Straight answers about CertiReport

Companies on SAP HANA and on Microsoft SQL Server, on the same CertiReport server at the same time. A report holds one SELECT per platform, so the same definition serves a HANA customer and a SQL Server customer. CertiReport itself runs as Windows services on 64-bit Windows Server 2012 R2 or later, with an embedded PostgreSQL for its own data.

No. There is no add-on, no user-defined table and no change to the company database. Reports read the company with a database user you create; the optional write-back of attachments and activities goes through the company's Service Layer with a SAP Business One user you configure. Everything else lives in CertiReport's own PostgreSQL database.

Report SQL is written by your designers, and the SQL safety guard only accepts a single SELECT; the read-only user is what makes a mistake harmless. The setup ships scripts for HANA and SQL Server that create a user with SELECT on the company only. The connection test connects, confirms the database is an SAP Business One company and lists every right the user holds to change data; the Companies page badges users that are read-only.

The SAP HANA Client 2.x (64-bit) installed on the engine server, the client that ships with SAP Business One. CertiReport loads SAP's ADO.NET provider from it and redistributes nothing. A tenant database is addressed with databaseName=NDB in the company's additional options. The prerequisite check, CertiReport.Engine.exe check, reports whether the client is found and every company connects.

Only for write-back. Reports run against the database directly; the Service Layer is used when a schedule attaches the sent files to the business partner or logs an activity. You enter the Service Layer URL, SAP Business One user, password and company database on the company page, and Test Service Layer signs in and out to prove it works. A write-back failure is recorded on the item and never fails the run.

Only to run Crystal layouts. Excel, CSV and HTML-template PDFs need no Crystal at all. The optional Crystal feature of the setup appears when the SAP Crystal Reports runtime for .NET Framework is registered on the machine, 32-bit or 64-bit, any 13.0 service pack; the sidecar binds to whichever is installed. CertiReport does not ship SAP's runtime; you install it under SAP's licence. Formats an older runtime lacks are replaced by the closest one and noted in the run warnings.

Yes. The designer lists the Report and Layout Manager entries of the connected company, standalone reports and document layouts, and the engine fetches the layout from the company database and caches it until it changes in SAP Business One. The layout's parameters are read and mapped to your variables; Schema@, UserCode@ and JOINFROM conditions are filled by the engine, and DocKey@ with ObjectId@ let you schedule a document layout such as the AR invoice over documents. Layouts that depend on the client's print proxy (PLD__ITEMS) do not run outside SAP Business One.

From an HTML template written in Scriban in the report designer, with the company logo, the variables, the datasets and helpers for money and dates. The engine renders it in the Google Chrome or Microsoft Edge already installed on the server through headless Chromium; nothing is downloaded. Templates run sandboxed with no file or network access. The footer with page numbers, the verification code and the QR code is added by the engine.

Every file keeps its SHA-256. A certified PDF carries a verification code (XXXX-XXXX-XXXX) and a QR code to the portal's public verify page. There the recipient enters the code or scans the QR and sees the issuer, report, issue date, hash and whether the file was digitally signed; dropping the PDF compares it byte for byte with the issued document. The uploaded file is hashed and not stored, and the issued document itself is never exposed. The same check is available at GET or POST /api/v1/verify/{code}. Optionally the PDF is signed PKCS#7 with the company's certificate and protected with an AES-256 open password.

On the CertiReport server under %ProgramData%\CertiReport\files, in a folder per year, month and run, next to the metadata database and the encrypted key ring in the same ProgramData folder. Runs with their files are kept for 400 days and finished mail for 90 days by default; both are set under Administration › Settings and enforced by the engine every 15 minutes. Files are downloaded from run history or through the API, and copies can go to a folder, SFTP, SharePoint or the partner's record in SAP Business One. A nightly backup archives database, keys and optionally the files.

Any SMTP server (STARTTLS or TLS, user name and password or an anonymous internal relay), Microsoft 365 with an Entra app using OAuth2, or Microsoft Graph over HTTPS. A mail profile carries limits for messages per minute, recipients per day and attachment size, with a Send test message button. Bounces are read back from the sender mailbox over IMAP or Graph, and addresses that bounce hard are suppressed.

Per active SAP Business One company on one CertiReport server. The key is signed by CERTICONS, bound to the Hardware ID of the server and verified offline. Standard, Professional and Enterprise differ in the number of companies and the support agreement; every feature is in every edition. Deactivating a company frees its slot, and a licence for more companies replaces the current key without reinstallation.

There is no trial mode. Without a licence CertiReport installs and starts, users sign in, design reports, import starter reports and prepare schedules, but no company can be added and no report runs. We are glad to run a demo on your own company or ours, and to quote within one business day.

A banner appears above every page from 30 days before expiry and the failure-alert addresses are mailed at 30, 14, 7 and 1 days. During the grace period everything runs; afterwards no company can be added or reactivated and every run is refused with a "Licence:" message, while reports, schedules, history and files stay untouched. With more active companies than licensed, the first by creation are covered and the rest are badged Unlicensed and do not run.

Run the new setup over the existing installation, with a window or silently from the command line. It stops the three services, replaces the program files, keeps the database, settings, connection string and licence, applies the migrations and starts the services again. All releases during the licence period are included.

English, Arabic and French, chosen per user from the account menu and remembered. Arabic switches the whole portal to right-to-left. The e-mails you send to business partners are your own text, with a subject and body per SAP Business One language, so a partner receives the variant that matches the language on their master record.

Yes, a REST API at /api/v1 with an OpenAPI reference at /api/docs. API keys carry the same six roles as users, are shown once and stored hashed, and are sent in the X-Api-Key header. You can list schedules, queue a run or a test send, read runs with their items and files, approve or reject a waiting run, search deliveries, verify a document, manage the licence and read Prometheus gauges at /metrics. A webhook posts a signed JSON summary after every run.

Users sign in with a local account, their Windows account or Microsoft (Entra ID). Administrators must use an authenticator app; accounts lock for 15 minutes after 5 failed attempts and sign-ins are limited to 10 per minute per address. Database passwords, Service Layer sign-ins, mail passwords, client secrets and destination keys are stored encrypted with a machine-protected key ring; no password travels in an export file. The portal serves HTTPS with a certificate from the machine store, and a hash-chained audit log records sign-ins, changes, licence activation and runs.

No. Licence keys are verified offline against the public key embedded in the product, and no configuration, credentials, report data or documents leave your server. The public verification page runs on your own portal at the address you configure. Support cases are handled by e-mail with the information you choose to share.