Arratech Connect, Technical Brief

What it is

Arratech Connect is a B2B SaaS platform for electronic invoicing and Peppol document exchange. Customers send and receive invoices, credit notes, and other business documents through the Peppol network via Arratech’s certified Access Point (AP) and Service Metadata Publisher (SMP). Arratech is a certified Peppol Service Provider, with OpenPeppol Service Entity ID PSE000778.

Two product models exist:

  • Shared AP: the customer is a participant under Arratech’s own Access Point. Default model.
  • Whitelabel AP: Arratech hosts a customer’s own Access Point, for customers that are themselves approved Peppol Service Providers.

Document validation, Applicability Statement 4 (AS4) send and receive, SMP publication, tenant management, reporting, and a customer portal are all delivered as one integrated platform.

Where it runs

Arratech Connect is cloud-native, running primarily on Amazon Web Services (AWS), provisioned as code with OpenTofu. The entire environment is reproducible from version control.

  • Default region: eu-central-1 (Frankfurt, Germany).
  • Compute: AWS Fargate (long-running) and AWS Lambda (event-driven). No Elastic Compute Cloud (EC2), no Elastic Kubernetes Service (EKS).
  • Data: DynamoDB (operational), S3 (documents, archives, data lake), OpenSearch (search and logs).
  • Identity: Amazon Cognito.

The platform is multi-region and multi-cloud by design. A customer’s region is fixed at onboarding and the data stays there. The default deployment is eu-central-1; the same OpenTofu modules provision a self-contained stack in additional AWS regions, and, where a national qualification requires it, in other clouds. For example, a SecNumCloud-qualified module on GCP S3NS serves the French market. New regions and clouds are deployed as customer demand and national mandates require.

Environments are fully isolated. Development, staging, and production each run in separate AWS accounts with separate Cognito user pools and separate data stores.

How you connect

Two customer-facing surfaces:

  • api.arratech.com: REST API for submission, retrieval, and tenant management. Behind an Application Load Balancer (ALB) with AWS Web Application Firewall (WAFv2) in front.
  • app.arratech.com: the Connect web portal, hosted on AWS Amplify and served via CloudFront.

Documents are submitted to the API in two ways. (1) Presigned-URL upload: the client requests a presigned URL and PUTs the document directly to S3, suited to larger payloads and bulk submission. (2) Direct API: the client POSTs the document body and the platform stores it on the customer’s behalf. Either path triggers the outbound pipeline.

For inbound documents, customers receive notification through:

  • Webhooks. A subscription is created via the API and returns a secret at creation time. Each delivery carries an HMAC signature derived from the request body and that secret, so the receiver can verify authenticity before processing. Deliveries are queued on a FIFO SQS queue with retry and dead-letter behaviour.
  • REST polling of the documents endpoints.
  • Email notifications and in-app announcements via the portal.

API authentication is Cognito-issued bearer tokens. All external traffic is HTTPS, with Transport Layer Security (TLS 1.2 minimum, 1.3 supported) and certificates issued and auto-renewed by AWS Certificate Manager (ACM). Port 80 redirects to 443 on every public listener.

Peppol path

Arratech operates its own AS4 Access Point and its own Service Metadata Publisher.

Outbound (Arratech as Corner 2, C2)

Document lands in S3 → transaction-sender (Lambda) is triggered → document is validated against the applicable Business Interoperability Specifications (BIS) and Peppol International (PINT) rules → recipient AP is discovered via Peppol U-NAPTR Domain Name System (DNS) lookup (Service Metadata Locator (SML) → SMP) → message is signed using Arratech’s OpenPeppol Public Key Infrastructure (PKI) key and dispatched over AS4 to the recipient AP → Message Level Status (MLS: AB/AP/RE) returned by Corner 3 (C3) is recorded.

Inbound (Arratech as C3)

AS4 message terminates at the receiver ALB → transaction-receiver (Fargate) authenticates the partner AP’s signature against the OpenPeppol PKI trust chain → Standard Business Document Header (SBDH) is parsed → payload is validated → the document is persisted and surfaced to the customer through API, portal, or webhook → MLS response is returned to the partner AP.

Document validation is a single Rust service that enforces Peppol BIS, PINT, and country-specific business rules.

Data and crypto

  • At rest. Advanced Encryption Standard 256-bit (AES-256) across all stores (DynamoDB, S3, OpenSearch, Elastic Container Registry (ECR), Fargate ephemeral). Default keys are AWS-managed in the Key Management Service (KMS). OpenPeppol PKI private keys (G3 generation, with dual-chain G2 transition support) are additionally encrypted at the application layer with a dedicated Customer-Managed Key (CMK) that enforces an encryption context. Decryption requires a valid Identity and Access Management (IAM) role and a matching context, or it fails.
  • In transit. TLS 1.2/1.3 externally; AS4 messages signed and encrypted per the Peppol AS4 profile using OpenPeppol PKI certificates; service-to-AWS traffic at TLS 1.2 or higher via the AWS Software Development Kit (SDK).
  • Backups. DynamoDB point-in-time recovery (any state in the last 35 days), S3 versioning, OpenSearch daily snapshots, daily AWS Backup of tagged resources retained 35 days. The whole environment is replayable from OpenTofu.

Security and monitoring

  • AWS WAFv2 in front of every public endpoint, with AWS-managed rule sets (IP reputation, OWASP-style common rules, known-bad inputs) and rate limiting (global, plus tighter limits on sensitive paths such as signup).
  • Amazon GuardDuty for managed threat detection, including S3 Malware Protection.
  • AWS CloudTrail with S3 data events to a KMS-encrypted, versioned, immutable audit bucket.
  • Amazon CloudWatch for metrics, logs, and alarms; alerts fan to a dedicated Slack channel and on-call email via Simple Notification Service (SNS) and EventBridge.
  • Virtual Private Cloud (VPC) Flow Logs retained 90 days.
  • Drata for continuous automated compliance checks; tickets raised on control drift.

Monitoring is operated internally by the Arratech platform team. Critical alerts are triaged in real time by on-call. An Incident Response (IR) process (detection, triage, containment, remediation, post-mortem, customer communications) is in place and integrates with Drata IR controls.

MFA and identity

Identity is Amazon Cognito. Supported second factors today: Time-based One-Time Password (TOTP) via authenticator apps, and Short Message Service (SMS) one-time codes. Multi-Factor Authentication (MFA) is enforced per customer organisation via an mfaRequired flag. When enabled, every member of the org must have MFA, and users cannot disable their own MFA while they belong to such an org. Sensitive operations (including changes to the org’s MFA policy) require MFA. Arratech personnel accessing logs, metrics, or customer data are required to use TOTP MFA by internal policy.

Releases and compliance

Arratech operates continuous delivery. Merges to main flow through Pull Request (PR) review, full automated test suite, version bump, and GitHub Actions deploy via short-lived OpenID Connect (OIDC) credentials, with no long-lived AWS keys in Continuous Integration (CI). Lambda services deploy via S3 artefact, container services via ECR → Fargate. Every release is tagged and immutable; rollback is a redeploy of the previous tag, typically minutes. A canary header at the load balancer enables targeted pre-prod verification for higher-risk changes.

Compliance posture today

OpenPeppol certified Service Provider (PSE000778). Drata-driven continuous compliance.