TSE & Tax Authority¶

Since January 1, 2020, a Technische Sicherheitseinrichtung (TSE) (Technical Security Device) has been mandatory for POS systems in Germany (KassenSichV, §146a AO). DiKAS is fully TSE-compliant and signs all fiscally relevant transactions in accordance with the AEAO on §146a AO.

For tax auditors: → TSE Compliance — Documentation for Tax Auditors (detailed technical description)

For users: → TSE Guide in the User Manual (setup and operation)

What Is a TSE?¶

A TSE is a certified security module that digitally signs every POS transaction. The tax office (Finanzamt) can use it to check whether POS data was tampered with after the fact.

TSE in DiKAS¶

DiKAS signs all fiscally relevant transactions — not just invoices:

Transaction	ProcessType	Entity	Description
Receipts	`Kassenbeleg-V1`	Receipt	Every payment (direct sale, table payment)
Voids	`Kassenbeleg-V1`	Receipt	Every receipt void
Orders	`Bestellung-V1`	OpenBon	Every order in table service
Batch orders	`Bestellung-V1`	OpenBon	Batch orders (signature on lead receipt)
Shift opening	`SonstigerVorgang`	Exchange	Every shift opening
Shift closing	`SonstigerVorgang`	Exchange	Every shift closing
End-of-day reports	`SonstigerVorgang`	DayClose	Every Z-report
Expenses	`SonstigerVorgang`	Spending	Every cash withdrawal

Architecture¶

Signing Flow¶

Handler (e.g. ProcessDirectSaleCommand)
    → TseSigningHelper.SignReceiptAsync()
        → Load BackendConfig (TSE enabled?)
        → Check ITseService.IsAvailable
        → Build ProcessData
        → Resolve ClientId (CashRegisterId → BonIdServer → "1")
        → ITseService.SignReceiptAsync() [5s Timeout]
        → Save TSE fields on Entity
        → HandleOutageLogAsync() (outage log)

Expenses (Spendings): Signed as SonstigerVorgang; the transaction text depends on the AccountMode:

AccountMode	TSE Transaction Type
1 (Expense)	`AVSonstAusgabe`
2 (POS→Bank)	`AVTransfer`
3 (Bank→POS)	`AVSonstEinlage`
4 (Bank transfer)	`AVSonstAusgabe`

Components¶

Component	Description
`TseSigningHelper`	Central static class for all TSE signing operations
`ITseService`	Interface for TSE access (IsAvailable, Sign, Export)
`TseServiceRouter`	Routes to the active TSE: fiskaly cloud preferred, then network TSE, then local Swissbit hardware
`FiskalyTseService`	fiskaly cloud TSE (SIGN DE) — signs over the internet, no USB device required
`SwissbitTseService`	Local Swissbit USB TSE
`TseProxyService`	Network TSE: signs via another DiKAS POS acting as the TSE host (`BonIdServer`)
`TseInitializationService`	Initial TSE setup
`ITseDataHolder`	Interface with 9 TSE fields on all signed entities
`TseOutageLog`	Outage log entity
`TseConfig`	TSE configuration (PublicKey, Serial, SigAlg, PINs)

ProcessData Formats¶

The following strings are passed to the TSE and signed along with the transaction. The detailed, audit-oriented description is in the tax audit documentation, Section 4.

Kassenbeleg-V1 — a fixed tax portion of five gross slots (19% / 7% / 10.7% / 5.5% / 0%), followed by the payment portion <Amount>:<Bar|Unbar> (cash payments first):

Beleg^<19%>_<7%>_<10,7%>_<5,5%>_<0%>^<Zahlungen>
Example: Beleg^47.60_12.40_0.00_0.00_0.00^60.00:Bar

Bestellung-V1 — one line per order item; the description is in quotation marks, and the price is the gross unit price:

<Menge>;"<Bezeichnung>";<Brutto-Einzelpreis>
Example:
2;"Cola";3.50
1;"Pizza Salami";11.50

SonstigerVorgang — transaction code and data, separated by ^:

<Vorgang>^<Daten>
Example: AVKassenschnitt^Tagesabschluss^1523.90

DiKAS uses six transaction codes for this: AVSichOpen (shift opening), AVSichClose (shift closing), AVKassenschnitt (end-of-day report), AVSonstAusgabe (expense/cash withdrawal), AVSonstEinlage (cash deposit), and AVTransfer (cash transfer). A void is not a SonstigerVorgang — it is a Kassenbeleg-V1 with negative amounts.

QR Code Format (DSFinV-K Appendix I)¶

V0;{CashRegisterSerial};{ProcessType};{ProcessData};{TransNo};{SigCounter};{Start};{End};{SigAlg};{LogFormat};{Signature};{PublicKey}

Setup¶

The Admin → Settings → Finance → TSE screen shows the TSE status and the exports (TSE TAR, DSFinV-K, GDPdU). There are exactly two settings there: the "TSE active" toggle and the optional "TSE server" field. There is no "TSE type" dropdown — which TSE is used follows from the server configuration. At startup, DiKAS checks in this order: cloud TSE (fiskaly) → TSE server (pool) → local Swissbit TSE.

