Are we vulnerable to cyberattacks when sending e-invoices? Is the system secure, is there encryption?

the e-invoice system is managed by the state very secure. the password is linked to the e-signature certificate others can't easily log in. if the accountant changes, close access from the system that's it. revoke the gibe user...

E-invoice tech: XML → digital sign (qualified certificate) → TLS transport → GiBE server. GiBE security: HSM (Hardware Security Module), certificate management, audit logging (tamper-proof), redundancy (high availability). Integration: SOAP API (legacy), REST API (new), mutual TLS (mTLS) certificate pinning. Custom integration risk: input validation (XSD schema), credential storage (HSM, not plaintext), rate limiting (DDoS), error handling (info disclosure).

the e-invoice state system is super secure, bro. make sure the certificate password is strong and manage access in the GiBE account one by one and if the accountant changes revoke the old persons access and give it to the new one. if theres a smell with the integration software switch to another payment processor...

E-Invoice security: 1) Digital certificate (qualified e-signature), 2) TLS 1.2+ transmission, 3) GiBE audit logs (non-repudiation), 4) Role-based access (accountant role restricted), 5) Token expiry (session management). Integration: API authentication (certificate + key), input validation (XSD), output encoding. Incident: certificate revocation (CRL check), breach notification (GiBE handle), audit trail investigation.

Quick summary for newcomers: If 2FA is on a stolen password alone is useless.

If you post the result here, it will help others too.

Good call starting this thread.

We need to take it step by step. Most incidents start with a leaked password, not a vulnerability.

Correct me if I'm wrong.

If you're going this route, sort this out first. If you get three different answers on a topic, the question was asked wrong.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. Just leaving this note, it might be useful.

My perspective changed after experiencing that. Just because everyone does it doesn't mean it's right.

If 2FA is on, a stolen password alone is useless. Good luck with that.

Exactly like that. Your time to detect an issue directly determines its cost.

Correct me if I'm wrong.

Thanks, this was very helpful.

let me speak from the other side; I'm on the supplier side. i mean security isn't absolute; it's about making attacks not worth the effort.

the answer varies greaty by industry; there is no one-size-fits-all rule then if you have questions write them; I'll answer as best I can.

The cheap-looking path usually ends up costing more later. tbh having backups accessible on the same network and with the same identity makes them part of the target.

If I were you, Id go this route.

This thread is archived.

There's a common mistake people make when doing this. Hasty decisions become decisions you have to fix six months later.

Good luck with that.

I can't fully agree with this. Don't hesitate to ask; those who don't ask always pay more.

Just because everyone does it doesn't mean it's right. Correct me if I'm wrong.

I went through the same thing. Hasty decisions become decisions you have to fix six months later.

Of course, it varies if your situation is different.

Exactly like that. If permission and scope aren't in writing, don't start that test.

Taking notes for two weeks yields better results than a six-month estimate. This is my opinion, I'm not claiming it's absolute truth.