Digital Certificate Mandate and Custody Addendum (e-CF)

1. Scope of Addendum and Automated Technical Mandate (Law No. 126-02 and Law No. 32-23)

This Digital Certificate Mandate and Custody Addendum (hereinafter, the "e-CF Addendum") forms an integral and indivisible part of the SaaS Subscription and Terms of Service of AHORRATECH, EIRL, and is mandatory for every Client or Taxpayer that imports, replaces, or configures an electronic signature Digital Certificate (in PKCS#12 format, .p12 or .pfx extension) within the Electronic Invoicing module of Ahorra POS.

Pursuant to Dominican Law No. 126-02 on Electronic Commerce, Documents and Digital Signatures, its Implementing Regulation (Decree No. 335-03), Law No. 32-23 on Electronic Invoicing, and Decree No. 587-24, the Client hereby grants to the automated computer systems of AHORRATECH a specific, non-discretionary, and strictly instrumental technical mandate to: (a) hold in encrypted custody the binary file of its Digital Certificate (.p12 or .pfx) and its activation password; and (b) execute in an unattended manner the standard XMLDSig digital signature (RSA-SHA256 algorithm with C14N 1.0 canonicalization) over the XML files corresponding to Electronic Fiscal Receipts (e-CF), Electronic Consumer Invoice Summaries (RFCE), Sequence Voids (ANECF), Receipt Acknowledgments (ARECF), Commercial Approvals or Rejections (ACECF), certification portal application or sworn statement files, and authentication seeds required by the Web Services of the General Directorate of Internal Revenue (DGII).

2. Real Cryptographic Security Architecture and Custody in AES-256-GCM Vault

AHORRATECH implements industrial-grade cryptographic controls to protect the Taxpayer Digital Certificate. Upon receiving the .p12 or .pfx file (up to a maximum size of 50 KB) and its password over a secure TLS connection, the server reader component validates in memory that the PKCS#12 container holds a valid RSA private key and a currently valid X.509 certificate, extracting only its public metadata (subject name, tax serial or document number SN, issuing authority, validity dates, and SHA-256 fingerprint). The password is never stored in the user web browser.

Immediately thereafter, the Ahorra POS cryptographic vault separately encrypts the binary bytes of the .p12 file and the UTF-8 bytes of the password using the AES-256-GCM authenticated encryption algorithm with a 256-bit master key managed in a secure server environment, generating unique 96-bit (12-byte) random initialization vectors (nonces) for each operation and binding the unique numeric identifier of the Client organization (tenant_id) as Associated Authenticated Data (AAD). This cryptographic isolation via AAD mathematically guarantees that the encrypted certificate of one Taxpayer can never be decrypted or used under the context of another organization within the database.

During checkout sale issuance at the point of sale, expense recording with an electronic voucher, or authentication with the DGII, the internal certificate provider decrypts the .p12 file and its password solely and exclusively in volatile process memory (RAM) for the milliseconds required to apply the XMLDSig signature and validate the document against the official DGII XSD schema, without ever writing the private key or password to hard disk, temporary files, or audit logs. The Client may revoke or replace active custody at any time from the Fiscal Setup tab by removing or replacing the certificate.

3. Legal Presumption of User Authorization and Non-Repudiation of Issued Documents

The Client acknowledges and agrees as an absolute contractual presumption before AHORRATECH that every Electronic Fiscal Receipt (e-CF), Summary (RFCE), Credit Note (E34), Debit Note (E33), Purchases Voucher (E41), Minor Expense Voucher (E43), Sequence Void (ANECF), Receipt Acknowledgment (ARECF), or Commercial Approval (ACECF) whose generation is triggered from any active user account linked to its organization in Ahorra POS (whether holding an administrator role, cashier role, or any custom role configured by the Client) has been legitimately and validly instructed, authorized, and consented to by the RNC holder and its Delegated Signer.

Pursuant to Article 34 of Law No. 126-02 and the provisions of Law No. 32-23, electronic documents digitally signed with the active certificate configured by the Client produce full legal and tax effects and carry a presumption of integrity, authenticity, and non-repudiation. AHORRATECH is fully and completely released from any civil, administrative, or tax liability arising from: (a) human data entry errors, incorrect charges, improper discounts, or wrong receipt type selection committed by the Client cashiers, accountants, or employees; (b) abusive or unauthorized use of internal user accounts due to failure to timely revoke access for former staff; or (c) theft, loss, phishing, or compromise of login credentials or the original .p12 file on the Client devices.

4. Exclusive Obligations of the Taxpayer Regarding Certificate, Delegated Signer, and OFV

It is the sole, exclusive, and non-delegable responsibility of the Client to: (a) apply for, purchase, and maintain in force its individual Digital Certificate for tax procedures or digital signing from a Certification Entity duly accredited or authorized by the Dominican Institute of Telecommunications (INDOTEL); (b) register and keep active in the DGII Virtual Office (OFV) the official delegation of the individual certificate holder as the authorized "Delegated Signer" (Firmante Delegado) on behalf of the company RNC; (c) renew and replace the .p12 or .pfx file inside Ahorra POS prior to its expiration date (the platform displays preventive warnings when thirty days or fewer remain, but cannot renew certificates before certification authorities on the Client behalf); and (d) timely request, authorize, and register in Ahorra POS its electronic fiscal receipt sequence ranges (Series E e-NCF) and, where applicable, contingency sequence ranges (Series B NCF), ensuring they do not run out or expire.