Regulatory compliance
Verifactu is already mandatory: how it works in Odoo and how we set it up for you
Verifactu has been mandatory since January 1, 2026 for companies (sociedades) and since July 1, 2027 for everyone else required to issue invoices in Spain. If your business is not enrolled in the SII (Immediate Supply of Information) and doesn't have a compliant system yet, you're already past the deadline.
What Verifactu is
Verifactu comes from the Billing Regulation approved by Royal Decree 1007/2023, developed further by Order HAC/1177/2024. The regulation defines two modes: the Verifactu mode, with immediate remission of every billing record to the Spanish Tax Agency, and the non-remission mode, which places a heavier evidentiary burden on the issuer if the tax authority asks them to justify their invoices. Companies already enrolled in the SII (Immediate Supply of Information) are exempt from this obligation.
How it works in Odoo
The flow, start to finish:
- 1
You enable Verifactu in Odoo and configure your digital certificate.
- 2
When you confirm an invoice, Odoo generates its billing record (the ‘registro de alta’) with a SHA-256 fingerprint chained to the previous record — each invoice is linked to the one before it.
- 3
That record is remitted immediately to the Spanish Tax Agency.
- 4
Odoo reflects the status of each remission and handles resubmission if the tax agency returns an error.
- 5
The invoice carries the tax QR code and the legend the regulation requires.
- 6
If you need to cancel or correct an invoice, Odoo generates its own chained record — a previous record is never deleted or overwritten.
What the regulation requires from your billing system
Verifactu isn't just a submission formality: it requires the billing system to guarantee the integrity, traceability, and retention of every record. The chain of SHA-256 fingerprints makes each invoice depend on the one before it — lose that chain, and you lose the proof that your invoices haven't been tampered with. That makes retaining those records — and therefore backing them up and being able to recover them — a legal obligation, not an optional extra.
Our turnkey offer
We set up Odoo Community (version 17 or 18) with the OCA (Odoo Community Association) Verifactu modules, ready to operate:
- A docker-compose with Odoo Community 17 or 18 and the OCA Verifactu modules, configured with your own company's digital certificate.
- A backup and recovery system for the billing record chain, managed by our technical support — keeping that chain intact is a legal requirement, not an extra.
Choose how you want it: on-premise or managed cloud
Same Verifactu compliance either way — the difference is who operates the infrastructure. There's no better option: it depends on how you'd rather work.
On-premise
The docker-compose is installed on your own infrastructure. You control the environment; we configure Verifactu, your digital certificate, and the backup.
Managed cloud (AWS, Azure, or GCP)
We deploy the same docker-compose in the cloud — AWS, Azure, or GCP — so you don't have to deal with any local installation. Same certificate, same backup managed by our technical support.
Frequently asked questions
- If your business issues invoices in Spain and isn't enrolled in the SII (Immediate Supply of Information), yes. It's mandatory since January 1, 2026 for companies and since July 1, 2027 for everyone else required to comply.
- We add Verifactu to your existing Odoo, or deploy Odoo Community (17 or 18) with the OCA Verifactu modules from scratch — depending on your starting point.
- Verifactu regulates the billing software itself: the billing record, its chained fingerprint, and the remission to the Tax Agency are generated when you confirm the invoice, regardless of whether you later print it or send it on paper.
- If your business is enrolled in the SII (Immediate Supply of Information), you're exempt from the Verifactu obligation.
- Your own company's digital certificate — we configure it in your Odoo as part of the setup; we never use a shared or third-party certificate.
- Both comply equally with Verifactu — the difference is only who operates the infrastructure. On-premise if you'd rather control it yourself; managed cloud (AWS, Azure, or GCP) if you'd rather we handle it. In both cases, your digital certificate and the managed backup/recovery are the same.