Security
What Egypt ETA e-Invoice can read and write, what it stores, and what leaves your instance.
The eSeal key never touches Odoo
The certificate lives on a USB token or HSM issued by an accredited Egyptian provider, held by a separate local service. Odoo builds the document and asks that service to sign it.
That is ETA's requirement rather than our design, and it is a good one: the private key that signs your tax documents is in hardware, not in a database column, not in a backup, and not in an environment variable somebody pasted into a chat.
There is no software-only signing mode and there will not be one.
Credentials
The Client Secret is on a field restricted to an ETA Administrator and masked after saving. Access tokens are held in memory for their lifetime and refreshed before expiry rather than after a call fails.
No credential is logged, placed in a URL, or stored in an error message.
The raw document is restricted
The generated payload is visible only to an ETA Administrator. It contains the whole document — the customer's tax registration number, every line, every amount.
An ETA User can build, submit and read status without ever seeing it.
Groups
| Group | Can |
|---|---|
| ETA User | Build documents, submit, read status |
| ETA Administrator | Connections, credentials, the raw payload |
The environment guard
A connection refuses to be set to Production while its URLs still point at a pre-production address.
This is a safety control rather than a convenience. Both directions of the mistake are expensive and neither announces itself: filing against production while you believe you are testing creates documents you cannot withdraw, and "filing" against pre-production while you believe you are live files nothing at all until somebody checks at the end of the period.
Filing is never automatic
Submission is a deliberate act by a person. A filed document cannot be unfiled, and a module that submitted on validation would file every draft mistake somebody posted.
That is a security property as much as a usability one: the blast radius of a bad invoice is one invoice, not a period's worth.
202 is not treated as success
ETA answers a submission with HTTP 202 — received, not filed — and validates afterwards. This module records Submitted and polls for the real answer.
The alternative would be a system that confidently reports a tax document as lodged when the Authority has refused it.
Multi-company
Record rules on every model: connections, documents, and the code mappings. Each company has its own connection with its own credentials.
What has not been verified
No call has ever been made to the Egyptian Tax Authority from this module. There is no ETA-issued Client ID or eSeal certificate on the development account.
The automated suite runs against a mock ETA service — a real HTTP server, not a patched library — so a 202 carrying rejections, an expired token and a timeout are exercised faithfully. Acceptance by ETA itself, and signing against a physical token, are unverified.
Every documented fact this module relies on is recorded with its source URL and the date it was read, including a table of what could not be confirmed and what the module does instead.
Reporting a vulnerability
info@technovision.dev. We acknowledge within two business days.
Not affiliated with or endorsed by the Egyptian Tax Authority.