Your competitor cannot see your discount structure, your payment terms or your customer concentration. From January, a continuous, machine-readable record of all three will sit with a provider you are choosing in the next ten weeks.

Invoice data carries more than evidence for indirect tax. It represents a concentrated view of how an enterprise operates commercially. A structured invoice may reveal customer and supplier relationships, pricing, discounts, payment terms, product and service classifications, sales volumes, purchasing patterns and tax treatments. Once every B2B transaction is structured and routed through an accredited provider, that view becomes continuous and machine-readable rather than occasional and buried in PDFs.

ASP Selection Is a Data-Governance Decision

This follows directly from what the format does. Selecting an Accredited Service Provider determines where a complete commercial record of the enterprise sits, who can reach it, and what happens to it afterwards — which makes the selection a data-governance decision alongside everything else it is.

Ten weeks from the 30 October 2026 appointment deadline, this question is being handled in most programmes as a security-questionnaire annexe to a contract negotiated primarily on price. The questionnaire arrives late, is completed by a procurement team without a view of what the data reveals, and is filed.

Eight Questions Worth Asking Directly

The objective is to understand how commercially sensitive information is stored, accessed, supported and governed throughout the service lifecycle. Questions that deserve attention:

  • Where is invoice data hosted?
  • Who has administrative access to production data?
  • Which support teams can view customer information?
  • How are audit logs maintained and retained?
  • Which subcontractors participate in service delivery?
  • How are security incidents communicated to customers?
  • How is enterprise data exported if the relationship ends?
  • What are the archival and deletion arrangements?

These are governance questions rather than a cyber-security exercise, and keeping that distinction is what makes them answerable inside a ten-week selection window. Turning ASP selection into a security assessment invites a certification review that a procurement team can complete without ever establishing which humans can read a customer’s pricing on a Tuesday afternoon.

The second and third questions are the ones most often answered in general terms and most worth pressing on. Administrative access to production data and support-team visibility of customer information describe a set of named people, at the provider and at its subcontractors, who can see the enterprise’s commercial position. The answer should be specific enough to name roles and the controls that constrain them.

The Two That Decide Exit Optionality

Data export on exit and the archival and deletion arrangements are the questions that determine whether the enterprise retains a choice three years from now. An ASP relationship that cannot be exited with the enterprise’s own structured transaction history intact converts a service contract into a dependency, and the pricing conversation at renewal reflects that.

Export terms should specify format, completeness, timeframe and cost before signature. Archival and deletion arrangements should specify what the provider retains after termination, for how long, and under what obligation — because a provider holding five years of an ex-customer’s commercial record after the relationship ends is a governance position the enterprise has taken whether or not it discussed it.

What This Is Actually Protecting

Information security in this context extends past protecting data from external threats. It covers preserving control over one of the organisation’s richest sources of commercial intelligence as responsibility is shared across the ASP ecosystem. The answers to the eight questions above tell the enterprise whether the governance around that intelligence matches its own risk appetite.

The enterprise decides the appetite. The contract decides whether the appetite is respected, and it is being signed in the next ten weeks.