Greece myDATA E-Invoicing

Paid pluginsize Lplanned, not built

Indicative price, not an offer: $799–1,999/year

Generated from docs/plan/paid/greece-mydata-e-invoicing/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Paid module (EUR 99–199/month) for Greece: real-time e-invoicing to AADE (Hellenic Ministry of Finance) myDATA platform. Every B2B and B2C invoice is transmitted in real time via XML, AADE validates and returns a unique reference number, and receipt stores the reference. Non-compliance is a criminal offense in Greece (daily fines + potential jail time for officers). This is the highest-risk jurisdiction for AstroBaaS merchants.

The problem

My orders are not e-invoiced to Greece’s tax authority (AADE myDATA). I record receipts manually with no real-time compliance. AADE audits are unannounced; I cannot prove I transmitted invoices on time. Non-compliance is a criminal offense (daily fines + possible jail time).

What it does

• AADE myDATA API integration: real-time transmission of invoice XML (one transmission per invoice, immediately after order capture)
• Certificate management: merchant provides AADE-issued digital certificate (PKCS#12 format); module stores and uses it for signing
• Invoice transmission workflow: checkout creates order → order is immediately transmitted to AADE via signed XML → AADE validates and returns mark (reference number) → mark is stored in invoice record
• Transmission audit log: every transmission (time, XML sent, response received, mark assigned) is logged in AstroBaaS for merchant/auditor review
• Error handling: if AADE rejects an invoice (invalid format, business rule violation, certificate expired), the order is marked as ‘Transmission Failed’ and merchant receives urgent email + admin alert
• Retry logic: failed transmissions are automatically re-attempted (configurable: immediately, hourly, daily) until successful or merchant intervenes
• Receipt document: invoice displays AADE mark (unique reference number per invoice) and transmission timestamp for audit trail

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• No AADE certificate provisioning — merchant must obtain certificate from AADE directly (reason: certificate is a legal/identity document; AstroBaaS cannot request it on behalf of the merchant)
• No multi-language legal templates — invoices are in Greek; translation is merchant’s responsibility (reason: tax authorities require specific legal language; auto-translation is not acceptable)
• No support for other Greek tax schemes (VAT groups, reverse charge, special regimes) beyond standard B2B/B2C (reason: these are edge cases; merchants in complex scenarios hire Greek accountants)

Data model

Settings: aade_certificate_file (binary, PKCS#12), aade_certificate_password (encrypted), aade_is_test_mode (boolean). Order gains aade_mark (unique reference string, nullable), aade_transmission_date (timestamp), aade_transmission_status (enum: pending | success | failed_retry | failed_fatal). New AuditLog: {order_id, event: ‘aade_transmission’, status, aade_response, timestamp}.

API

• POST /api/settings/aade/upload-certificate { certificate_file, password } (admin only; stores encrypted)
• POST /api/orders/:id/transmit-to-aade (manual retry, admin only)
• GET /api/orders/:id/aade-status → { mark, transmission_date, status, last_error_message }
• GET /api/aade/transmission-log (admin only, paginated, all transmissions)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Settings → Tax → Greece AADE myDATA: button to upload certificate (choose PKCS#12 file, enter password). Test button to validate certificate with AADE sandbox. Settings also show current certificate expiry date and renewal reminder. Orders table gains ‘AADE Mark’ column (green checkmark if transmitted successfully, red X if failed). Order detail page shows transmission timestamp, mark, and full XML/response log for troubleshooting.

The seam — why this is paid

Paid module owns AADE API integration, certificate management, and transmission audit trail. Core owns order storage and receipt generation (module only adds the mark to the receipt). Merchant owns obtaining the certificate and maintaining it (renewing before expiry).

Greece-specific legal obligation. Requires AADE API credential (certified service). High support commitment: AADE sandbox sign-off, invoice rejection handling, multi-language error reporting, and regulatory audit trails.

Dependencies

• Order entity (core)
• Invoice/receipt generation (core)
• Settings (core)
• AADE myDATA API (third-party: requires merchant’s certificate)
• XML generation library (core or module)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Checkout completes an order; within 2 seconds, order is transmitted to AADE; AADE returns a mark (e.g., ‘1234567890’)
• Order detail page shows mark and transmission timestamp; receipt PDF displays mark in a prominent field
• AADE certificate expires in 30 days; admin sees warning in Settings and on dashboard
• Transmission to AADE fails (network down); module logs error, retries hourly, and alerts merchant via email
• Manual retry button: admin clicks ‘Retry transmission’ on a failed order; module re-sends XML and updates mark if successful
• Transmission audit log shows every transmission: time, order ID, mark assigned, AADE response status (validated | error [reason])

Risks

Certificate expires during deployment; transmissions fail until renewed (merchant must proactively renew). AADE API is down during checkout; transmission stalls (need timeout + async retry queue). XML schema changes when AADE updates myDATA (need to track upstream schema changes). Merchant uploads wrong certificate (personal, not business); transmissions fail with cryptic error (need clear error message). AADE audits ask for transmission logs; logs are deleted (need long-term retention or archival).

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.