InvoiceNext

The decisions

Nine parallel research missions produced roughly 10,000 lines of findings. These are the conclusions that survived them. Everything after this section is the evidence.

The clock

Both mandates are phased by turnover. Our customer is in the later band of each, which is more build runway than the headline dates suggest — and the reason the connector business earns revenue before the app does.

Verified — UAE dates from Ministerial Decisions 243, 244 of 2025 and 66 of 2026; Oman from Decision 189/2026. Three independent streams converged on the UAE dates.

The compliance model, in one paragraph each

Both countries run Peppol five-corner networks, and neither has a clearance gate. The invoice travels supplier → supplier's provider → buyer's provider → buyer, while a tax data document is reported to the authority in parallel. Oman's own architecture document — authored by OpenPeppol — states the authority validates that document against Schematron only, explicitly "not for tax compliance."

What is ours, and what is not

Market and the gap

The UAE's 156,000-business gap between VAT registrants and corporate-tax registrants is entirely sub-threshold businesses that are in scope and unserved. At AED 50–100 per month, one percent of the combined market is AED 3.8–7.6m ARR.

Where the gap actually is

Every mass-market SMB product — Zoho, Xero, QuickBooks, Odoo, Wafeq, Qoyod, Daftra — is absent from the accredited layer. Only Tally bridges both, and Tally is desktop-first with no Arabic UI. Meanwhile not one of the 42 accredited UAE providers publishes a price or offers self-serve signup.

Competitive set

Two watch items

• Zoho's UAE e-invoicing intentions are unknown and decisive. They already shipped full ZATCA Phase-2 clearance inside the free product for Saudi — so they can do this, and if they do it for the UAE the SMB opportunity narrows sharply. They have shipped nothing for Oman.
• Odoo already runs its own Peppol access point and SMP but excludes the Gulf — a product decision, reversible quickly.

ASP posture

Four providers, one abstraction, and a deliberate decision not to become one of them yet — with a single exception that has a hard deadline.

Verified UAE listings — read from the Ministry of Finance register (42 entries). Unverified Taxilla's Oman accreditation — claimed on their own site with no date, number or register link; the OTA publishes no public directory we could find. Ask them for the reference in the commercial conversation.

Should we become an ASP ourselves?

Not yet — the financial case is off by one to two orders of magnitude. Break-even on per-message pricing is roughly 5,300 customers white-label or 9,200 building it ourselves. We have zero.

The one thing that cannot be deferred

OpenPeppol's Managing Committee mandated ISO/IEC 27001 for every Peppol service provider on 24 June 2026: "From 1 January 2027 onwards, a New Service Provider will only be issued a first Peppol PKI Production certificate if it holds a valid ISO/IEC 27001 certificate." White-labelling does not exempt us — OpenPeppol's own security FAQ says so. Certification takes 6–12 months.

This is also counterparty risk on the providers we are about to depend on: non-compliant providers are publicly blacklisted on 1 May 2028 and their certificates revoked on 1 Jun 2028. "Do you hold ISO 27001, and will you by October 2027?" is a pass/fail procurement question for all four.

Fast-track options, ranked

1. Press all four for programmatic tenant provisioning — weeks, near-zero cost. This solves the real blocker without any accreditation. Complyance already exposes company creation and an integration-partner source type; ClearTax scopes every call by entity header.
2. White-label an accredited access point under our brand — 1–3 months.
3. Accredit through a wholly-owned Omani company on a licensed stack — 9–14 months, roughly €55–80k. The OTA sanctions every element of this in writing. This is the genuine fast-track.
4. UAE only: be the product supplier, not the licensed provider — the amended decision lets the partner carry the licence, business-continuity certification and insurance while we carry ISO 27001. Design toward it; it is a later option.
5. Acquire an accredited provider — 3–9 months, six to seven figures. Only worth revisiting if a small Oman provider is available cheaply.

Peppol certification, PKI, testbed status and ISO 27001 transfer between countries. National accreditation, the local entity and the country data specification do not.

The product

Zoho Invoice feature-for-feature is the brief. Their help guide, API reference and pricing gave us the real surface — fourteen modules, and a boundary they draw sharply.

Core — Zoho parity

Payables — the deliberate departure from Zoho

Zoho's own line is Invoice = receivables; Books = receivables, payables and accounting. We move payables inside the boundary and leave the ledger outside it. No chart of accounts, no journals, no bank feeds, no financial statements — but a full inbound side, because both regulators require a business to use one provider for both directions. A receivables-only product loses the deal to whoever does both.

