Encadena SIF

Encadena SIF is an independent plugin. Veri*factu (Verifactu) is the invoice verification system of the
Spanish Tax Agency (AEAT): this plugin is not affiliated with, endorsed by or sponsored by the AEAT.

Encadena SIF turns every WooCommerce order into a Spanish billing record (registro de facturación) that follows
Royal Decree 1007/2023 and Order HAC/1177/2024: it creates the record, chains it with its SHA-256 hash, prints the
tax QR and either sends it to the Spanish tax agency (VERIFACTU mode) or keeps it chained locally (non VERIFACTU
mode, with event records).

It is a Verifactu plugin: Verifactu is how everyone writes it, and Veri*factu is the official name the AEAT uses.
Both are the same regulation, and this plugin works either way: with a certificate it submits to the AEAT, and without
one it keeps the chain in the shop.

The plugin is free and complete: issuing, voiding, corrective invoices, QR, PDF and submission with the
shop’s own certificate. Every feature is in this download; nothing is held back.

What it does, and why it is built this way

• The hash reproduces exactly the official AEAT examples (three cases from the technical specification v0.1.2),
  and the QR reproduces the four official URL variants.
• Records are immutable: they are only inserted, never updated or deleted. The submission state lives in a
  separate table, so the fiscal content of a record never changes.
• Independent chains per taxpayer and correlative numbering per series and tax ID.
• The certificate is stored outside the public directory, encrypted, in uploads/encadena-sif-certs/, and its
  password is encrypted too: it is read from the ENCASI_CERT_PASS constant in wp-config.php when you define it, or
  from the encrypted copy the plugin keeps next to the certificate.
• PDF invoice with the QR: with PDF Invoices & Packing Slips for WooCommerce active, the invoice carries the
  record number and date, the customer tax ID, the issuer’s fiscal data and the verification QR.
• Compatible with WooCommerce High-Performance Order Storage (HPOS).

What the shop owner never has to fill in

The system identifier, its version, the producer and the responsible declaration travel with the plugin. The shop
only configures its own data: tax ID, legal name, series, when to invoice, and its certificate.

External services

The plugin connects to two external services. Both are optional: without a certificate it never contacts the AEAT,
and the Telegram notice stays off until a bot token and a chat are entered.

Spanish Tax Agency (AEAT) — Veri*factu

• What is sent: the billing record (invoice number and date, amounts and tax breakdown, the customer’s tax ID and
  name, the previous record’s hash and the hash of the record itself). No other data of the shop or of the customer
  is sent, and nothing is sent while the plugin is in non VERI*FACTU mode.
• When: only when the mode is VERI*FACTU and an order reaches the status you chose, and when you press
  “Test connection” in the panel.
• Where: https://prewww1.aeat.es/wlpl/TIKE-CONT/ws/SistemaFacturacion/VerifactuSOAP (test) or
  https://www1.agenciatributaria.gob.es/wlpl/TIKE-CONT/ws/SistemaFacturacion/VerifactuSOAP (production).
• How it identifies itself: with the certificate you upload (mutual TLS). There is no shared credential and no
  account with the AEAT.
• Terms of service: https://sede.agenciatributaria.gob.es/Sede/condiciones-uso-sede-electronica/aviso-legal.html
• Privacy policy: https://sede.agenciatributaria.gob.es/Sede/condiciones-uso-sede-electronica/aviso-legal/politica-privacidad.html

Telegram (optional notices)

• What is sent: the text of the notice (invoice issued, submission rejected, summary) and the chat identifier
  you configure. No customer data beyond what the notice text already shows.
• When: only if you enter a bot token and a chat ID in the settings, and only when one of those events happens.
• Where: https://api.telegram.org/bot<token>/sendMessage, the official Telegram Bot API.
• Terms of service: https://telegram.org/tos
• Privacy policy: https://telegram.org/privacy

The plugin does not send telemetry, does not contact any update server of its own and does not share data with any
other third party.

Privacy

The plugin does not send telemetry and does not contact any server of its own. What leaves the site is what is
described in External services above: the billing record submitted to the AEAT when the shop runs in
VERI*FACTU mode with a certificate, and the optional Telegram notice, if it is switched on.

• Privacy policy: https://farowp.com/privacidad
• Terms of service: https://farowp.com/terminos