ON-PREMISE BIR EIS E-INVOICING · ENTERPRISE EDITION
Your invoices never leave your network. The BIR still gets every one.
BIR-EIS Enterprise is an e-invoicing engine that runs on your own servers. It takes invoices from NetSuite, transmits them to the BIR Electronic Invoicing System, and keeps every record in your own PostgreSQL database.
For Large Taxpayers running NetSuite across several branches.
- Issuing deadline retained by RMC 98-2026
- 31 DEC 2026
- EIS certification within six months of it
- PERMIT TO ISSUE FIRST
- Go-live target from kickoff
- 8 WEEKS
- Invoice records in any vendor cloud
- 0
01Why on-premise
The question to ask any e-invoicing provider: whose servers?
01.1
Data residency
Invoices, customer TINs and BIR acknowledgements stay in your PostgreSQL database, on your servers. Nothing is copied to a vendor cloud, so there is no third-party processor to add to your register.
01.2
Security review in weeks, not quarters
Your CISO reviews a system on your own infrastructure, behind your proxy, signed in through your identity provider. The answers to the usual questionnaire are written down before they ask.
01.3
A licence, not a meter
One flat annual licence per taxpayer. Unlimited invoices, branches and users, so volume growth and new branches never raise the bill.
02How it works
One engine inside your network. Four outbound connections. Nothing inbound.
The engine and its PostgreSQL 17 database run on Docker Compose (2.24 or later) or Kubernetes (1.27 or later). It queues and transmits each invoice to the BIR EIS, retries when a call fails, and records every acknowledgement where your auditors can find it.
03NetSuite
Built for NetSuite first.
Invoices start in NetSuite and their BIR status comes back to NetSuite. Your finance team keeps working where it already works.
Not on NetSuite? Computerized accounting system users connect through a REST API with keys, or import .xlsx and .csv files.
- Pull
- A scheduled SuiteQL pull, every 5 minutes by default, picks up records that are pending.
- Push
- Optional: a SuiteCloud SDF bundle sends each record as it is saved, through a reverse proxy you publish. Leave it off and the pull covers everything.
- Write-back
- Each BIR milestone, from issued to acknowledged or rejected, is written back to four fields on the NetSuite record.
- Records
- Invoices, credit memos and cash sales.
- Corrections
- Issued invoices are never edited in place. A correction is a new credit or debit memo, issued and transmitted like any other document.
04Regulation watch
What the regulations say, as of 10 November 2026.
E-invoicing rules have moved twice in a year. We keep a dated record of what each issuance says, from firm alerts and published circulars, and update this block when a rule changes. It is a summary, not tax advice: confirm how a rule applies to your company with your tax adviser.
| Issuance | Date | What it says | Status |
|---|---|---|---|
| RR 11-2025 | Implements NIRC §237 and §237-A as amended by RA 12066 (CREATE MORE) and set the first e-invoicing date, in early 2026. | Superseded in part | |
| RR 26-2025 | Moved the RR 11-2025 deadline from early 2026 to 31 December 2026. | In force | |
| RMC 98-2026 | Covered taxpayers must issue e-invoices through the BIR EIS from 31 December 2026. A Permit to Issue comes first; EIS certification follows within six months of it. Five covered groups; micro taxpayers are not among them. Rules for transmitting sales data are separate and still pending. | In force | |
| RMC 110-2026 | Sets up accreditation for e-invoicing service providers. Whether a licensed on-premise system falls under it is an open legal question; ask your tax adviser. | Open question |
LAST REVIEWED 2026-11-10
05Pricing model
One flat annual licence per taxpayer. No per-invoice meter.
- LICENCEOne licence covers one TIN and one deployment, billed once a year.
- UNLIMITEDInvoices, branches, console users and engine replicas.
- ONBOARDINGA fixed fee, agreed before kickoff.
- ADD-ONThe NetSuite connector and its SuiteCloud bundle.
- OPTIONALPremium support with faster response times.
- PRICE LOCKThree years at the price you sign.
Numbers on the readiness call.
Book a readiness call06Security review
Written for the people whose job is to say no.
