KSeF's invoice keys are in hundreds of places!

niepoprawni.pl 3 weeks ago

Of course, the title is simply a rhetorical shorthand — of course, I do not claim that there are precisely 100 copies of the complete set in each company. But the essence of the problem does not change!

This key is not a PIN or token generated specifically for access. That's 5 fields:

➡️ KSeF number,
➡️ invoice number,
the buyer's NIP,
The name of the buyer,
➡️ gross amount.

So it's a simple operating invoice. They are adequate to let everyone to download the invoice anonymously within 10 years. The Ministry of Finance itself foresees their distribution outside the invoice warehouse. The KSeF number from February 2026 is shown in JPK_VAT and from 2027 is expected to appear besides on invoice payments. The invoice number, NIP, counterparty name and gross amount are in turn the basic fields of virtually all accounting system, ERP, acquisition register, cost study or export to Excel.

Moreover, the Ministry of Finance itself describes the confirmation of the transaction which contains the buyer's data, the invoice number and the full amount, and the code or link to access the invoice without logging in. And the authoritative KSeF manual confirms that an anonymous invoice search requires the KSeF number and these 4 average business data.

Full XML invoice sits in a well protected repository, with RBAC, access audit and export ban. However, the control department staff gets the table: the contractor, the NIP, the invoice number, the amount, the KSeF number — due to the fact that specified data is needed for the arrangement. The accountant exports it to XLSX. The study sends an email to the director. BI keeps these columns in the warehouse. The invoice number and the amount can be found in the ticket helpdesk and the KSeF number in the settlement table. This data is backed up for years.

You don't even request to find 1 file containing all 5 columns. Just combine 2 sets after the invoice number, the contractor or the KSeF number. It's an component of data analysis.

The problem is that KSeF changes the safety classification of average metadata. Data that previously said at most: "X company received invoice No. 123 on 57,432 PLN", after collecting 5 fields, become a certificate allowing to download the first paper from the state system.

The claim that all companies keep these 5 fields in hundreds of files is just a general description. However, these fields, by the nature of the accounting circuit, happen in a number of systems and copies that previously did not should be protected as authentication data. KSeF makes it right now. And that is the simple plan mistake of this mechanism, making KSeF a spy max.

Grzegorz GPS Swiderski
]]>https://Twitter.com/gps65]]>
]]>https://t.me/CanalBlogeraGPS]]>

PS. Selection of my latest articles on KSeF: