Skip to main content

Compliance Framework

Compliance Framework Document

Project: Bilko — Balkan Accounting SaaS Version: 1.0 Date: 2026-02-23 Author: DPO / Compliance Officer Status: Draft Reviewers: CTO, Legal Counsel (RS, BA, HR) Classification: Confidential

Document History

Version Date Author Changes
0.1 2026-02-23 DPO Initial three-country compliance mapping

1. Compliance Scope

Bilko is a cloud accounting SaaS operating in three jurisdictions. Each has distinct data protection, accounting, tax, and e-invoicing requirements.

graph TD
    subgraph RS["Serbia (Republika Srbija)"]
        RS_DP["ZZPL — Zakon o zaštiti podataka o ličnosti\nSl. glasnik RS 87/2018 (GDPR-aligned)"]
        RS_ACC["Zakon o računovodstvu\nSl. glasnik RS 73/2019"]
        RS_VAT["Zakon o PDV\n20% / 10% / 0%"]
        RS_SEF["SEF e-Invoice\nUBL 2.1 XML — B2B mandatory Jan 2023\nPenalty: 50K–2M RSD"]
        RS_APR["APR Filing\nJune 30 deadline"]
    end

    subgraph BA["Bosnia & Herzegovina"]
        BA_DP["ZZLP BiH — Zakon o zaštiti ličnih podataka\nSl. glasnik BiH 49/2006"]
        BA_FBiH["FBiH: Zakon o računovodstvu i reviziji FBiH\nSl. novine FBiH 83/2009 + Pravilnik 2022"]
        BA_RSBA["RS entitet: Zakon o računovodstvu i reviziji RS BiH\nSl. glasnik RS BiH 96/2005"]
        BA_VAT["Zakon o PDV BiH\n17% / 0% — UIO authority"]
        BA_CPF["CPF e-Invoice\nPending ~2027"]
    end

    subgraph HR["Croatia (Hrvatska)"]
        HR_DP["GDPR — directly applicable (EU member)\nUredba (EU) 2016/679"]
        HR_ACC["Zakon o računovodstvu\nNN 78/15, 116/18, 42/20, 47/20, 114/22"]
        HR_VAT["Zakon o porezu na dodanu vrijednost\n25% / 13% / 5% / 0%"]
        HR_FISK["HR-FISK (eRačun B2G/B2B)\nFINA certificate — mandatory Jan 2026\nPenalty: up to EUR 500K"]
        HR_FINA["FINA RGFI\nApril 30 deadline"]
    end

2. Data Protection Compliance

2.1 Applicable Laws

Jurisdiction Law Supervisory Authority Penalty
Serbia ZZPL (Sl. glasnik RS 87/2018) Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti Up to 2M RSD (legal entity)
Bosnia & Herzegovina ZZLP BiH (Sl. glasnik BiH 49/2006) Agencija za zaštitu ličnih podataka (AZLP) Up to 10K BAM
Croatia GDPR Uredba (EU) 2016/679 Agencija za zaštitu osobnih podataka (AZOP) Up to €20M or 4% global turnover

2.2 Legal Basis for Processing

Data Category Legal Basis Jurisdiction
Account email, name Contract performance (Art. 6(1)(b) GDPR / Art. 12(1)(b) ZZPL) All
Tax IDs (PIB, JMBG, OIB, JIB) Legal obligation — accounting/tax law RS, BA, HR
IBAN, bank accounts Contract performance All
IP address, session logs Legitimate interest — security All
Financial transaction data Legal obligation — accounting/tax law All

2.3 Data Subject Rights Implementation

Right GDPR Article ZZPL Equivalent Status
Access Art. 15 Art. 26 Planned — /api/gdpr/export endpoint
Rectification Art. 16 Art. 27 In-app edit functionality
Erasure ("Right to be forgotten") Art. 17 Art. 28 Blocked by legal retention requirements
Portability Art. 20 Art. 30 Planned — JSON/CSV export
Restriction Art. 18 Art. 29 Planned — account suspension flow
Objection Art. 21 Art. 31 Via support ticket

Note on Erasure: Financial data cannot be erased during mandatory retention periods (10 years RS, 10-11 years BA, 11 years HR). Account can be anonymized (name/email) but transaction records must be kept.

