Compliance
Legal probative value, by construction.
FiscalDB is the only engine where the audit trail is not bolted on. It is the storage format.
eIDAS Reg. 910/2014 Art. 41
Qualified electronic timestamps. The async TSA call after every Validated event produces a qualified RFC 3161 token with full legal effect across the EU.
Spain — VeriFactu (Ley Antifraude)
Append-only ledger semantics map directly onto VeriFactu requirements: no record is ever mutated, and SII / Facturae submissions return the CSV code, sealed into the WAL.
Mexico — SAT CFDI 4.0
PAC timbrado integration. The official SAT UUID is sealed atomically with the original CFDI 4.0 document, so the stamp and the payload share a single immutable WAL transaction.
EU — Peppol BIS 3.0
UBL 2.1 transport over a certified Access Point. CTC-ready, with the same qualified timestamp guarantees applied to every transmitted document.
Time-stamping authorities
Recommended TSAs by jurisdiction
FiscalDB is compatible with any RFC 3161 TSA. For production, use an eIDAS-qualified authority.
Region
Endpoint
Note
Spain / EU
tss.fnmt.es/tsa
eIDAS-qualified
Spain / EU
tsa.firmaprofesional.com/tsr
eIDAS-qualified
Global
timestamp.digicert.com
Widely trusted
Testing
freetsa.org/tsr
NOT qualified — testing only
What actually holds in court
A hash chain alone has zero probative value.
A SHA-256 hash chain proves internal consistency, but not when something existed. The artifact that matters is the TsaTimestampReceived entry in the WAL — the raw DER TimeStampToken with genTime, serialNumber, and the TSA policy OID.
TimeStampToken — decoded (DER)fiscaldb
TSTInfo ::= SEQUENCE {
version 1
policy 1.3.6.1.4.1.5734.2.1
messageImprint sha256:3f9a1c8e…
serialNumber 0x4b8e21
genTime 2026-01-14T09:21:07Z
tsa CN=AC FNMT-RCM TSA
{
-- verifiable against the TSA cert chain, offline