E-Invoicing Archives: How to Prove Your Invoices Haven’t Changed for 10 Years

An invoice is one of the few business documents that every company must be able to reproduce, unchanged, years after it was issued. Tax authorities across the European Union can request an invoice long after the transaction, and when they do, the question is not only whether the invoice exists, but whether it can be shown that its content has not been altered since the day it was issued.

For paper invoices, this was largely a matter of physical storage. For electronic invoices, it is a matter of evidence. And with the VAT in the Digital Age (ViDA) package making structured e-invoicing the norm across the EU, the number of invoices that exist only in electronic form is about to grow dramatically.

This article is written for e-invoicing service providers, ERP and billing platform vendors, accounts payable and receivable automation providers, and finance and tax teams responsible for invoice archives. It explains what EU law requires, why transmission and storage alone do not prove integrity, and how qualified timestamps provide that proof at scale.

What the VAT Directive requires

Article 233 of Council Directive 2006/112/EC sets the core obligation: the authenticity of the origin, the integrity of the content and the legibility of an invoice, whether on paper or in electronic form, must be ensured from the point in time of issue until the end of the period for storage of the invoice.

The Directive defines the two key terms precisely:

• Authenticity of the origin means the assurance of the identity of the supplier or the issuer of the invoice.
• Integrity of the content means that the content required by the Directive has not been altered.

Each taxable person decides how to meet these requirements. Article 233 allows business controls that create a reliable audit trail between an invoice and a supply of goods or services, and gives two technology examples for electronic invoices: advanced electronic signatures based on qualified certificates, and EDI with procedures guaranteeing authenticity and integrity.

Article 247 leaves the storage period to each Member State, and allows Member States to require that electronic invoices be stored in their original form, together with the data guaranteeing their authenticity and integrity. In practice, storage periods across the EU commonly range up to ten years, and longer in some cases, depending on the country and on tax assessment and limitation rules.

The consequence is simple: whatever method a company chooses, it must be able to demonstrate integrity for the entire storage period, not just assert it.

ViDA: e-invoicing becomes the default across the EU

The VAT in the Digital Age package was adopted by the Council on 11 March 2025 and published in the Official Journal on 25 March 2025. Among its key changes:

• Member States may impose mandatory domestic e-invoicing without first requesting a derogation from the Commission, and an increasing number are doing so or preparing to.
• From 1 July 2030, digital reporting requirements based on structured e-invoices apply to intra-EU B2B transactions, using the European standard EN 16931.
• By 1 January 2035, Member States with existing domestic real-time reporting systems must align them with the EU standard.

For e-invoicing providers and ERP vendors, this means one thing: invoice volumes processed electronically will grow across every Member State and every customer segment, and so will the size of the archives that must be kept verifiable for years.

Why transmission and storage are not proof of integrity

A common assumption is that structured e-invoicing solves the integrity question by itself. It does not.

• Secure transmission protects the invoice in transit, not in storage. Once the invoice is delivered and archived, the transport channel no longer guarantees anything about it.
• Database records and audit logs are controlled by the company itself. They can support an audit trail, but they rely on the integrity of the same systems that hold the invoices.
• Tax reporting does not replace the taxable person’s own obligation. Even where invoice data is reported to the tax authority, Article 233 still requires each company to ensure the integrity of the invoices it stores, both issued and received.
• Disputes are not only with tax authorities. Customers, suppliers, auditors and courts may all need to rely on an invoice as evidence, without access to the reporting systems of a tax authority.

What is needed is independent, verifiable evidence that the invoice existed in a specific form at a specific time, and that it has not changed since.

How qualified timestamps provide the proof

A qualified electronic timestamp, issued by a Qualified Trust Service Provider under the eIDAS Regulation (EU) No 910/2014, binds the cryptographic hash of the invoice to a date and time certified by an independent authority. Under Article 41(2) of eIDAS, it enjoys a legal presumption of the accuracy of the date and time and of the integrity of the data, and under Article 41(3) it is recognised as qualified in every Member State.

