Every cleared invoice is cryptographically signed. Here's what that chain of trust actually involves.
Issued during onboarding after a taxpayer completes the compliance checks in ZATCA's sandbox environment.
Issued once the taxpayer moves to production, used to cryptographically stamp every live invoice from that point forward.
Certificates have a defined validity window. dsFatoora tracks expiry and initiates renewal automatically, well ahead of the deadline, so live submissions never fail on an expired certificate.
Private keys are stored in an encrypted key vault, never in application code or plain configuration — accessible only to the signing process at submission time.
If a certificate is revoked or compromised, dsFatoora halts submissions under that identity immediately and flags it for re-onboarding rather than allowing invoices to queue against an invalid certificate.