Alfa is the new business software from Tresoor TarkvaraLearn more →
Start free

Data service intermediation policy (DHX)

Version: 30.09.2026

This policy applies to the document exchange layer (DHX) intermediation that Tresoor Tarkvara OÜ (registry code 10501507, X-Road member EE/COM/10501507) provides to organisations using AlfaERP. It is drawn up under § 13(2) of the Estonian X-Road regulation.

1. Basis of intermediation

  • The organisation concludes an AlfaERP service agreement with Tresoor. In its standard terms the organisation authorises Tresoor to send and receive its documents through DHX (DHX procedure 3.3.3). Acceptance is stored so that it can later be shown who accepted, when and which version of the terms.
  • Tresoor intermediates through the X-Road subsystem EE/COM/10501507/DHX. The subsystem belongs to the group "DHX vahendajad" (DHX intermediaries), and the sendDocument and representationList services are open to the group "Kõik X-tee kasutajad" (all X-Road members).
  • Represented organisations are listed in Tresoor's representation register. Each entry holds the organisation's registry code, name, start and end of representation and a reference to the mandate. The register is the only source of the representationList service, so the published list and the routing of documents cannot diverge.
  • Representation starts on the entry's start date and ends when the agreement ends or at the organisation's request. An ended representation stays in the list with its end date, so senders know the old route no longer applies.
  • An organisation with its own DHX subsystem is not represented by Tresoor at the same time — otherwise its mail would be split between two places.

2. Authentication and authorisation of the represented party

  • The organisation's employee is authenticated in AlfaERP with an e-identity means (ID card, Mobile-ID, Smart-ID) or another sign-in method allowed by the organisation.
  • Rights to send, register and view documents are granted by the organisation to its users through AlfaERP roles. The content of an access-restricted document is visible only to the responsible person, the registrar and users with a separate right.
  • The represented organisation is identified from the representation register. The sender's registry code and the X-Road header representedParty are taken from the register, not from user input, so a user cannot send on behalf of another organisation.
  • An incoming document is routed by the addressee's registry code only to that organisation's document register. Documents sent to an unknown addressee or one whose representation has ended are not accepted (DHX.InvalidAddressee).

3. Authentication and authorisation log

  • Every DHX action is written to the AlfaERP audit log: receiving a consignment, registering or rejecting it, sending, retrying, delivery and failure. Changes to the representation register (adding, changing and ending representation) and to the DHX node settings are logged too. Each entry records the actor, the organisation and the time; document content is not logged.
  • Sign-ins are recorded by the AlfaERP authentication service with the user, method and time.
  • The audit log is kept for 1 year. Consignment receipts (consignment identifier, recipient's acknowledgement, time and parties) are kept with the document register entry until the end of its retention period.
  • The sign-in log is kept for 1 year.
  • Tresoor's platform administrators have access to the logs.

4. X-Road message log

  • The message of every DHX request (sendDocument, representationList) is logged by Tresoor's security server according to the X-Road protocols; the represented organisation is visible in the request's representedParty header (regulation § 13(3)(4)).
  • The message log is archived in the security server archive; Tresoor's X-Road administrators have access to the archive.
  • The message log archive is kept for 1 year.

5. Changes and contact

  • Tresoor follows this policy and notifies the Information System Authority and the data service providers whose services it has access to of any change to it (regulation § 13(3)(2)). The current version and its date are on this page.
  • Tresoor Tarkvara OÜ, registry code 10501507. Contact: info [at] tresoor.ee.