# VATMesh — Cross-Border Structural Controls & Deterministic Tax Calculations

> B2B platform for structural validation and deterministic tax calculation of business documents, covering Europe (Italy, France) and the Mediterranean / Gulf (Tunisia, Morocco, Saudi Arabia, UAE, Egypt).

VATMesh is a software platform (OmniTax and ELFATOORA engines). It provides exact minor-unit decimal arithmetic, local XSD / Schematron structural validation, deterministic tax and withholding calculators, ERP idempotency protection, a local append-only audit journal, and a JSON-RPC MCP server for authenticated API clients.

## What VATMesh does

1. **Exact minor-unit decimal arithmetic (`/api/v1/math/calculate-breakdown`):** financial amounts are computed in integer minor units (100 for EUR, USD, MAD, SAR, AED, EGP; 1000 for TND), so `HT + tax + duty = TTC` holds without floating-point drift.
2. **Local structural validation (`/api/v1/validate/xml`):** deterministic schema, checksum and arithmetic checks for Italy `FatturaPA v1.2.2`, Tunisia `TEIF v1.8.8`, Saudi Arabia `ZATCA FATOORA (UBL 2.1)` and EU `Factur-X (EN 16931)`. The endpoint requires an API key.
3. **Deterministic simulators (`/api/v1/sandbox/clear`):** local simulations of the Italian SdI, Tunisian TTN, Saudi and Egyptian rule sets. They never contact an administration and require an API key.
4. **ERP idempotency (`Idempotency-Key`, 24 h replay window):** SHA-256 request fingerprinting (`tenantId + method + path + rawBody`); identical retries replay the cached response, concurrent duplicates get `409`, mutated payloads reusing a key get `422`.
5. **Append-only audit journal (`/api/v1/audit/seal`, `/api/v1/audit/verify-chain`):** continuous SHA-256 hash chain (`entryHash = SHA256(seq | prevHash | tenantId | docId | eventType | payloadHash | timestamp)`) with binary Merkle inclusion proofs and database triggers that abort updates and deletes. Retention follows the customer's own policy; no qualified external timestamp authority is claimed.
6. **Tenant isolation and OpenAPI 3.1 contract (`/api/v1/openapi.json`):** every query and proof is scoped by a validated `tenant_id`; cross-tenant access attempts return `403 FORBIDDEN_CROSS_TENANT_ACCESS`. The production database is SQLite with application-level tenant scoping — no PostgreSQL row-level-security policy is claimed.
7. **Transparent metered overages:** quotas and overage rates are published per plan, with a grace buffer so a deadline is never blocked by a quota reset.

## What VATMesh does not do

- It is not accredited, mandated or certified by any tax administration.
- It never transmits, files or submits anything to an administration, and it does not issue clearances, receipts or certificates of conformity.
- It does not provide legal, tax or accounting advice, and it does not certify the legal validity of a document.
- It does not operate a payment, banking or treasury service.

## Epistemic integrity

- **Publisher status:** VATMesh acts strictly as a software publisher and pre-validation tool, not a bank, EMI or regulated accounting firm. It prepares XML payloads that the customer signs with its own qualified certificate authority (for example TunTrust/ANCE DigiGo, an Italian QTSP, a ZATCA CSID or an ETA eSeal).
- **No data mining:** customer financial data, tax identifiers and line items are never sold, rented or used to train models.
- **Sources:** statutory references point to official primary sources (official gazettes, finance ministry decrees, tax authority circulars).

## Jurisdictions covered (local engines, local execution)

- **Tunisia (TN):** Code de la TVA, TEIF XML v1.8.8, 1.000 TND fiscal stamp, payroll and corporate tax calculators, TEIF withholding declaration generator.
- **Italy (IT):** DPR 633/72, FatturaPA XML v1.2.2 validator, Codice Destinatario checks, TD17 autofattura generator, bollo virtuale inspection.
- **France (FR):** Factur-X / CII EN16931 generator, SIREN/SIRET and VAT-number checks, TVA settlement calculator, e-reporting package generator.
- **Morocco (MA):** CGI (ICE, tax identity), DGI SIMPL XML generator, TVA and corporate tax calculators.
- **Saudi Arabia (SA):** ZATCA FATOORA (UBL 2.1) generation, TLV QR generation, TRN and national-address checks, zakat and withholding calculator.
- **United Arab Emirates (AE):** FTA TRN checks, UBL 2.1 generator, VAT and corporate tax calculators.
- **Egypt (EG):** ETA e-invoice generator, RIN and GS1 item code checks, VAT and withholding calculator.

## Key URLs and machine-readable endpoints

- Homepage and corridor simulator: https://vatmesh.com/
- OpenAPI 3.1 specification: https://vatmesh.com/api/v1/openapi.json
- ERP and e-invoicing integration guide: https://vatmesh.com/how-to#erp
- Checkout: https://vatmesh.com/checkout
- Regulatory perimeter register: https://vatmesh.com/regulatory-status
- Blog and guides index: https://vatmesh.com/blog

## Trust, security and compliance documents

- Security posture: https://vatmesh.com/security
- Data processing agreement: https://vatmesh.com/dpa
- Sub-processors directory: https://vatmesh.com/subprocessors
- Privacy policy: https://vatmesh.com/privacy
- Terms of service: https://vatmesh.com/terms

## Canonical pricing (source of truth: `src/auth/country_profiles.js`)

- **Nano:** free (10 documents / month) — evaluation access.
- **Solo:** 9 € / 29 DT / 79 MAD / 49 SAR / 49 AED / 190 EGP — 100 documents / month; overage +0.08 € / +0.25 DT.
- **Pro:** 49 € / 160 DT / 350 MAD / 189 SAR / 189 AED / 850 EGP — 500 documents / month; overage +0.05 € / +0.15 DT.
- **Cabinet:** 199 € / 650 DT / 1,290 MAD / 690 SAR / 690 AED / 2,900 EGP — 2,500 documents / month pooled, up to 30 entities; overage +0.05 € / +0.15 DT.
- **Enterprise:** custom quote (10,000+ documents / month, dedicated instance, service level defined by contract).

Cabinet is invitation-only and Enterprise is a custom contract: neither is self-provisioned, and Nano never opens a paid checkout session.

## Publisher and contact

- **Editor / publisher:** VATMesh — Vat Mesh Technologies Ltd. Company registration number, registered address, VAT status and the named data protection officer are being verified and are published on the legal pages once confirmed; until then, legal requests are handled at legal@vatmesh.com.
- **Security vulnerabilities:** security@vatmesh.com
- **Enterprise sales and custom corridors:** sales@vatmesh.com
- **General support:** support@vatmesh.com