Security boundaries

What the application enforces by itself — and where its limits lie. The second part is the more important one: it says what the environment has to provide.

What the application enforces

Measure	Effect
Upload limit	applies to the web server and to the multipart limit; above it, 413 before the content is processed
No DTD (XXE)	the engine reads invoice XML with DTD processing prohibited and without an entity resolver. An external entity can therefore neither read files nor trigger network access
Schema validation is local only	validation runs against the bundled schemas; the schema resolver resolves locally only. A schemaLocation in the document triggers no network access — otherwise every uploaded invoice would be an SSRF vector
No external hosts (CSP)	default-src 'self', scripts only with a nonce, no inline scripts. All libraries sit locally — no CDN. In OnPremise mode the policy is purely 'self'
Bot protection on forms	a honeypot field and a signed timing trap on all form pages. Failures in the protection itself let the request through rather than making the page unusable
Rate limiting	a fixed counting window per address or per API key, without a queue
Passwords	PBKDF2-HMAC-SHA256, 210,000 iterations, a separate salt per account; a minimum of 12 characters; lockout after 10 failed attempts for 15 minutes
Sign-in links	valid for 15 minutes, redeemable once, stored only as a hash; a confirmation page prevents a mail scanner from completing the sign-in
API keys	the key store holds SHA-256 hashes only; the plaintext appears once on creation and exists nowhere afterwards
Cookie and antiforgery	HttpOnly, SameSite=Lax and, outside development, Secure; the keys sit in the persistent ring under .aspnet\
Separation of tenants	every archive query is constructed per tenant; membership is read afresh on every request, so a withdrawal takes effect immediately

Limits you need to know

Whoever reaches the command line on the server reaches everything

Keys, plans, passwords, emergency access. That is deliberate — there is no second login system above the installation — but it requires treating server access accordingly.

/api-docs and /openapi/v1.json are public, including in the Enterprise installation. They contain the description of the interface, not any data; anyone who does not want that hides the paths at the reverse proxy.

The interface is not automatically forced over HTTPS. There is no redirect from HTTP to HTTPS and no “HTTPS only” option in the installer; anyone needing both arranges it at the proxy.

The licence-dependent part is fail-soft

Without a licence key, OCR and template PDFs deliver no result but also no error that aborts processing — a silent functional gap, with the reason in the log. Anyone expecting OCR checks the log.

The interface is translated, not every validation finding. Some messages come from the engine and are in German; rule IDs and BT references are language-neutral.

What belongs in the backup

Two folders in the program directory are security-relevant and easily overlooked: keys\ with the key hashes and .aspnet\ with the key ring. See Data and backup.