Every control below is named, documented and testable on your own hardware. Where there is a limit, we say it first.
- S-01
Single sign-on through your identity provider
OpenID Connect, Authorization Code flow with PKCE. Tested with Microsoft Entra ID, Okta and Keycloak. IdP groups map to the admin, maker and approver roles. No SAML: bridge it through your IdP.
- S-02
An egress allow-list you can read
Four outbound hosts, all named, through your HTTPS proxy and your corporate CA bundle. Nothing listens on the internet.
- S-03
Append-only invoice status history
Every lifecycle step of every invoice is recorded and never rewritten, alongside a maker and approver workflow.
- S-04
Nightly backups and a restore drill
A nightly pg_dump with a sha256 sidecar for every file, kept on your storage, and a documented restore drill your team rehearses.
- S-05
An air-gapped install bundle
Images and checksums travel as one bundle, so the servers never pull from a public registry. The licence check still needs outbound internet.
- S-06
Metrics, a dashboard and alert rules
Prometheus metrics, a Grafana dashboard and alert rules that import into the monitoring stack you already run.
- S-07
A hardened container
Runs as a non-root user on a read-only image filesystem.
- S-08
Secrets as files
Credentials are mounted as files from a folder or secret you control, never baked into the image.
07Questions
The questions we hear first.
Straight answers, including the ones that limit what we can claim.
Q1Does BIR-EIS hold BIR accreditation, or act as an ESP?
No. BIR-EIS is not an e-invoicing service provider (ESP) and makes no accreditation claim. Your deployment is your own system and goes through the CAS and EIS certification steps the BIR sets for taxpayers. Whether a licensed on-premise system counts as an ESP deployment under RMC 110-2026 is an open question we will not pre-empt; ask your tax adviser, and we will tell you where it stands on the readiness call.
Q2What network access does it need?
Nothing inbound from the internet: your staff reach the console on your own network. Outbound HTTPS goes to four hosts only, the BIR EIS, our licence server, your NetSuite account and your OIDC issuer, through your HTTPS proxy when you set one. The BIR whitelists egress per application, so you register a static public egress IP (the server’s or the proxy’s) with the BIR.
Q3Where does our invoice data live?
In your own PostgreSQL 17 database, on your servers or your own cloud account. Nightly backups go to storage you choose. The licence heartbeat sends health data only, never invoices, customers or TINs, and you can print the exact body it will send before it goes.
Q4What happens if the licence lapses?
If heartbeats stop reaching the licence server, the system keeps working through a 14-day grace and then turns read-only. At licence expiry it turns read-only at once. Read-only blocks new issuing; your records stay viewable, searchable, printable and exportable.
Q5How long does it take to go live?
Our go-live target is 8 weeks from kickoff. The BIR steps run on their own clock: a Permit to Issue comes first, and EIS certification follows within six months of it. We plan both with you on the readiness call.
Q6What does onboarding cover?
A fixed fee covers installation on your Docker Compose host or Kubernetes cluster, single sign-on with your identity provider, the NetSuite connector and its SuiteCloud bundle, support through the BIR sandbox and certification steps for your system, a first restore drill, and the handover to your operators.
Q7Can it run air-gapped?
The installation can: an air-gapped bundle carries the images with sha256 checks, so the servers never pull from a public registry. Two things still need outbound internet: transmission to the BIR EIS, and the licence, which sends a heartbeat every 24 hours to the licence server. There is no offline licence file.
Q8How much does it cost?
One flat annual licence per taxpayer, with unlimited invoices, branches, users and engine replicas, plus fixed-fee onboarding. The NetSuite connector is an add-on and premium support is optional. We share the numbers on the readiness call, with a three-year price lock.
08Book a readiness call
Thirty minutes on where you stand and what it takes.
On the call
- 01Where you are with the Permit to Issue and EIS certification
- 02Your NetSuite set-up, branches and monthly invoice volume
- 03Your network, identity provider and security review path
- 04An 8-week plan and the licence numbers
Bring
Your finance or tax lead, and someone from IT or security.
Replies come from hello@bir-eis.com.