Xesta

Role

Own product: architecture, backend, regulatory core and infrastructure.

Challenge

Under Spain's anti-fraud law, invoicing software must guarantee that records cannot be altered, chain them with hashes, sign them, include a verifiable QR code and send them to the Tax Agency (AEAT), without a connection outage ever stopping invoicing.

Solution

• • Veri*Factu core isolated from the rest of the app: hash chaining, QR generation and XAdES electronic signatures.
• • Billing records immutable at three levels: database permissions, PostgreSQL triggers and application-level guards.
• • Invoices are issued locally at once; submission to the AEAT goes through a queue with retries and exponential backoff, so an outage never blocks invoicing.
• • SOAP client for the AEAT and an automated test suite covering the regulatory pieces.
• • 100% European infrastructure: everything in Docker on Hetzner Cloud, with backups to Hetzner Storage Box. No AWS, Azure or Google Cloud.

Stack

Related services