Custom software development in Spain
We are a Spanish company. The software we build invoices in euros, complies with the GDPR and faces the strictest invoicing regulation this country has ever had.
What we run in Spain today
Scan and Buy is a Spanish company based in Málaga. This is where our autonomous stores run, where our servers are and where we invoice from.
Building management or retail software for Spain today means three concrete things: issuing invoices with a chained, tamper-evident record, processing personal data under the GDPR with the AEPD as supervisory authority, and taking payments through a PSD2-regulated gateway with strong customer authentication. The rest — language, design, catalogue — is the easy part.
How you get paid
The payment method decides the checkout.
Currency: Euro (EUR). A checkout copied from another country fails here before it fails anywhere else.
Stripe
It is our default gateway for online payments in Spain. In our veterinary marketplace the gateway choice is resolved in code: Spain charges through Stripe in euros, Argentina through Mercado Pago in pesos. It is not a setting someone has to remember to change.
Yavin
The card terminal in our autonomous stores. PCI DSS certification for card payments belongs to the gateway, not to us — claiming otherwise is what half the industry does and it does not hold up.
Bizum · SEPA
Bizum is Spain's most widely adopted instant person-to-person payment method and increasingly appears in commerce. Direct debits and transfers run over SEPA, with IBAN and mandate.
Tax obligations
What the tax authority demands from the software.
It is not a module bolted on at the end. It shapes the data model, and redoing it later costs far more than getting it right from the start.
| Framework | What it means for the system |
|---|---|
| AEAT · Verifactu | The invoicing software regulation requires each invoice to produce a chained record carrying the previous one's hash, signed and tamper-evident, with a QR code printed on the invoice itself. Software that lets you edit an already-issued invoice is not compliant, however well it works. |
| VAT | Standard, reduced and super-reduced rates, plus the Canary Islands (IGIC) and Ceuta and Melilla (IPSI) regimes, which are not VAT and break any calculation assuming a single consumption tax across the whole territory. |
| B2B e-invoicing | The business growth act extends electronic invoicing to transactions between companies and professionals, with an obligation to report payment status. That is data the software must store and transmit, not merely print. |
Experience
What almost nobody accounts for
Hash chaining changes how the database is designed, not just what gets printed. If an invoice's record depends on the previous one, numbering cannot have gaps or be reordered, and two processes invoicing at once cannot each request a number on their own. We solved it by assigning the number inside the same transaction that creates the invoice: either both happen or neither does. It is boring, and it is exactly what prevents a gap in the series you later have to explain.
Regulatory framework
Who regulates the product.
AEMPS
Spanish Agency for Medicines and Medical Devices. It authorises human and veterinary medicines and sets the summary of product characteristics, the source any serious digital vademecum is checked against.
AEPD
Data protection supervisory authority. It is who sanctions badly implemented cookie consent, which is more common than it looks: a banner is painted, the choice is stored, and nobody tells the tag about it.
Data protection
GDPR and the Spanish data protection act. Our servers are in the European Union and the database is self-hosted Supabase, not a managed service on another continent: the international transfer that does not exist is the one you never have to justify.
Other markets
The figures behind all of the above are on the pricing page, and the terms used here are in the glossary.
FAQ
Custom software in Spain
Do you develop in Spain or subcontract abroad?
We develop in-house, from Málaga. Servers are in the European Union and the infrastructure is self-hosted, database included.
Is the software you build Verifactu compliant?
The invoicing module we build issues chained records with hashes, gapless sequential numbering assigned inside the transaction, and does not allow editing an issued invoice: corrections go through credit notes. Formal compliance of a specific system depends on its own declaration, and that is reviewed project by project.
Do you hold ISO 27001 or PCI DSS certification?
No. PCI DSS certification for card payments belongs to the payment gateway we integrate, not to us. We would rather say so than display a badge we do not hold.
Can you work with a company outside Málaga?
Yes. Work is remote except for the physical installation of stores and lockers, which does require presence. Most of our projects — marketplaces, vademecums, panels, bots — do not depend on location.
A project in Spain?
Tell us what you need and we will say what it involves in this market and what we do not know yet.