Combined with an electronic seal of the issuing company (Articles 35 and 36 of eIDAS), which proves the authenticity of the origin, the qualified timestamp provides exactly the two properties Article 233 requires:

Because the presumption comes from EU law, the evidence is recognised in every Member State. A company issuing invoices in several countries does not need a different integrity mechanism for each tax administration.

Implementation patterns for high-volume invoicing

Timestamping is fully automated and adds only milliseconds to invoice processing. Only the hash of each invoice is sent to the timestamping authority; invoice content never leaves your systems. The most common patterns are:

Structured invoices (UBL, CII). The XML invoice is sealed with an XAdES signature extended with a qualified timestamp (XAdES B-T, and B-LTA for long-term archiving), or packaged in an ASiC container with the seal and timestamp alongside the original file. The structured data itself is not altered, so it remains fully compliant with EN 16931 and with Peppol or other transmission networks.

PDF invoices and hybrid formats. PDF and PDF/A-3 invoices, including hybrid formats that embed structured XML, are sealed as PAdES and extended to B-LTA. Recipients can verify the seal and timestamp directly in Adobe Acrobat.

Received invoices. Accounts payable platforms timestamp each received invoice at the moment of receipt, together with its transmission metadata. This proves what was received and when, which matters for the right to deduct VAT and in disputes with suppliers.

Long-term archive. Archived invoices keep their seals, timestamps and validation data. Before the timestamping certificates or algorithms approach the end of their recommended lifetime, archive timestamps are added (PAdES/XAdES B-LTA or RFC 4998 Evidence Records), so the evidence remains valid for the entire storage period.

Planning the volume

Invoice timestamping scales with transaction volume. A simple planning model: one qualified timestamp per invoice at issue or receipt, and typically a second one when the invoice is extended to B-LTA for long-term storage.

For an e-invoicing provider or ERP vendor processing invoices on behalf of many customers, these figures multiply across the customer base. As ViDA extends mandatory e-invoicing to more Member States and transaction types, the volume curve only goes one way.

What to require from your timestamping provider

• Qualified status in the EU Trusted Lists, with a timestamping service listed as qualified (QTST) and granted. Only qualified timestamps carry the presumption of Article 41(2).
• High availability, because invoice runs are time-critical, especially at month-end and year-end.
• No quotas or throttling, so a peak invoicing run never blocks.
• Standard RFC 3161, compatible with any XAdES, PAdES or ASiC implementation.
• Hash-only requests, so invoice data, which often includes personal and commercial information, never leaves your infrastructure.
• Predictable pricing at volume, with packages that match transaction volumes rather than user counts.

How qtsa.eu supports e-invoicing workflows

qtsa.eu provides qualified electronic timestamps issued by AlfaTrust Certification S.A., a Qualified Trust Service Provider supervised under eIDAS and listed in the EU Trusted Lists for the issuance of qualified electronic timestamps. The service is built for continuous, high-volume invoice processing:

• eIDAS qualified and listed in the EU Trusted Lists. Every timestamp carries the legal presumption of Article 41(2) and is recognised in all EU Member States, whichever tax administration you deal with.
• Uptime above 99.9%. A highly available service for invoice runs that cannot wait.
• Simple to use, without restrictions. A standard RFC 3161 endpoint for any XAdES, PAdES or ASiC implementation. No daily or monthly quotas and no throttling, including during month-end and year-end peaks.
• 24-month validity. Every prepaid package can be used over 24 months from the date of purchase, so seasonal invoicing peaks never lead to unused timestamps.
• Volume packages up to 1.200.000 timestamps, with tailored offers for e-invoicing providers and platforms with higher volumes.
• Hash-only requests. Invoice content never leaves your systems.
• No VAT for EU businesses. Companies registered in another EU Member State with a valid VAT number are invoiced under the reverse charge mechanism.

Test it on your invoice flow

Request 50 free qualified timestamps, add our TSA to your invoice sealing or archiving process, and verify the result with your own validation tools or in Adobe Acrobat. Our integration guides cover the most common environments, and our team can help you size a package for your invoice volume.

Get 50 free eIDAS qualified timestamps → | See volume packages →

Frequently asked questions