Generated documents

Required

• Render documents with no network and no local files

  MED-22

  Turn HTML into PDF or images in a renderer that can load only the template's own assets, never other addresses or local files. Escape every value placed in the template.

Recommended

• Build documents in a background job

  MED-23

  Generate PDFs, exports and other documents in a background job that stores the file and tells the person when it is ready. Never render one inside a web request.

• Store each issued document and never rebuild it

  MED-24

  Save every issued invoice, receipt, contract and statement as the exact file sent, with its SHA-256 and template version. Serve that stored file every time after, never a new render from today's data.

• Make generated PDFs accessible

  MED-25

  Generate every PDF that people read as a tagged PDF with a title, a document language, headings, a reading order, image descriptions and embedded fonts. Validate each document type against PDF/UA in CI.

Optional

• Use PDF/A for documents kept for years

  MED-26

  Write documents that must stay readable for 5 years or more, such as invoices and signed agreements, as PDF/A. Validate each file against its declared PDF/A part before you store it.

Rules on generated documents in other playbooks

• Use Playwright or WeasyPrint to turn HTML into PDF names the PDF software.
• Neutralise formulas in spreadsheet exports stops CSV injection.
• Build large exports ahead of time serves files that are the same for everyone.
• Let customers download the usage behind each invoice covers usage files next to invoices.
• Send e-invoices where the law requires them covers structured invoices.
• Avoid risky attachments covers documents sent by email.