Overview

For any VAT-registered business operating in the Kingdom of Saudi Arabia, compliance with ZATCA's FATOORAH e-invoicing mandate is a legal requirement. Every invoice must be digitally signed and submitted to the ZATCA platform in real time — and that process begins with onboarding.

Onboarding means registering iVendNext as an authorised electronic invoicing device with ZATCA. Until this registration is complete and a valid production certificate is in place, iVendNext cannot legally submit invoices. The onboarding process establishes a cryptographic identity for each device — a Cryptographic Stamp Identifier (CSID) — that ZATCA uses to verify the authenticity of every document your system submits.

Rather than requiring IT teams to interact directly with ZATCA's APIs or generate certificate signing requests manually, iVendNext provides a guided onboarding wizard that handles every step. This article explains what that process involves, why each step exists, and how your business can reach live, compliant ZATCA submissions with minimal technical effort.

What Is ZATCA Device Registration?

ZATCA's FATOORAH Phase 2 mandate requires each electronic invoicing solution — referred to as an EGS (E-Invoicing Generation Solution) — to be individually registered before it can submit invoices. This is a device-level registration that ties a specific installation of iVendNext to a cryptographic certificate issued by ZATCA.

Each registered device receives a unique CSID embedded in every submitted invoice. ZATCA uses this, along with the digital signature and invoice hash chain, to verify that each document was produced by an authorised system and has not been tampered with.

iVendNext supports this natively. Every POS machine can be registered as an independent ZATCA device, each maintaining its own certificate, hash chain, and submission credentials — important for multi-branch operations where stores may operate with intermittent connectivity.

The Onboarding Wizard

The iVendNext ZATCA onboarding wizard walks IT administrators through the full registration process in a structured, step-by-step interface. The typical process takes approximately ten minutes and does not require prior knowledge of ZATCA's technical specifications.

The wizard collects ZATCA-required company details — VAT registration number, building number, street, city, and postcode — and uses these to automatically generate a Certificate Signing Request (CSR). The CSR is a cryptographic document that identifies your business to ZATCA and initiates certificate issuance. In iVendNext, this is handled in a single click.

Before the CSR is submitted, iVendNext runs a pre-flight validation of all required fields. VAT number format, address completeness, and postcode validity are all checked at this stage — an iVendNext safeguard to catch data issues before they cause ZATCA API rejections.

Compliance Certificate Testing

Once the CSR is submitted, ZATCA issues a compliance certificate used exclusively for testing. iVendNext uses it to run six mandatory compliance checks against the ZATCA sandbox environment, covering the full range of document types your system may produce:

• Standard Tax Invoice (B2B)

• Standard Credit Note (B2B)

• Standard Debit Note (B2B)

• Simplified Tax Invoice (B2C)

• Simplified Credit Note (B2C)

• Simplified Debit Note (B2C)

All six must pass before iVendNext proceeds. This mirrors ZATCA's own compliance framework — a solution that cannot generate all six document types correctly is not considered compliant. If any test fails, the issue can be corrected and tests re-run without affecting production credentials.

Production Certificate Activation

Once all six compliance tests pass, the wizard exchanges the compliance certificate for a production CSID automatically. iVendNext calls the ZATCA API, receives the production token, stores it securely within the company's ZATCA settings, and activates live submission mode.

From this point, every invoice created in iVendNext for that company is submitted to ZATCA using the production certificate. No further action is required — the system switches modes automatically upon successful CSID provisioning.

Multi-Environment Support

iVendNext supports three ZATCA environments: Sandbox, Simulation, and Production. Each can be configured independently per company, allowing teams to test configurations or software updates without touching production data or certificates.

This is valuable for businesses rolling out iVendNext across multiple branches in phases — each company can be at a different stage of onboarding simultaneously. The Simulation environment mirrors the production ZATCA platform closely and is recommended for final validation before go-live.

Per-Company and Per-Device Isolation

In multi-entity retail operations, ZATCA compliance must be maintained separately for each legal entity. iVendNext enforces this through per-company ZATCA records — each company has its own isolated credentials: VAT number, CSID tokens, the Previous Invoice Hash (PIH) chain, and submission mode configuration.

This isolation is a compliance requirement. ZATCA mandates that each VAT-registered entity maintains its own invoice chain and submission credentials. Mixing credentials across entities would invalidate the cryptographic chain and risk regulatory penalties.

For POS environments, each terminal registered as a ZATCA device maintains its own independent certificate and hash chain, supporting both multi-branch deployments and offline scenarios where a terminal may need to queue and resubmit invoices generated while disconnected.

Configuring Submission Time Windows

Once onboarding is complete, administrators can optionally define up to two daily submission windows per company. When configured, iVendNext will process ZATCA submissions only within these windows, allowing businesses to schedule API traffic around peak trading hours or maintenance periods. This is an iVendNext configuration option, not a ZATCA requirement — submissions will run continuously if no windows are defined.

This is useful for large-volume retailers where background submissions during peak hours could affect POS performance. By confining submission activity to defined windows — such as early morning and late evening — operations teams can keep compliance traffic off their busiest trading periods.

Summary

ZATCA onboarding in iVendNext takes a VAT-registered Saudi retailer from zero to fully compliant in under an hour. The onboarding wizard handles CSR generation, compliance testing, and production certificate activation automatically. Per-company and per-device isolation ensures multi-entity and multi-branch operations remain compliant without credential conflicts. Once onboarding is complete, iVendNext handles all e-invoicing compliance automatically — with no ongoing action required from store staff or IT administrators.