Message IconCustomer SupportUser IconContact SalesLock IconLogin
Arratech logo
Message IconCustomer SupportUser IconContact SalesLock IconLogin
Get StartedGet Demo

The Peppol Transport Model Demystified

An illustration explaining the Peppol four-corner transport model, showing a business invoice securely moving from sender to receiver through trusted Access Points. The image features modern professionals at work, connected by a Peppol Network flow
Credit/Source:Hans Christian Pedersen
Peppole-Invoicing
Robin Anderson BoströmRobin Anderson Boström

In the evolving landscape of digital business communication, interoperability, security, and reliability are essential. For organisations exchanging electronic documents such as invoices, purchase orders and catalogues, the Peppol transport model has become a trusted enabler of data exchange across borders and ERP systems.

Originally developed to simplify public procurement in Europe, the Peppol network is now widely used in both the public and private sectors around the world.

Below, we introduce the Peppol transport model and explain how it supports flexible, secure and dynamic exchange of electronic business documents.

The Peppol network is now widely used in both the public and private sectors around the world

The 4-corner model

Instead of requiring direct connections between every sender and receiver, Peppol uses an intermediary model based on access points operated by certified service providers. These service providers handle message routing for their customers, regardless of whether their customers act as sender or receiver.

This architecture is known as the Four-corner model. Corner 1 is the organisation sending the business message and Corner 4 is the organisation receiving it. Between them, Corner 2 and Corner 3 are the respective access point service providers responsible for routing the message through the Peppol network. As a result, Corner 1 connects to Corner 2, which communicates with Corner 3 through the Peppol network. Corner 3 then delivers the message to Corner 4.

The role of Corner 1 depends on the business message being exchanged. When an invoice is sent, the seller is Corner 1 and the buyer is Corner 4. When a purchase order is sent, the buyer is Corner 1 and the seller is Corner 4.

This architecture allows organisations to choose or change their access point service provider independently, while maintaining full interoperability with all other organisations connected to the Peppol network.

A key element of the Peppol transport model is dynamic discovery

Dynamic discovery

A key element of the Peppol transport model is dynamic discovery, also known as dynamic lookup. This means that routing information is not fixed in advance between trading partners. Instead, the necessary technical information is looked up at the time the message is sent.

When a sender initiates a message, the sending access point uses the recipient’s identifier to discover where the recipient’s technical metadata is published. This process starts with the Service Metadata Locator (SML), a central service that points the sending access point to the relevant Service Metadata Publisher (SMP). The SMP then provides the recipient’s technical details, including the receiving access point and the document types the recipient can receive and process.

This dynamic lookup allows the sending access point to prepare, encrypt, digitally sign and route the message to the correct destination without requiring prior bilateral configuration between the sender and receiver.

Message packaging and routing

Within the Peppol transport model, messages must be packaged and labelled so that access points can process them correctly. For this purpose, messages exchanged between access points in the Peppol infrastructure are encapsulated in an envelope called the Standard Business Document Header (SBDH).

The SBDH carries essential routing and identification information, including the network identifiers of the sending and receiving organisations and the type of business document being exchanged. This enables access points to process, validate and route messages consistently, while keeping the business content itself separate from transport-level concerns.

In practice, the sending access point prepares the business document and wraps it in the SBDH. It then performs dynamic discovery, retrieves the recipient’s technical metadata from the relevant SMP, determines the correct routing, encrypts and signs the message, and transmits it to the receiving access point. The receiving access point acknowledges receipt and delivers the message to the recipient organisation.

Security and trust are fundamental design principles of the Peppol transport model.

Information security and trust

Security and trust are fundamental design principles of the Peppol transport model. Multiple mechanisms work together to protect information during transmission.

Transport security is ensured through AS4 messaging combined with Transport Layer Security (TLS), a standard protocol that encrypts network connections and authenticates communicating systems between access points. Authentication and identification rely on Peppol certificates issued to certified access points, allowing both sender and receiver to verify each other’s identity. Authorisation is enforced by limiting participation to approved access point providers that comply with the Peppol governance and technical framework. Non-repudiation is achieved through signed acknowledgements that confirm both sending and receipt of messages.

These mechanisms create the foundation of trust between organisations and service providers, making the Peppol transport model suitable for electronic document exchange in regulated and cross-border contexts.

Why this matters

For organisations using Peppol, the transport model offers several practical advantages. Integration complexity is reduced through standardised interfaces and shared addressing mechanisms. Organisations retain the freedom to choose and change service providers without impacting connections to trading partners. The model also provides a secure and scalable foundation for electronic document exchange across sectors and jurisdictions.

Arratech, your partner for Peppol-as-a-Service at scale

At Arratech, we are experts in Peppol network infrastructure and we support organisations globally in operating solutions based on the Peppol transport model, both While Label and Shared modes. With Arratech’s Access Point Suite and SMP Suite, you can enable your software or service to start exchanging documents on the Peppol Network in no time. Enjoy instant onboarding through our Arratech Connect portal, full compliance, and seamless integration. Whether you are new to Peppol or already operating within the network, we invite you to sign up for a free trial of our platform in a sandbox environment to see what we have to offer.
GET A DEMO

FAQs Hero Image

FAQs

What is Peppol Access Point and how does it work?

Connect once, exchange documents with the entire network

Peppol Access Points are essential communication hubs within the Peppol network. By connecting your business through a single certified Access Point, you can immediately begin securely exchanging electronic business documents with all participants across the network. Although initial setup and certification require some effort, once established, your organization can instantly reap the benefits of streamlined operations and substantial cost savings.

How can my business start sending invoices via Peppol?

To start, you’ll need to connect to a certified Peppol Access Point provider. Arratech is a certified Peppol Access Point provider. Contact us and we can support you through the process.

Do I need to register to use Peppol e-invoicing?

Yes, your business needs a unique Peppol ID (also called a Participant ID) to send or receive documents. We can support you during onboarding, ensuring your Peppol ID is properly listed in the Peppol directory.

Is Peppol mandatory in my country or industry?

It depends. In many European countries, Peppol or other types of e-invoicing networks based on Peppol standard is required for invoicing public sector entities, especially in construction, healthcare, and infrastructure. Even where it’s not mandatory, Peppol is often the preferred standard because of its security, compliance, and interoperability. Check with your local authority or ask us for the latest updates relevant to your business needs.