Electronic invoicing is often presented as a technical or regulatory topic. In reality, it is first and foremost a trust problem. Invoices contain sensitive financial, contractual and sometimes personal data. Once exchanged through Peppol or similar networks, these documents become part of critical business flows that must be secure, reliable and auditable. ISO/IEC 27001 is widely referenced in this context, yet frequently misunderstood.