2.4 Cross-Border Data Transfers

  • Host: Railway EU West (Amsterdam / Frankfurt) — within EEA
  • HR → Railway: No transfer mechanism needed (EU to EU)
  • RS → Railway: Serbia is on GDPR adequacy list (European Commission Decision 2023/1485)
  • BA → Railway: No EU adequacy decision for BiH. Rely on Standard Contractual Clauses (SCC 2021/914) with Railway as processor.

2.5 DPA Requirements

Data Processing Agreements must be signed with:

  • Railway (primary database host)
  • Cloudflare (WAF, CDN — processes IP addresses)
  • Sentry (error tracking — processes stack traces with potential PII)
  • Any email service provider

3. Accounting & Tax Compliance

3.1 Serbia (RS)

Requirement Law Details Bilko Implementation
Chart of Accounts Pravilnik o kontnom okviru (Sl. glasnik RS 3/2020) Standard Serbian CoA — 9 classes RS-specific CoA template preloaded on org creation
VAT rates Zakon o PDV (Sl. glasnik RS 84/2004 + amendments) 20% standard, 10% reduced, 0% exempt VAT rate selector on invoice line items
Financial statements Zakon o računovodstvu Bilans stanja + Bilans uspeha (BS format) Export to APR-compliant XML/PDF
Mandatory e-invoicing Zakon o elektronskom fakturisanju (Sl. glasnik RS 44/2021) B2B mandatory since Jan 1, 2023 (≥4.5M RSD) SEF API integration (UBL 2.1 XML)
APR filing deadline Zakon o računovodstvu Art. 33 June 30 (full-year entities), March 31 (other) In-app reminder + export
Retention period Zakon o računovodstvu Art. 26 10 years for financial statements and documentation Delete-prevention lock on records >0 days old
Pausal regime Zakon o paušalnom oporezivanju <6M RSD annual income Simplified invoice mode for pausal firms
PIO/health contributions Zakon o doprinosima Applied to salaries Future: payroll module

SEF Integration:

  • Portal: efaktura.mfin.gov.rs
  • Format: UBL 2.1 XML (HR-CIUS compatible subset)
  • Authentication: API key per organization
  • Mandatory fields: seller PIB, buyer PIB, invoice number, date, amounts, VAT breakdown

3.2 Bosnia & Herzegovina (BA)

Requirement Law Details Bilko Implementation
FBiH CoA FBiH Pravilnik o računovodstvu (Sl. novine FBiH 89/2016 + 2022 revision) FBiH-specific chart of accounts FBiH CoA template
RS entity CoA RS BiH Pravilnik RS entity chart of accounts (differs from FBiH) RS BiH CoA template
VAT rate Zakon o PDV BiH (Sl. glasnik BiH 9/2005) 17% standard, 0% exempt — UIO authority VAT 17% selector
VAT filing UIO portal Monthly/quarterly PDV prijava Export to UIO-compatible format
Filing deadline FBiH/RS entity laws March 31 (most entities) In-app reminder
FBiH retention Zakon o računovodstvu i reviziji FBiH Art. 17 10 years Delete-prevention lock
RS entity retention Zakon o računovodstvu i reviziji RS BiH Art. 16 11 years Delete-prevention lock
e-Invoice CPF platform (pending) Expected mandatory ~2027 Roadmap item
CIT rate Zakon o porezu na dobit FBiH 10% flat Future: tax calculation module

Entity detection: Bilko must determine if an organization is in FBiH, RS entity, or Brčko District to apply the correct CoA and retention rules. On org creation, user selects entity. Brčko follows BiH state-level law.

