Compliance
Compliance & Accreditation
Everything an enterprise buyer, auditor or regulator needs to verify TrustBill's UAE e-invoicing compliance posture — legal entity, accredited-ASP chain, data residency, sub-processors and the primary regulatory sources for every claim on this site.
Legal entity
- Trading name
- TrustBill UAE
- Legal name
- TrustBill FZ-LLC
- Jurisdiction
- Sharjah, United Arab Emirates
- Company address
- Sharjah, UAE
- Primary contact
- info@trustbill.ae
- Data protection contact
- privacy@trustbill.ae
- Support contact
- support@trustbill.ae
Accredited service provider (ASP) partner
TrustBill is the software platform that consultancies, SMEs and enterprises use to convert their invoices into UAE PINT-AE format and route them to the FTA e-invoicing network. The last-mile submission to the network is performed through an accredited service provider partner: Microvista Technologies LLC (MoF accreditation number 157529).
This is the same architecture used by many software platforms on the UAE market: the customer-facing product handles the workflow, integrations, validation and dashboards; the accredited ASP handles the certificate management, transmission and receipt on the Peppol network. The regulatory outcome (compliant PINT-AE XML delivered to the FTA via an MoF-accredited entity) is equivalent to routing directly through any other accredited ASP.
The Ministry of Finance publishes the authoritative Accredited Service Provider register and updates it as accreditations are granted, renewed or removed. TrustBill re-verifies against the register on the LAST-VERIFIED date shown at the bottom of this page. Enterprise buyers should independently verify the current status before signing.
Data residency & retention
- Primary region
- AWS me-central-1 (Dubai, UAE)Invoice data, customer PII and audit logs all stay in this region.
- Failover region
- AWS eu-west-1 (Ireland)Warm standby for disaster recovery. Data is encrypted at rest and in transit; failover is only invoked on primary-region failure.
- Encryption at rest
- AES-256-GCMPer-tenant KMS keys; keys rotated on schedule and revocable per tenant.
- Encryption in transit
- TLS 1.3HSTS enforced on all customer-facing endpoints.
- Retention
- 7 yearsPer UAE Federal Tax Authority regulations. Deleted-tenant data is purged 30 days after cancellation unless a legal-hold flag applies.
- Backups
- Point-in-time recovery + daily snapshotsWeekly restore-drill validated. Backup encryption uses a distinct KMS key from primary storage.
Security posture
TrustBill operates a security programme aligned with SOC 2 Type II controls, ISO 27001 principles and OWASP Top 10 hardening. Every code change passes through automated static analysis, dependency vulnerability scanning and mandatory code review before it reaches production.
Access to customer data is scoped by role and audited: engineers operate against production data only through gated JIT-elevation flows, and every access is logged with the requester, purpose and duration. Third-party access follows the same model.
TrustBill runs a private vulnerability-disclosure programme. Security researchers can email security@trustbill.ae with the disclosure and expect an acknowledgement within 48 hours.
Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Microvista Technologies LLC | Accredited service provider — PINT-AE transmission to the UAE FTA e-invoicing network (Peppol 5-corner) | UAE |
| Amazon Web Services (AWS) | Cloud infrastructure — primary (me-central-1) and failover (eu-west-1) | UAE / EU |
| Cloudflare | CDN and DDoS protection for the marketing site and the app entry points | Global edge (data stays in me-central-1 for customer requests) |
| Stripe | Payment processing for paid tiers (SME and enterprise) | Ireland / global (Level 1 PCI DSS) |
| Sentry (self-hosted) | Error monitoring — PII-scrubbed events only; scrub configuration published in the source repo | AWS me-central-1 |
| PostHog | Product analytics — consent-gated per PDPL and cookieless where possible | EU (Frankfurt) |
Primary regulatory sources
Cabinet Decision No. 173 of 2026 — Administrative Penalties
Current penalty framework for the UAE Electronic Invoicing System. Repealed and replaced Cabinet Decision No. 106 of 2025 on 30 October 2026 — removed the AED 1,000/day system-failure penalty and introduced an AED 250/day data-notification penalty.
Cabinet Decision No. 106 of 2025 — Original penalty framework (repealed)
Historical reference only. Superseded by Cabinet Decision No. 173 of 2026; any documentation that still cites it is out of date.
Ministerial Decision No. 243 of 2025 — E-Invoicing System
Establishes the mandatory e-invoicing framework and accredited-service-provider requirement. Technical specification for PINT-AE (UAE Peppol International Invoice) sits here.
Ministerial Decision No. 244 of 2025 (as amended)
Effective dates by wave (Wave 1 ASP appointment 30 Oct 2026; go-live 1 Jan 2027 / Wave 2 appointment 31 Mar 2027; go-live 1 Jul 2027; government entities 31 Mar / 1 Oct 2027).
MoF E-Invoicing Guidelines v1.1 (June 2026)
Business-process and edge-case guidance including advance payments, retention, credit notes and free-zone treatment.
- UAE Ministry of Finance Accredited Service Provider register ↗
The authoritative list of MoF-accredited ASPs. Verify current status before contracting.
OASIS UBL 2.1 / Peppol BIS Billing 3.0
Underlying XML syntax and semantics on which PINT-AE is built.
Last verified against the sources above: 2026-09-24
Frequently asked questions
Is TrustBill itself on the MoF Accredited Service Provider register?+
The last-mile submission is performed by TrustBill's accredited ASP partner, Microvista Technologies LLC (MoF accreditation №157529). The MoF register is the authoritative source — always verify current status at mof.gov.ae before signing any contract that depends on ASP accreditation.
How is data segregated between customers?+
Every customer tenant has a distinct database schema, row-level security policies enforced at the database boundary, per-tenant KMS keys for at-rest encryption, and per-tenant audit logs. Cross-tenant access is prevented at every layer — application, database and infrastructure.
Where is my invoice data physically stored?+
In AWS me-central-1 (Dubai, UAE). This is the primary region for all invoice data, customer PII and audit logs. The failover region (AWS eu-west-1, Ireland) is a warm standby invoked only on primary-region failure; failover data is encrypted at rest with a separate KMS key and any failover event is logged and disclosed to affected customers.
What happens to my data if I cancel?+
Deleted-tenant data is purged 30 days after cancellation unless a legal-hold flag applies (open audit, litigation, regulator hold). During the 30-day grace period, you can restore the tenant. After purge, the data is unrecoverable — backup snapshots older than 30 days are also scrubbed of the cancelled tenant's rows on the next weekly rotation.
Can I audit TrustBill under my own security-review process?+
Yes. Enterprise customers receive a SOC 2 Type II-style controls package on request under NDA. The package covers access control, encryption, sub-processors, incident response, and change management. Email security@trustbill.ae to start the review.
Book an enterprise walkthrough
For enterprise procurement, compliance and legal teams: schedule a walkthrough of the controls package, sub-processor list, and ASP submission chain with a TrustBill security engineer.