Cloud TSE (fiskaly)¶

No USB device required — signing runs via the certified fiskaly cloud (SIGN DE) over the internet. The credentials (API key, API secret, TSS ID, client ID) are stored in the server configuration (Tse:* in appsettings or environment variables); you can choose the test or live environment. For DiKAS cloud packages with a booked cloud TSE, this is already pre-configured — there is nothing further to do.

As soon as a cloud TSE is configured, it automatically takes priority.

Hardware TSE (Swissbit)¶

USB stick on the POS computer or the appliance:

Plug in the Swissbit TSE
Store the local path (mount point) of the TSE in the server configuration
Admin → Settings → Finance → TSE → switch on "TSE active"

During initialization, DiKAS sets the PINs/PUKs itself (randomly, per device) and registers the POS as a client. The POS identifier comes from the license — there is no manual serial number field.

TSE Pool (Multiple POS Terminals, One TSE)¶

For businesses with multiple POS terminals sharing one TSE: one POS acts as the TSE host, and the others sign through it over the local network.

Admin → Settings → Finance → TSE
In the "TSE server" field, enter the address of the POS that serves as the TSE host (e.g. https://kasse1.local)
Switch on "TSE active"

Automatic Deactivation on Failure

If TSE initialization fails repeatedly at startup, the TSE deactivates itself automatically and "TSE disabled" appears in the POS header. Details for users: TSE in Daily Use.

API Endpoints¶

Method	Endpoint	Description
GET	`/api/v1/tse/info`	TSE status information (capacity, certificate, signatures)
GET	`/api/v1/tse/config`	Read TSE configuration
PUT	`/api/v1/tse/config`	Update TSE configuration
POST	`/api/v1/tse/initialize`	Initialize TSE
GET	`/api/v1/tse/export/tar`	Export TSE log data as TAR (optional ?startDate=&endDate=)

TSE Data on the Receipt¶

Every receipt contains the TSE data:

══════════════════════════════════
  BON Nr. 20260313-0042
──────────────────────────────────
  ...Artikel...
──────────────────────────────────
  TSE-Information:
  Signatur:   a8f3c2d1e5...
  Trans.-Nr:  12345
  Sign.-Zäh:  67890
  Start:      2026-03-13T18:30:00
  Ende:       2026-03-13T18:30:01
  Seriennr:   ABCDEF1234567890

  [QR-Code]
══════════════════════════════════

The QR code contains all TSE data in DSFinV-K format (Appendix I) and can be scanned by the tax office (Finanzamt).

DSFinV-K Export¶

For the tax audit, DiKAS exports data in DSFinV-K format:

Admin → Settings → Export → DSFinV-K
Select the time period
"Create Export"
ZIP file containing all required CSV files

GDPdU Export¶

For the digital tax audit:

Admin → Settings → Export → GDPdU
Select the time period
"Create Export"
GDPdU-compliant export file

TSE Outage¶

If the TSE fails (defect, network issue):

DiKAS automatically logs the outage (TseOutageLog with StartTime, Reason, AffectedTransactions)
Processing payments is not blocked — operations continue
The TseError field on the affected document is set
When the TSE becomes available again, open outage entries are closed (EndTime is set)
The outage logs are retained for the tax office (Finanzamt)

Important: In the event of a TSE outage, you are required to document the outage and resolve it promptly. DiKAS handles the documentation automatically.

Quality Assurance¶

TSE signing is safeguarded by automated tests. Among other things, these tests check:

the ProcessData formats for Kassenbeleg-V1 (single/multiple tax rates, zero receipt) and Bestellung-V1
QR code generation (V0 format)
the signing flow (TSE active, disabled, unavailable)
amount formatting and behavior in the event of a TSE outage

Frequently Asked Questions about TSE¶

Do I need a TSE? Yes, mandatory in Germany since January 1, 2020.

Which TSE does DiKAS support? The Swissbit hardware TSE (USB, on-site), the fiskaly cloud TSE (SIGN DE, over the internet), and the network TSE pool (several POS terminals sharing one TSE).

What does a TSE cost? That depends on the variant chosen: a hardware TSE is a one-time purchase, while a cloud TSE is billed on an ongoing basis. Contact DiKAS for current pricing.

Can the tax office audit my data? Yes, via the DSFinV-K, GDPdU, and TSE TAR exports. DiKAS is prepared for this.

Does a TSE outage block the POS? No. DiKAS logs the outage and keeps operating. The outage must be resolved promptly.

Further Documentation¶

→ TSE Compliance for Tax Auditors — Detailed technical documentation for the tax audit → TSE Guide for Users — Setup and operation → Cash Register Notification to the Tax Authority — Register your POS via Mein ELSTER (§ 146a para. 4 AO) → Plugin Development — Build your own modules