← Back to all articles

Three n8n nodes, one compliance-ready archive

SealDoc Team · · 5 min read

The hardest part of compliance automation is rarely the rules. It is the plumbing that connects the rules to the systems that already run your business. The rules say an invoice has to stay readable, authentic and intact for the full retention period, with a record of what happened to it. Your mailbox says “you have a new attachment”. Bridging those two worlds is where most teams stall.

This post walks through the smallest workflow that closes that gap, built with n8n and the n8n-nodes-sealdoc community node. Three connected nodes, zero custom code.

What we are building

A workflow that does the following with every incoming PDF:

  1. Picks up the file from a trigger of your choice: a mailbox, a Slack upload, a cloud drive, an external webhook, anything n8n can listen to.
  2. Hands it to SealDoc, which converts it to PDF/A-3, checks PDF/A conformance, requests an RFC 3161 timestamp, and records every step in a hash-chained audit trail.
  3. Stores the result wherever your retention policy says it belongs.

What you do not build yourself: the PDF/A-3 conversion, the timestamping and its retries, the audit trail, the evidence pack. SealDoc does that work behind one API call.

Prerequisites

  • A self-hosted n8n instance with community nodes enabled.
  • A SealDoc workspace on the Starter plan or higher. Starter is where timestamps and evidence packs begin, and this workflow relies on both. See pricing.
  • A SealDoc API key, created in the SealDoc app under Integration → API Keys. Copy it straight away: it is shown only once.

Install the node in n8n under Settings → Community nodes → Install, with the package name n8n-nodes-sealdoc. If you install nodes by hand instead, run this in your n8n nodes folder (usually ~/.n8n/nodes) and restart n8n:

npm i n8n-nodes-sealdoc

Create the credential under Credentials → New → SealDoc API and paste your key into API Key. The SealDoc node now offers five resources: Document, Invoice, Job, Peppol Check and Validator. This workflow uses Job.

Node 1, the trigger

Pick the trigger that matches where your invoices land today. We use the Gmail Trigger here because it is a common starting point; the pattern is the same for IMAP, OneDrive, an n8n Webhook URL or any other source that delivers a file.

Configure the Gmail Trigger to fire on new messages under a label such as incoming-invoices, and switch on Download Attachments. n8n then puts the first attachment in the binary property attachment_0.

Node 2, SealDoc · Job · Create

Add a SealDoc node, rename it to Archive, and set Resource to Job and Operation to Create:

  • Input Binary Field: attachment_0. This is the name of the binary property from Node 1, typed as plain text.
  • Run OCR: optional. Switch it on for scanned documents, so the PDF/A-3 gets a searchable text layer.

The timestamp needs no setting: on a Starter plan or higher, SealDoc requests an RFC 3161 timestamp for every job.

The node uploads the file and returns straight away with the job ID:

{ "jobId": "8b1e4c3a-2f7d-4e9a-b6c5-0d4f2a7e9c13" }

Conversion runs in the background, so a slow PDF never blocks your queue.

Node 3, SealDoc · Job · Get

Add a Wait node of a few seconds, then another SealDoc node with Resource Job, Operation Get and Job ID {{ $('Archive').item.json.jobId }}. Follow it with an IF node on status:

  • queued or processing: loop back to the Wait node. Keep a counter in the loop so a stuck job cannot keep it running forever.
  • completed: the PDF/A-3 is ready.
  • failed: send the job to the error route below.

A completed job shows its proof in the response: timestampedAt and timestampTokenBase64 for the timestamp, outputHash for the result, isPdfACompliant for the conformance check.

To fetch the file, add an HTTP Request node: GET https://api.sealdoc.eu/api/download/{{ $json.id }}, with Header Auth (X-Api-Key and your key) and Response Format File. Then pass it to your storage node.

Every job also has a Legal Evidence Pack: GET /api/jobs/{id}/evidence-pack, with the same header. That ZIP always contains compliance_passport.json, MANIFEST.json and manifest.sha256, plus, where they exist, the document, chain_of_custody.json, ledger.json with public-keys.jwk, and the RFC 3161 token timestamp_token.tsr. It is self-contained and verifiable offline: a tax inspector can check its integrity without calling our servers. SealDoc assembles it right after the job; ask in the first moments and the API answers 409 with a Retry-After header.

What about errors

Two kinds, at two moments:

  • When you submit. A missing file or invalid OCR languages give a 400, a plan without the feature gives a 402, and a used-up monthly limit gives 409 quota_reached. In those cases no job is created, and the SealDoc node stops the workflow. Set its On Error setting to continue with an error output if you want to route these.
  • While processing. The job ends with status failed, and errorMessage says why, for example a file that cannot be opened. Route the failed branch of your IF node to Slack or email, so a person knows something needs attention.

A timestamp authority that does not answer does not fail the job. The job completes, and compliance.rfc3161Timestamp in the Get response shows whether the timestamp is there.

Why three nodes is enough

This workflow contains no conversion, timestamping or archive logic of its own. That is the point. SealDoc’s API is the boundary; your n8n workflow is the connective tissue between that boundary and your business systems. When the rules or the formats evolve, SealDoc evolves behind the same API call, and you update the node version.

This workflow archives the documents you receive. For the invoices you send, the same node has the Invoice resource, which turns structured data into a Factur-X, XRechnung or Peppol BIS invoice. See how to generate a compliant e-invoice with n8n.

Beyond n8n

Everything in this tutorial is also available through SealDoc’s REST API directly. From the Growth plan, webhooks push job.processing, job.completed and job.failed to your own endpoint, so you can drop the polling loop entirely. All the ways to connect are on our integrations page.

The compliance plumbing is solved. What you do with the time you save is up to you.

← Back to all articles