Release Notes — April 19, 2026
This release completes the EU VAT, Stripe Tax & Subscription Invoicing project (Phases 1–4) and ships the corresponding GDPR sub-processor update to the Privacy Policy and Data Processing Agreement (DPA).
EU VAT, Stripe Tax & Subscription Invoicing
Overview
CADENSA now issues its own legally compliant subscription invoices end-to-end:
- Stripe Tax automatically calculates VAT for HU, EU and non-EU customers (including B2B reverse charge for valid EU VAT numbers).
- The Hungarian e-invoicing provider Billingo issues the actual electronic invoice and sends the mandatory data to the Hungarian Tax Authority (NAV) via the Online Számla 3.0 system.
- The PDF is archived in Wasabi (eu-central-2 / Frankfurt) under WORM Object Lock COMPLIANCE mode for the legally mandated 8 years.
- Customers can browse and download their invoices from the new in-app Billing → Invoices page.
What's new for customers
| Feature | Details |
|---|---|
| Billing details form | Required before any subscription. Captures company name, address, EU VAT number (validated via VIES), tax number, contact email. |
| EU VAT number validation | Real-time validation against the EU VIES database, results cached for 30 days. |
| Automatic VAT calculation | Powered by Stripe Tax — correct rate for HU domestic, EU cross-border (B2B reverse charge / B2C OSS), and non-EU 0% export. |
| Own invoice numbers | Format CDN-YYYY-NNNNNN (e.g. CDN-2026-000001). Replaces Stripe-hosted invoice URLs. |
| In-app invoice history | New page at /billing/invoices listing all subscription invoices with PDF download. |
| Email link | Invoice success emails now link to the in-app history (PDF auto-downloads from Wasabi via short-lived presigned URL). |
Reliability
- Idempotent webhook handler —
invoice.payment_succeededis safe to replay. - Hourly retry job — failed invoice generations (Billingo timeouts, Wasabi outages, etc.) are retried up to 5 times.
- Admin browser — operations team has a dedicated screen at the admin app to inspect, filter and manually retry any invoice.
GDPR — Sub-processor update (Privacy Policy v2.1, DPA v1.1, GDPR v1.1)
The two new infrastructure providers have been added to all customer-facing legal documents:
Wasabi Technologies, LLC
| Property | Value |
|---|---|
| Purpose | Subscription invoice PDF archival |
| Region | EU — eu-central-2 / Frankfurt, Germany |
| Retention mode | WORM Object Lock COMPLIANCE — 8-year immutable retention |
| Legal basis | Hungarian Accounting Act §169 (8 years mandatory for accounting documents) |
| DPA | wasabi.com/legal/data-processing-addendum |
| Data | Invoice PDFs only — no operational user data |
Billingo Technologies Zrt.
| Property | Value |
|---|---|
| Purpose | Electronic invoice issuance + NAV Online Számla 3.0 reporting |
| Region | EU — Hungary |
| DPA | billingo.hu/adatvedelem |
| Data transferred | Customer name, billing address, tax / EU VAT number, email, invoice line items and amounts |
| Retention | 8 years (mandatory under Hungarian Accounting Act §169) |
| Sub-processors | NAV (Hungarian Tax Authority — mandatory legal reporting) |
Document version updates
| Document | Old version | New version |
|---|---|---|
| Privacy Policy | 2.0 | 2.1 |
| DPA Template | 1.0 | 1.1 |
| GDPR Compliance Page | 1.0 | 1.1 |
Total sub-processors: 7 (was 5) — Hetzner, Stripe, Tarhely.eu, Vercel, Wasabi (NEW), Billingo (NEW), Google Analytics.
Right to object
In line with GDPR Article 28(2), enterprise customers have 30 days to object to either of the new sub-processors by emailing support@cadensa.io. If you object and we cannot find a mutually acceptable alternative, the affected service may need to be terminated.
Documentation updates
- Data Security FAQ — Wasabi and Billingo added to the third-party services list (EN + HU).
- Privacy Policy — new dedicated Billingo subprocessor card; Wasabi block clarified.
- DPA Template — Article 7 (Sub-processors) now lists 7 entries with full disclosure.
- GDPR Compliance — third-party processor list expanded to 7 entries.
Developer-facing notes
- New env vars introduced for the invoicing pipeline:
BILLINGO_API_KEY,BILLINGO_PDF_MAX_ATTEMPTS(default8),BILLINGO_PDF_DELAY_MS(default1500),WASABI_ACCESS_KEY_ID,WASABI_SECRET_ACCESS_KEY,WASABI_REGION,WASABI_BUCKET,WASABI_ENDPOINT. - A development-only flag
WASABI_ALLOW_NO_LOCK_FALLBACK=trueallows uploads to a bucket without Object Lock for local testing. This must befalsein production — Object Lock is required for legal compliance. - Billingo PDF generation is asynchronous: the new
downloadInvoicePdf()validates%PDF-magic bytes and retries up to 8× with 1.5 s spacing before giving up. JSON error bodies returned with HTTP 200 are now correctly detected as transient.
Still needed before EU production launch
The implementation is complete; remaining items are external/legal/DevOps:
- Wasabi production bucket with Object Lock COMPLIANCE configured
- Billingo account on Axeri Bt. + NAV connection activated
- NAV OSS-IN registration (for EU cross-border B2C)
- Stripe Dashboard: Tax enabled + HU Domestic + HU Union OSS registration
- Production smoke test (T16 manual test playbook)
Until OSS is registered, the platform is fully ready to serve HU customers (B2C + B2B), EU B2B (reverse charge) and non-EU customers (0% export).