VeriFactu — Electronic billing
Pool-Control generates VeriFactu compliant billing records: chained SHA-256 fingerprint, SOAP XML and QR code in the PDF.
What is implemented
| Function | Status |
|---|---|
| Fingerprint and chaining when issuing invoice | Available |
| XML VeriFactu (SOAP draft) | Available |
| Validation QR in PDF | Available |
| XML download from invoice detail | Available |
| Rectifications (R1 credit) with reference to original invoice | Available |
| Immutability: do not edit issued invoices | Available |
| Company Certified (.pfx) | Settings → Company → VeriFactu Certificate |
| Sending to AEAT pre-production | Tenant certificate + ALLOW_AEAT_SEND=confirm on server |
| XAdES Signature | Pending (approved production) |
| Real AEAT production | Blocked (ALLOW_PROD + XAdES) |
Usual flow
- Create or generate a draft invoice.
- Review data and press Issue — number, fingerprint and XML are assigned.
- The invoice cannot be edited (only rectified with credit).
- Download PDF (with QR) or XML.
- Optional: Send AEAT (PRE) from the detail (only if the server has a certificate from the obligated issuer).
Requirements for AEAT shipping
- Upload the .pfx/.p12 certificate of the obligated issuer in Company Settings (the NIF of the certificate must match the NIF of the company).
- Company name = name in AEAT census (must match the certificate).
- Software producer NIF configured in SuperAdmin → VeriFactu (different from the tenant's NIF).
- Default pre-production environment (
verifactuProduction = false). - In local development you can use
VERIFACTU_CERT_PATH(not in Render production). - When uploading the certificate in Settings: you are informed of the AES-256-GCM encryption, AEAT purpose and possibility of deletion; detail in política de privacidad and Company Settings.
Automatic test matrix
| Suite | What is valid |
|---|---|
verifactu-hash.test.ts | Footprint F1/F2/R1 |
verifactu-xml.test.ts | Recipient XML, chaining |
verifactu-aeat-response.test.ts | Correct/Incorrect Parser |
verifactu-compliance.test.ts | API legal rules (immutability, VF-free purchases) |
pnpm test:verifactu-xsd | XML Samples (structure/XSD if xmllint) |
RUN_AEAT_INTEGRATION=1 | Actual PRE Shipping (optional, no CI) |
Internal test accounts
| Account | Subdomain | Usage |
|---|---|---|
| Public demo | AquaDemo | Testers — fictitious data (CIF demo) |
| VF Laboratory | vf-lab | VeriFactu tests with real developer data — not the public demo |
Laboratory access (seed): admin@vf-lab.test / password123
Command to recreate dynamic lab data:
cd packages/server && pnpm seed:vf-lab -- --resetPurchases and VeriFactu
The supplier invoices, receipts, payments to the supplier and purchase cancellations/credits in the ERP are not sent to AEAT as VeriFactu registration.
| Document | VeriFactu from Pool-Control? | Reason |
|---|---|---|
| sale invoice (customer) | Yes — hash, XML, QR, PRE send | You are the mandatory issuer |
| Credit / rectification sale (R1) | Yes | Rectify an invoice that you issued |
| supplier invoice (purchase) | No | It is registered by your provider; you only post the receipt |
| Payment or cancellation of purchase | No | It is not a registration record of your billing issued |
If your supplier is obliged to VeriFactu, he sends the XML to the Treasury; Pool-Control does not replace that shipment.
Legal registration vs internal audit
| Layer | What keeps | Where to see it |
|---|---|---|
| VeriFactu Registration (mandatory issuer) | SHA-256 fingerprint, chaining, SOAP XML, AEAT status | Invoice issued: technical fields + XML download |
| Business audit | Who issued, attempts to edit blocked, AEAT PRE submissions | Settings → Audit (SETTINGS_VIEW_LOGS) |
Relevant audit actions: INVOICE_ISSUED, VERIFACTU_EDIT_BLOCKED, VERIFACTU_AEAT_SEND.
Exportable logbook (bulk CSV/XML for inspection) is pending; Today the technical record is in each invoice issued.
PRE environment until official registration in census
Until the company is registered and the AEAT census matches the certificate and company name:
- Use only pre-production (
verifactuProduction = false, hostprewww1). - Shipments only with
ALLOW_AEAT_SEND=confirmand supervision. - Validate in tenant
vf-lab(not AquaDemo public demo). - Do not activate AEAT production or
ALLOW_PRODin Render.
When the official registration is ready: tenant certificate in Settings, Correct PRE test from the app, then approval (XAdES) before production.
Rectify ≠ delete
Issued invoices cannot be deleted. To correct: use Rectify → credit (R1) and, if applicable, new invoice.