Everything you need to check, prove and re-check.

Seven official registries, qualified checks with match verdicts, automatic retries, scheduled re-validation and tamper-evident evidence — the full toolchain for VAT compliance, on one European platform.

Start Free Trial View pricing

Checking

One check, five honest answers

Send a country code and an ID — normalization, scheme detection and registry routing are handled for you. And when the answer isn't a clean yes, you're told exactly why.

Forgiving input — spaces, dots and dashes are stripped, letters uppercased, country prefixes fixed — “de 123.456.789” just works.
Check against your records — optionally pass the company name and address from your invoice — the result tells you field by field whether they match the register.
Five distinct outcomes — Valid, Invalid, Unknown, Source unavailable, Not supported — “the registry is down” is never silently reported as “invalid”.
Live from the dashboard too — every check can also be started from the dashboard — no code needed for the one-off case.

Registries & coverage

Seven official registries, one API

Every answer comes from the official source for that country — the European Commission, national tax authorities, business registers — never from a cached copy.

Automatic routing — the country code decides the registry — EU IDs go to VIES, GB to HMRC, CHE to the Swiss UID register, and so on.
Preferred provider per check — pin a specific registry when you need to — per check, per schedule, or as a project default.
Growing coverage — IDs from countries without a connected registry — Singapore UEN, Indian GSTIN, Canadian BN and others — are stored and verified via manual review.

Qualified checks

“The number exists” isn't “this is really them”

An ID can be valid and still belong to someone else. Qualified checks verify that the name and address on your invoice match the register — the standard tax offices actually expect.

Per-field match verdicts — company name, street, postal code, city, region and country each get their own verdict — Match, Partial match or No match.
The registry's own verdict — where the register compares fields itself — VIES qualified checks, BZSt — its verdict is used directly, not our approximation.
Consultation numbers — qualified VIES checks return an official consultation number — archived with the result as proof for your tax office.
BZSt for German requesters — when your requester VAT ID starts with DE, the German qualified confirmation (eVatR) is used automatically for EU checks.

Reliability & retries

Registry maintenance is our problem, not yours

VIES goes down for national database backups regularly, often overnight. Checks that hit an outage retry themselves — with backoff, a safety net, and no double billing.

5 retries over 4 hours — after 1, 5, 15, 60 and 240 minutes — timeouts, rate limits and registry errors all retry automatically.
Picked up within seconds — queued checks start processing within about 15 seconds; stuck checks are detected and safely re-queued.
Manual review fallback — when every retry fails, the check moves to the review queue by default — a human closes the loop, nothing disappears.
Metered once — a check counts against your quota when it's created — retries and manual review never consume a second validation.

Batch & API

Your whole customer base, one request

Validate at signup, at checkout, or 10,000 suppliers at once — the REST API is built for automation, with the bookkeeping details already thought through.

Batch validation — send a list of IDs in one call — results come back per item, in order, delivered asynchronously via webhook or polling.
All-or-nothing input validation — if any item in a batch is malformed, the whole batch is rejected before processing — no half-imported messes.
Idempotency built in — pass an idempotency key and retries of your own requests never create duplicate checks — or duplicate charges.
Your metadata, echoed back — attach order numbers, customer IDs or ERP references to every check — up to 20 key-value pairs, returned with the result and the webhook.

Read the API reference →

POST /taxvalidation/v1/validations

{
  "countryCode": "DE",
  "rawValue": "DE812345678",
  "companyName": "Acme Software GmbH",
  "customerMetadata": {
    "erp_ref": "SUP-2041"
  },
  "attachSchedule": { "frequency": "QUARTERLY" }
}

201 · outcome: VALID 0.8 s

Scheduled re-validation

Set the cadence once. Stay current forever.

Tax advisors recommend re-validating business customers regularly — quarterly is the common rhythm. Schedules do it on time, every time, without a calendar reminder.

Monthly, quarterly or yearly — per identifier, with as many schedules as you need — attach one right when you create a check, or any time later.
Run now — trigger an immediate re-check before a big invoice — without shifting the regular schedule.
Per-schedule behavior — each schedule can set its own mode, preferred registry and failure handling — pause and resume any time.
Never silently skipped — due schedules are picked up within a minute; a failed scheduler tick is retried on the next — runs don't just vanish.

Manual review

For everything a registry can't answer

Some IDs have no connected registry. Some registries stay down. Some verdicts arrive by post. Manual review keeps all of it in the same system — with the same evidence trail.

A queue, not a dead end — failed and unsupported checks wait for a human verdict — notification emails and a webhook make sure someone sees them. Nothing expires.
Structured verdicts — reviewers record the outcome, per-field matches, a source reference and a comment — resolved with the same result format as automatic checks.
Record outside results — a confirmation letter from the tax office, a registry checked by phone — store it with the original check date and attach the letter as evidence.
Auditors see the difference — manual results carry the reviewer as actor and the method “Manual” — a human verdict is never disguised as a registry response.

Results & evidence

Every result is a self-contained file of proof

Years later, nobody remembers what was sent or who clicked what. A validation result does — it freezes the request, the registry's answer and every attachment in one permanent record.

Frozen request snapshot — the exact input, mode and trigger, plus the actor — user, API key or schedule. The result never depends on data that might change later.
The raw response, archived — the registry's exact XML or JSON answer, encrypted at rest and downloadable — the strongest evidence there is.
Attach your own evidence — confirmation letters, screenshots, PDFs — up to 10 MB per file, stored encrypted with uploader and description recorded.
Plan-based retention — results and evidence stay for your plan's retention window — with custom periods for statutory record-keeping.

Exports & reports

Hand the auditor a bundle, not a login

When the tax office or your accountant asks, you export — per check, per identifier, or everything at once. Tamper-evident, so the bundle is trusted even outside your systems.

Per-check report bundles — PDF + JSON report, the raw registry response and all evidence in one ZIP — with a SHA-256 manifest of every file.
Per-identifier dossiers — the same bundle across the full history of one VAT ID — the complete story of a customer relationship.
Bulk exports — all results as CSV, JSON and Excel in one archive — filterable by date range, outcome and registry, via dashboard or API.
Verifiable integrity — the report JSON embeds a SHA-256 of its canonical content — anyone can prove nothing was modified after export.

Webhooks

Your systems find out before anyone logs in

Async checks, batches and schedules all report back the same way: signed webhooks straight into your billing system, ERP or Slack pipeline.

Three precise events — completed for every result, invalid only when an ID fails, manual-review-required when a human is needed — subscribe to exactly what you care about.
Signed and verifiable — every delivery is HMAC-SHA256-signed with a rotatable secret — standard timestamped signatures your framework already understands.
Delivery you can trust — automatic retries with backoff, manual redelivery for 72 hours, and full delivery logs for 90 days.
Test before you ship — fire a test event at any endpoint from the dashboard — no need to make a real check fail.

Platform & governance

Compliance tooling that is itself compliant

VAT Checker runs on the TrustComponent platform — a European foundation with the governance features your legal team asks about first.

EU-hosted, EU-owned — a European company on ISO 27001-certified EU infrastructure — your validation data never becomes someone else's export.
DPA in minutes — a GDPR Art. 28 data processing agreement generated and signed online — plus SLA, NDA and custom contracts when procurement needs them.
Seats, roles & SSO — viewer, member and admin roles, OIDC single sign-on and enforced MFA — your accountant reads, your developers write.
Tamper-evident audit logs — every change with actor and before → after values — including who resolved which manual review. Exportable.
Built for agencies — organizations group multiple client projects under one roof — one login, separate data, separate DPAs per client.

Runs on the TrustComponent platform

EU-hosted

One account, one foundation — shared with every TrustComponent product.

SSO & MFA Team roles & seats Audit logs & exports Online DPA Organizations One invoice, e-invoicing

About the platform

Support

Talk to engineers, not ticket bots

From your first API call to a full customer-base migration — support comes from the people who build the product.

Migration help — moving off spreadsheets or another validation API? We help you import identifiers, set up schedules and map your webhooks.
Dedicated account manager — for custom agreements — a single contact who knows your setup.
Custom contracts & procurement — tailored agreements, procurement support and custom DPAs when your organization needs them.
Health checks — regular reviews of your validation setup — coverage gaps, schedule cadence, evidence completeness.

Talk to us →

Frequently asked questions

Why do I have to validate VAT IDs at all?

If you zero-rate a cross-border B2B invoice (reverse charge), the tax office expects you to show that your customer's VAT ID was valid at the time — otherwise you can be held liable for the VAT. Validating and keeping evidence of the validation is the standard way to protect yourself in an audit.

What is a qualified check?

A simple check confirms that a VAT ID exists. A qualified check additionally compares the company name and address you hold against the register and returns per-field match verdicts. For EU checks, VIES issues a consultation number as official proof; German requesters automatically get the BZSt qualified confirmation (eVatR).

What is a consultation number?

When VIES performs a qualified check, it returns a unique reference — the consultation number — that proves you validated that ID on that date. VAT Checker archives it with every result, together with the registry's raw response.

Which countries and registries are supported?

All 27 EU member states plus Northern Ireland via VIES, Germany's BZSt qualified confirmation, UK VAT via HMRC, Swiss UID (Zefix), Norwegian organization numbers (Brønnøysund), Australian ABN (ABR) and New Zealand NZBN. IDs from other countries can be stored and verified via manual review.

What happens when VIES is down?

Your check is accepted anyway. It retries automatically up to 5 times with increasing backoff over about four hours; if the registry stays down, it lands in the manual review queue instead of failing silently. Either way, a webhook delivers the final result — and the check is only metered once.

How long are results stored?

Retention is defined by your plan — results, evidence and raw registry responses stay available for the full window and are deleted automatically afterwards. Custom retention periods are available for businesses that need to cover full statutory record-keeping periods.

Can I re-validate my existing customer base?

Yes. Send your IDs via the batch API — each one becomes a stored identifier with its own history. Attach schedules to re-validate them monthly, quarterly or yearly, and subscribe to the validation.invalid webhook so you only hear about the ones that stop being valid.

Where is my data hosted?

In the EU. TrustComponent is a European company; validation data and evidence are stored and processed in the EU on ISO 27001-certified infrastructure, with a GDPR data processing agreement you can sign online. Checks are sent to the official registries and nowhere else.

Ready before your next audit is.

Validate, re-check & export the evidence
GDPR-compliant & EU-hosted
Integrated in minutes

Start Free Trial View pricing