Skip to content
ARRANTO

FatooraLite Pro — Executive Summary & Product Architecture Guide

[!NOTE]
Document Purpose: This executive summary outlines the business model, regulatory compliance framework, core technological differentiators, and target customer personas for FatooraLite Pro — a next-generation SaaS platform engineered for Saudi Arabia's ZATCA Phase-2 E-Invoicing (Integration Phase) mandate.

1. Product Vision & Value Proposition

In the Kingdom of Saudi Arabia (KSA), the Zakat, Tax and Customs Authority (ZATCA) mandates that all VAT-registered commercial entities integrate their billing systems with the government's central Fatoora Portal.

FatooraLite Pro eliminates the high technical and financial barrier of custom ERP integration by delivering an all-in-one, multi-tenant SaaS platform. Small-to-Medium Enterprises (SMEs) and mid-market organizations can onboard their business within 5 minutes, generate cryptographically signed UBL 2.1 XML invoices, and automatically clear or report invoices to ZATCA in real time.

graph LR
    SME["Saudi SME / Enterprise"] -->|1. Simple Web / PWA Interface| App["FatooraLite Pro Engine"]
    App -->|2. ECDSA secp256k1 & XAdES-BES| XML["Signed UBL 2.1 XML"]
    XML -->|3. Real-Time Clearance API| ZATCA["ZATCA Fatoora Platform"]
    ZATCA -->|4. Approved Clearance Stamp| Client["End Customer (Cleared XML + PDF A/3)"]

2. Regulatory Problem & Market Opportunity

Since Phase 2 enforcement began, standard paper and basic PDF invoices are non-compliant and subject to heavy regulatory penalties:

  • B2B Clearance Mandate: Standard Tax Invoices must be transmitted to ZATCA's API and cleared in real-time before they can be lawfully issued to a business buyer.
  • B2C Reporting Mandate: Simplified Tax Invoices must be cryptographically signed, stamped with a 9-tag TLV QR code, and reported within 24 hours.
  • Cryptographic Complexity: Invoices require ECDSA secp256k1 keypairs, XAdES-BES digital signatures, xml-exc-c14n11 canonicalization, SHA-256 Previous Invoice Hash (PIH) chaining, and strict BR-CO-17 tax rounding standards.

The Opportunity: Building in-house ZATCA integration costs organizations upwards of 50,000–150,000 SAR in development and ongoing compliance maintenance. FatooraLite Pro turns this complex compliance burden into a seamless, automated SaaS subscription.

3. Targeted User Personas & Workflows

FatooraLite Pro features a tailored experience optimized for four primary enterprise roles:

User Workflows by Persona
├── 1. Business Owner (Overall Revenue, Tax Health, Subscription & Multi-Branch Management)
├── 2. Accountant / Finance Manager (Daily Invoicing, B2B Clearance, Credit/Debit Notes, Tax Returns)
├── 3. Sales Representative (Quick POS / B2C Simplified Invoicing, Customer Directory)
└── 4. Auditor / Compliance Officer (Immutable Audit Trail, Hash Chain Verification, ZATCA XML Downloads)
PersonaPrimary Needs & ActionsFatooraLite Pro Capabilities
Business OwnerRegulatory compliance, tax liability tracking, branch management.High-level dashboard, multi-branch switching, role assignment, subscription management.
AccountantFast invoice creation, clearance monitoring, credit/debit notes.Single-click clearance, automated 15% VAT calculation, UBL 2.1 XML and PDF A/3 downloads.
Sales RepRapid customer checkout, POS invoicing, inventory selection.Instant B2C invoice generation, mobile-optimized TLV QR code printing.
AuditorProof of ZATCA filing, tamper-evident hash verification.Read-only compliance portal, raw XML payload inspection, PIH hash chain audit.

4. Key Differentiators & Technical Excellence

  1. Native pgvector RAG Assistant: An embedded AI assistant grounded on curated ZATCA tax codes (global context) and tenant business records (company context). Users can query regulatory rules or issue natural-language operational commands ("Draft invoice for Acme Corp").
  2. Built-in Cryptographic Engine: Pure Node.js/TypeScript cryptographic suite (lib/zatca/) implementing ECDSA secp256k1, X.509 CSR generation, XAdES-BES signing, C14N-11 canonicalization, and TLV QR encoding without heavy external binary dependencies.
  3. Enterprise Security & Multi-Tenancy: Strict database-level companyId tenant isolation, JWT sessionVersion instant revocation, AES-256 encrypted keys at rest, and Zod schema input validation across all endpoints.
  4. Resilient Architecture: Next.js 16 App Router with Turbopack, Neon serverless Postgres, and automated test harnesses enforcing 100% pass rates across Vitest unit tests and ZATCA compliance checks.

5. Master Documentation Directory

For detailed operational specifications, explore the complete documentation suite: