VeriFactu is a SaaS electronic-invoicing platform built by ALMC Security S.L.U. (Lleida, Spain) to help Spanish businesses comply with the VeriFactu regulation (Real Decreto 1007/2023), which requires invoices to be digitally signed, chained via SHA-256 hashing, and transmitted to the AEAT tax authority in real time. Rather than a manual accounting add-on, VeriFactu runs as backend infrastructure: when an order or invoice is created in a connected store or app, VeriFactu signs it with an AES-256-GCM + HKDF encrypted digital certificate, chains it to the previous invoice, and submits it to AEAT automatically, typically within milliseconds.
The product ships five official plugins — for WooCommerce, PrestaShop, Shopify, OpenCart, and Stripe — so ecommerce and subscription businesses can go live with minimal setup, plus a versioned REST API (OpenAPI 3.0) with webhooks, real-time NIF/CIF/DNI/VIES validation, multi-store/multi-company/multi-series support, and a dashboard for monitoring AEAT acceptance rates, quota usage, and certificate expiration. Rate limiting, IP whitelisting, and automatic exponential-backoff retries are built in for reliability, and ALMC also offers a white-label option so accountancies and advisory firms can manage VeriFactu on behalf of multiple clients from one multi-client dashboard.
Key Features
VeriFactu Regulation Compliance — Each invoice is digitally signed and sent in the AEAT's official XML schema per Spain's VeriFactu regulation (RD 1007/2023).
Automatic AEAT Submission — Invoices are signed, chained, and transmitted to the AEAT tax authority in real time upon order completion, with no manual batching.
5 Official E-commerce Plugins — Native, ALMC-maintained plugins for WooCommerce, PrestaShop, Shopify, OpenCart, and Stripe.
Encrypted Digital Certificates — Certificates are protected with AES-256-GCM + HKDF envelope encryption and per-tenant key derivation.
Complete REST API — A versioned (v1) REST API with OpenAPI 3.0 documentation covers invoices, certificates, series, NIF validation, and webhooks.
Real-Time Webhooks — HMAC SHA-256 signed webhook notifications report invoice status instantly, with exponential-backoff retry logic.
Real-Time NIF/CIF/DNI Validation — Spanish tax IDs are validated before invoice issuance, with an optional VIES lookup for intra-community VAT.
Control Dashboard — A live metrics panel shows monthly invoice volume, AEAT acceptance rate, quota usage, latency, and certificate expiration.
Multi-Series Support — Manage multiple invoice series with atomic counters across departments, stores, or invoice types.
Rate Limiting & IP Whitelisting — Redis-based sliding-window rate limits and per-API-key IP filtering protect the API from abuse.
Intelligent Retries — Invoices rejected by AEAT are automatically resubmitted using exponential backoff to prevent data loss.
Certificate Expiry Alerts — Automated email notifications fire at 60, 30, and 7 days before certificate expiration.
Pros & Cons
Pros
Native plugins for WooCommerce, PrestaShop, Shopify, OpenCart, and Stripe cover the most common ecommerce and billing stacks
Automatic, real-time invoice signing and AEAT submission removes manual compliance work
REST API with webhooks and a sandbox environment supports custom integrations
No lock-in contracts, and data stays exportable for 30 days after cancellation
White-label option lets accountancies manage VeriFactu for multiple clients from one dashboard
Cons
Built specifically for Spain's VeriFactu/AEAT regulation, so it has no relevance for businesses outside Spain
Free and Starter tiers cap monthly invoice volume (10 and 100 invoices respectively), requiring an upgrade as volume grows
Priority support and SLA guarantees are reserved for the Business and Enterprise plans