to re-architect my existing ERP or billing database?

No. We build a standalone middleware service that accepts your existing invoice JSON payloads, handles all cryptographic signing and XML conversions in the background, and forwards clearance responses back to your system.

How do you test compliance before connecting to real tax systems?

We validate all generated invoices, signatures, and cryptographic stamps against the official ZATCA FATOORA Developer Sandbox portal using test CSR certificates.

How are cryptographic keys and CSID certificates managed?

Cryptographic private keys are securely generated (secp256k1 / prime256v1) and kept strictly isolated in secret vaults or KMS; they never leave your infrastructure.

Expanding into the Saudi market?

Let's integrate ZATCA Phase 2 compliance into your software with fixed scope and tested sandbox validation.