3.3 Croatia (HR)

Requirement Law Details Bilko Implementation
CoA Zakon o računovodstvu NN 78/15 Croatian standard CoA (HSFI / MSFI for large entities) HR CoA template
Currency Since Jan 2024: EUR only HRK phased out. All amounts in EUR. EUR default for HR orgs
VAT rates Zakon o PDV (NN 73/13) 25% standard, 13% (food/hotels), 5% (books/medicines), 0% VAT rate selector per line item
VAT filing Porezna uprava Monthly/quarterly PDV obrazac Export for manual filing (Porezna uprava portal)
HR-FISK (eRačun) Zakon o elektroničkom izdavanju računa u javnoj nabavi (NN 94/18) + amendments Mandatory Jan 1, 2026 for B2B above threshold. FINA certificate required. UBL 2.1 XML HR-CIUS. Penalty up to EUR 500K HR-FISK API integration — Roadmap P2
FINA RGFI filing Zakon o računovodstvu Art. 30 April 30 In-app reminder + FINA export
Retention Zakon o računovodstvu Art. 10 + Opći porezni zakon 11 years Delete-prevention lock
Fiscalization 2.0 Pravilnik o fiskalizaciji Cash register fiscalization (if cash payments) Cash receipt module with Porezna uprava integration

HR-FISK Priority: Croatia's eRačun mandate (Jan 2026) with EUR 500K penalty makes this the highest-priority e-invoicing integration. FINA certificate must be obtained during onboarding for HR organizations.

4. Controls Register

Control ID Description Type Applies To Status
CC-01 AES-256-GCM encryption for L4 Restricted fields (PIB, JMBG, OIB, JIB, IBAN) Technical RS, BA, HR Planned
CC-02 Organization-scoped WHERE on all Prisma queries Technical All Planned
CC-03 RBAC with 4 roles (owner/admin/accountant/viewer) Technical All Planned
CC-04 JWT RS256 with 15min expiry + refresh token rotation Technical All Planned
CC-05 TLS 1.3 minimum via Cloudflare Technical All Active
CC-06 LoggedAction audit trail (append-only, 10-11yr retention) Technical All Planned
CC-07 DPA signed with Railway, Cloudflare, Sentry Legal All Required pre-launch
CC-08 SEF integration for RS B2B e-invoicing Technical RS P2 Roadmap
CC-09 HR-FISK integration + FINA certificate flow Technical HR P2 Roadmap
CC-10 Data subject rights endpoints (/gdpr/export, /gdpr/delete) Technical All Planned
CC-11 72-hour breach notification procedure to Poverenik/AZLP/AZOP Procedural All Required pre-launch
CC-12 Privacy Policy in Serbian, Bosnian, Croatian Legal RS, BA, HR Required pre-launch
CC-13 Terms of Service with data processing consent Legal All Required pre-launch
CC-14 VAT rate validation per jurisdiction Technical RS, BA, HR Planned
CC-15 Retention lock preventing deletion of accounting records during mandatory retention period Technical All Planned

5. Compliance Roadmap

gantt
    title Bilko Compliance Roadmap
    dateFormat  YYYY-MM

    section Phase 1 — MVP (pre-launch)
    GDPR/ZZPL core controls     : 2026-03, 2026-05
    DPAs signed                  : 2026-04, 2026-05
    Privacy Policy (3 languages) : 2026-04, 2026-05
    Terms of Service             : 2026-04, 2026-05
    DPIA completed               : 2026-04, 2026-05

    section Phase 2 — RS Launch
    SEF e-invoice integration    : 2026-06, 2026-08
    RS CoA + APR export          : 2026-06, 2026-07
    RS VAT reporting             : 2026-06, 2026-07

    section Phase 3 — BA Launch
    BA entity detection (FBiH vs RS) : 2026-09, 2026-10
    BA CoA templates             : 2026-09, 2026-10
    UIO VAT export               : 2026-09, 2026-10

    section Phase 4 — HR Launch
    HR-FISK + FINA cert flow     : 2026-10, 2026-12
    HR CoA + EUR amounts         : 2026-10, 2026-11
    Porezna uprava PDV export    : 2026-10, 2026-11
    FINA RGFI export             : 2026-10, 2026-11

Approval

Role Name Signature Date
Author DPO / Compliance Officer 2026-02-23
Reviewer (CTO)
Reviewer (RS Legal)
Reviewer (BA Legal)
Reviewer (HR Legal)
Approver CEO

No comments to display

Back to top