Source: FinancialWeb, 11/08/2009

SÃO PAULO - The implementation of electronic invoices is completed in less than three months for 80% of small businesses. The survey was carried out by FinancialWeb Expert Roberto Dias Duarte, who published an article last Monday (10) with the results of a survey of 101 companies that already issue or are expected to issue electronic invoices.

It shows, among other points, that the adjustment requires a maximum investment of R $ 10 in 62% of the cases. “Most companies are not yet considering NF-e as a management improvement project. Therefore, there was little involvement of the commercial, legal and marketing areas in the projects ”, explains

Read the complete survey here and check the NF-e panorama in small companies exclusively.
 

NF-e: Care with the use of digital certificates
 

“First of all, it must be remembered that the digital certificate represents the person's 'identity' in the virtual world. Thus, it is necessary to adopt some precautions to avoid that another person may close contracts and / or deals and carry out bank transactions on behalf of the certificate holder ” 
National Institute of Information Technology - ITI

Some readers expressed concern about the use of digital certificates for signing Electronic Invoices.

Firstly, it is necessary to understand that electronic documents signed with digital certificates have 3 fundamental characteristics:

1) Guarantee of authorship, that is, we can easily identify who signed a digital document

2) Guarantee of integrity. A signed document cannot be changed.

3) Guarantee of non-repudiation. Provisional measure 2.200 of August 2001 gives legal validity to signed electronic documents.

To further detail the topic, I selected the most basic questions: 

1) What is a Digital Certificate?

“Basically, the Digital Certificate works as a kind of virtual identity card that allows the secure identification of the author of a message or transaction on a computer network. The digital certification process uses very complex logical and mathematical procedures to ensure confidentiality, integrity of information and confirmation of authorship.
The Digital Certificate is an electronic document, digitally signed by a trusted third party, that identifies a person, whether physical or legal, associating them with a public key. A digital certificate contains the data of its holder such as name, date of birth, public key, name and signature of the Certification Authority that issued it, and may also contain additional data such as CPF, voter registration, ID, etc. ”

2) What are the digital signature applications?

“There are many possibilities for applications of digital signature, among which are the following: - electronic commerce; - electronic judicial and administrative proceedings; - facilitate the popular initiative in the presentation of bills, since citizens will be able to digitally sign their adhesion to the proposals; - signature of the income statement and other services provided by the Federal Revenue Service; - obtaining and sending notary documents; - secure transactions between financial institutions, as has been happening since April 2002, with the implementation of the Brazilian Payment System - SPB; - Electronic Official Gazette; - identification of sites on the world wide web, so that you can be sure that you are accessing the address you really want; etc."

3) Is the electronically signed document recognized in the same way as a handwritten document?

"According to art. 10 of MP No. 2.200-2, electronic documents digitally signed using certificates issued within the scope of ICP-Brasil have the same legal validity as paper documents with handwritten signatures. It is important to note that electronic documents digitally signed by means of certificates issued outside the scope of ICP-Brasil also have legal validity, but this will depend on the acceptance of both parties, issuer and recipient, as determined by the wording of § 2 of art. 10 of MP No. 2.200-2. ”

4) What precautions should be taken when using digital certification?

“First of all, it must be remembered that the digital certificate represents the person's 'identity' in the virtual world. Thus, it is necessary to adopt some precautions to avoid that another person may close contracts and / or deals and carry out bank transactions on behalf of the certificate holder. Recommendations for using a digital certificate:

a) The password for the private key and the private key itself must not be shared with anyone;
b) If the computer where the cryptographic key pair was generated is shared with several users, it is not recommended to store the private key on the hard disk, as all users will have access to it, with better storage on diskette, smart card or token;
c) If the private key is stored on a computer's hard disk, it must be protected from unauthorized access, keeping it physically secure. Never leave the room open when you leave and it is necessary to leave the computer on. Also use a password-protected screen saver. Watch out for computer viruses, they can damage your private key;
d) If the software for generating the key pair allows you to choose whether or not to have a password to protect the private key, it is recommended to choose access by means of a password. Not using a password means that anyone who has access to the computer can impersonate the private key holder, signing contracts and operating bank accounts. In general, it is much easier to use a password than to physically protect a computer;
e) Use a long password, inserting letters and numbers, since there are programs with the function of unblocking passwords. Personal data such as spouse or children's names, birthdays, addresses, telephone numbers, or other elements related to the person must be avoided. The password should never be written down, and it is recommended that it be memorized. ”
source: www.iti.gov.br

5) What type of digital certificate should my company acquire to sign electronic invoices?

“The digital certificate used in the Electronic Invoice must be purchased from the Certification Authority accredited by the Brazilian Public Keys Infrastructure - ICP-Brasil, and must contain the CNPJ of the establishment or its headquarters. “

6) Can the e-CPF be used as a digital certificate for the NF-e? And the e-CNPJ?

“The digital certificate to be used must be from a legal entity, type A1 or A3. The e-CPF cannot be used for the NF-e; e-CNPJ, however, is not the most suitable. The ideal is to use and an e-PJ, to be issued specifically for the NF-e signature process. ”

Source: www.nfe.fazenda.gov.br

7) Does the NF-e certificate give access to e-CAC information and other services from the IRS?

“Currently, the IRS allows access to e-CAC only to the legal representative registered in its database. Thus, if the NF-e certificate is issued to this person, they will have the same access as an e-CNPJ. ”

Source: www.serasa.com.br