The interface consequence: the payables inbox has buttons that change state on the Peppol network, which is unusual for an AP screen. Acknowledge and dispute must read as irreversible outbound actions, not as list-management. This is a specific thing to get right in the UI work.

Where we beat Zoho

• The e-invoice cockpit. Already built — see below.
• Retainer / prepayment invoices with a real UI. They exist in Zoho's API with no interface. Gulf contracting runs on advances, and Oman has a dedicated prepayment type (386).
• Debit notes, period locking, immutable numbering, outbound webhooks, real role-based access — all absent from Zoho Invoice, all cheap for us, all things a compliance buyer asks about.
• Arabic, properly. Zoho's Saudi edition does Arabic fields; we do the whole document and the whole interface.

The cockpit — already built, twice

The e-invoicing engine is a port, not a greenfield build. Two implementations exist: the JobNext production system (16 SQL migrations, a worker, QR, crypto, an ASP adapter layer, two UI screens, deployed) and a partial port already inside next2 in our exact target stack — api/app/einv/ at 1,571 lines, web/src/einv/ at 970 lines, three Alembic migrations, fully nav-wired, already fixing two defects the production version carries.

Arabic on day one

Oman's VAT Executive Regulations Article 144: "The issuance of the tax invoices shall be in Arabic. The tax invoice may be issued in English provided an Arabic translation is provided upon the Authority's request." Arabic is the default; English is the exception. The UAE imposes no language requirement but its authority can demand Arabic on audit.

Verified — four engines rendered the same bilingual Omani invoice, checked three ways. Presentation forms count baked-in shaped glyphs; zero means a clean logical-order text layer, which PDF/A-3 with embedded XML, search and audit all depend on.

Two more traps: ar-OM, ar-SA, ar-QA, ar-KW and ar-BH all default to Arabic-Indic numerals (ar-AE does not), so invoice numbers and tax registration numbers must be pinned to Western digits to match the machine-readable payload. And no production-grade Arabic font is installed on our build box — Noto Sans Arabic must be pinned as a build artifact, and it was the only candidate of five carrying tabular figures, without which decimal points do not align in an amounts column.

Connectors

Eighteen targets were assessed. The order is set by GCC installed base, not by API quality — and those turn out to be inversely correlated.

• Month 1: CSV/Excel import with a real validator, a public REST API with keys and a sandbox, email/SFTP drop. The public API turns every GCC reseller and systems integrator into a channel building at their own cost.
• Months 2–3: the on-prem agent and Tally together — one project, because Tally forces the agent to be genuinely general.
• Months 3–4: the cloud tier — Zoho Books, QuickBooks Online, Xero, Odoo.
• Months 4–6: SAP Business One, Sage 300, Dynamics 365 Business Central.
• Beyond: deal-led only.

Build the connectors; buy nothing. The unified-API vendors cover 7–14 of the 18, but Tally, Focus and Sage 300 are covered by none of them, our payload fits no unified model, and not one has a Middle East region — a live commercial objection when the payload is GCC tax data. The sharpest single opportunity found: UAE PINT AE for SAP Business One, where the incumbents are all chasing S/4HANA.

Pricing

The constraint

Zoho Invoice is free, forever — two users, 500 invoices a year, no paid tier at all; you upgrade sideways to Zoho Books. Wafeq sets the practical ceiling at AED 57 per month with unlimited users. We cannot win on price. We win on the mandate.

Against that, the only published provider cost is $1.10 per B2B invoice at list. A customer issuing 100 invoices a month would cost roughly $110 in cost-of-sale against about $16 in revenue. Per-invoice provider pricing at anything near list destroys the subscription model outright.

Three things that soften it

• That is a list price; volume wholesale rates will be materially lower — and none of the four will quote without a conversation.
• Every UAE business gets 100 free e-invoices per customer per year by law. Our exchange cost at the true bottom of the market is zero, which is what makes a free tier viable.
• Unlimited network access exists in the market at around €300 per year, and per-company pricing at €9–29 per month.

Working shape

Publishing a price is itself the differentiator. No accredited provider does. A business facing a deadline and unable to discover the cost of compliance without a sales call is the customer we are built for.

Name and website

Decided: InvoiceNext, joining JobNext, EstimateNext, BidNext and TalentNext. Mizan was rejected as too wide, Raseeda because it reads as receipt rather than balance.

Verified availability — whois and dig, 12 Aug 2026, with random-string probes confirming the regional registries have no wildcard. Unverified trademark — no formal search has been run. Nothing gets registered until UAE Ministry of Economy, Oman MOCIIP and WIPO searches are complete.

Two things to carry into the trademark work

• InvoiceNext is a descriptive mark, which is weak by construction — hard to register, hard to defend against an "InvoiceNow" or a "NextInvoice." A known trade-off, accepted for family fit and clarity.
• FatooraNext was rejected for a reason worth recording. ZATCA's Saudi portal is Fatoora and Oman's system is Fawtara — both target markets plus the largest neighbouring one. Beyond trademark weakness, searching the brand name would return the government portal, making us permanently invisible for our own name; and a name one letter from the national tax platform risks reading as official endorsement, which is exactly wrong for a vendor that is deliberately not accredited.

Website

A separate marketing site from the application, both served by the existing reverse proxy, which already handles multiple hostnames with automatic certificates. The site's job is narrow and unusual for this market: state the price, state the deadline, and let someone sign up. A deadline countdown by turnover band, a two-question "am I in scope and when" checker, and pricing above the fold. Bilingual from the first commit, not retrofitted.

Architecture

PostgreSQL, and what that does to reuse

Decided: PostgreSQL. Native row-level security, no per-tenant licensing, and the right engine for thousands of small tenants on a free tier — a different shape entirely from next2's handful of large ones.

Repository structure

Separate repository, own VM, our own kernel. Independent of the database choice, the numbers rule out sharing next2's: 286 of its 321 migrations reference the core or security schemas, 214 of them altering the row-level security policy, with kernel DDL interleaved at chain positions 1, 2, 3, 5, 2950, 3000, 3050, 3120, 4020 and 5002. That chain cannot be split against a live production database, which rules out both "a module inside next2" and "a monorepo with a shared schema kernel."

What crosses over is a versioned pure-Python package — money and currency, the import framework core, the approvals effects registry, grid and export — plus the conformance-test technique already keeping next2's Python and TypeScript money modules in sync. No shared schema, no shared migration chain, no cross-repository revision link.

The binding constraint is CI, not hosting

A second website is one line in the reverse-proxy config. But there is one self-hosted runner with one job slot, and next2's own traffic already produces measured queue waits of 30 and 37 minutes against a 34.5-minute median. Adding a second product would slow both. A separate VM at roughly $30 per month resolves it. Incidentally, the current box holds 38 GB of reclaimable build cache — the deploy script prunes images but never the builder.

What we take from next2

The one guard to carry over regardless

The information-architecture budget test: a CI-enforced numeric ceiling on navigation — total rows between 45 and 95, no workspace over 28, and every rail row must exist in the command palette. It is what stops a product accreting screens until it is unusable, and it is the most transferable thing in the repository.

Build plan

Same methodology as next2: parallel worktree missions with disjoint ownership, each on its own database, a checkpointed build journal, adversarial review before merge, and a burn-down matrix as the single instrument of progress.

Decisions taken, and what remains

Resolved 12 August 2026. Three items remain open, and two of them have external clocks.

Settled

Open, with clocks

ISO 27001 — the practical shape

• It certifies a management system with a scope you define — neither inherently organisation-wide nor per-product. Scope it to the InvoiceNext service, not to "the India company's operations."
• Use an accredited certification body (an IAF signatory — NABCB in India). Non-accredited certificates are cheap and get rejected.
• Budget three months of the system genuinely operating before the Stage 2 audit. The 6–12 month estimate is real, not padded.
• The UAE additionally requires ISO 22301 for business continuity — same scope logic, and cheaper done alongside than twice.

What we don't know

Listed because the failure mode of a sweep this size is a confident, plausible, wrong finding surviving into the plan.

• Unverified Taxilla's Oman accreditation. Claimed on their site with no date, number or register link. I previously reported the opposite based on a list published by a competitor — that was wrong to state as fact. The OTA appears to publish no public directory.
• Unverified Oman's accredited-provider count. Two streams say 11 and 22. Neither is the OTA's own register.
• Unverified Trademark clearance on every candidate name. No formal search has been run.
• Unverified Which Sage X3 version ships the GraphQL API, and whether it is cloud-only. This single unknown gates our largest connector estimate. A one-day spike against the public sandbox resolves it.
• Secondary Money precision in Oman — 2 or 3 decimals. The provider has not answered since 15 July. The architecture's own QR examples use 3; the scenario workbook assumes 2. Make it configurable.
• Secondary The corner-1 "no accreditation needed" reading. Drawn from the operative texts; the Ministry has never published those exact words. Confirm with counsel before contracting.
• Unverified Our own QR implementation. The tag numbers and UUID namespace in the existing code are explicitly best-guess constants, never validated against the OTA specification. Deliberately isolated so verification is a constants edit — but it is not done.

Research index

All findings are on disk at ~/projects/einvoicing/research/. Roughly 10,000 lines with citations.