21 Pre-Configured Country Profiles

One-line profile selector for European e-invoicing AND EU employment-contract signatures. Each profile preconfigures hash algorithm, canonicalization, signature level, and policy to comply with the target jurisdiction's requirements.

12 E-invoicing Profiles

9 Employment-Contract Profiles

eIDAS Regulation 910/2014

SECTION A

E-Invoicing Profiles (12)

Ready-made XAdES configurations for the major European tax authorities and Peppol participants.

Constant	Country	System	Format	Level
`spVeriFactu`	Spain	VeriFactu (AEAT)	XAdES-EPES	B-B
`spTicketBAI`	Spain (Basque)	TicketBAI	XAdES-EPES	B-B
`spFacturaeB2B`	Spain	Facturae 3.x / FACe	XAdES-EPES	B-T
`spFatturaPA`	Italy	FatturaPA (SDI)	XAdES-BES	B-B
`spSAFTPT`	Portugal	SAF-T PT	RSA-SHA256	B-B
`spKSeF`	Poland	KSeF	XAdES	B-T
`spFacturX`	France / Germany	Factur-X / ZUGFeRD	XAdES	B-B
`spEFactura`	Romania	e-Factura (ANAF)	XAdES	B-T
`spNAVOnline`	Hungary	NAV Online	XML-DSig	B-B
`spFiskalizacija`	Croatia	Fiskalizacija	XML-DSig	B-B
`spPeppolBE`	Belgium	Peppol UBL 2.0	XAdES	B-T
`spPeppolBG`	Bulgaria	Peppol UBL 2.1	XAdES	B-T
`spMyDATA`	Greece	myDATA (AADE)	XAdES	B-B

SECTION B

EU Employment-Contract Profiles (9)

eIDAS-aware signature profiles tuned to each member state's labour-law requirements. AdES or QES, the right hash, the right C14N, the right OCSP/timestamp expectations.

Country	Profile	Level	Hash	C14N	TS	OCSP	Notes
Germany	`spEmploymentDE`	slBLT	SHA-256	exclusive	yes	yes	§ 126a BGB requires QES for written-form contracts (e.g. fixed-term > 24 months, post-contract non-compete).
Italy	`spEmploymentIT`	slBLT	SHA-256	c14n10	yes	yes	QES (FEQ) common. CAdES (.p7m) widely used; XAdES accepted. INPS portals consume both.
Spain	`spEmploymentES`	slBT	SHA-256	exclusive	yes	no	AdES sufficient. SEPE / TGSS portals require FNMT or DNIe certificate; CRL via FNMT trust list.
France	`spEmploymentFR`	slBT	SHA-256	exclusive	yes	no	AdES OK. QES preferred for remote-signing flows under DSP2 / RGS.
Austria	`spEmploymentAT`	slBLT	SHA-256	exclusive	yes	yes	QES via Handy-Signatur / ID Austria common.
Belgium	`spEmploymentBE`	slBLT	SHA-256	exclusive	yes	yes	QES via eID card (BeID).
Portugal	`spEmploymentPT`	slBLT	SHA-256	exclusive	yes	yes	QES via Cartão do Cidadão / Chave Móvel Digital.
Netherlands	`spEmploymentNL`	slBT	SHA-256	exclusive	yes	no	AdES generally accepted; QES for some HR portals (UWV).
Poland	`spEmploymentPL`	slBT	SHA-256	exclusive	yes	no	QES via Profil Zaufany or qualified cert when contract goes to ZUS / PUE. No central labour-policy URI.

SECTION C

One-line Switching

Change jurisdiction by changing one constant. Hash, canonicalization, level, OCSP and timestamp expectations are reconfigured automatically.

Swap profiles in place

spVeriFactu → spFatturaPA is a one-line edit. The signer reconfigures every internal flag.
Employment profiles are loaded into TsgcXAdESSigner via Profile.LoadProfile(spEmploymentXX).
Override individual flags after LoadProfile when a deployment imposes stricter rules than the defaults.
Same key provider, same signer instance, same input bytes — only the profile changes.

switch-profile.pas

// E-invoicing profiles: assign to .Profile
vSigner.Profile := spVeriFactu;       // Spanish VeriFactu
vSigner.Profile := spFatturaPA;       // Italian FatturaPA
vSigner.Profile := spKSeF;            // Polish KSeF

// Employment profiles: use Profile.LoadProfile
vSigner.Profile.LoadProfile(spEmploymentDE);  // German QES B-LT
vSigner.Profile.LoadProfile(spEmploymentES);  // Spanish AdES B-T

// Override defaults if deployment requires it
vSigner.Profile.LoadProfile(spEmploymentES);
vSigner.Profile.IncludeOCSP := True;     // SEPE requires OCSP
vSigner.Profile.IncludeTimestamp := True;
vSigner.Profile.PolicyIdentifier :=
  'http://my.example/policy/v1';

SECTION D

eIDAS Context

EU Regulation 910/2014 defines three signature levels. Country profiles map each jurisdiction to the correct one.

Simple Electronic Signature (SES)

Any electronic data attached to other electronic data, used to sign. Lowest legal weight; typically not enough for employment contracts or e-invoicing.

Advanced Electronic Signature (AdES)

Uniquely linked to the signatory, capable of identifying them, created with means under their sole control, and tamper-evident. The default for most e-invoicing systems and many EU labour jurisdictions.

Qualified Electronic Signature (QES)

An AdES backed by a qualified certificate created on a Qualified Signature Creation Device (QSCD). Legally equivalent to a handwritten signature in every EU member state. Required for German written-form contracts (§ 126a BGB) and many high-value workflows.

Who validates

Tax authorities (AEAT, ANAF, AADE, NAV), labour courts, public-administration verifiers, and Peppol Access Points. The country profiles ship with the parameters those validators expect.

DEPLOYMENT NOTE

Spain — FacturaeB2B / FACe

A specific cross-cutting concern that catches Spanish e-invoicing deployments by surprise.

RSA-SHA1 for FACe submissions

The spFacturaeB2B profile produces XAdES-EPES signatures over Facturae 3.x invoices submitted to the Spanish FACe portal. PFX-backed certificates correctly produce RSA-SHA1 signatures for the FacturaeB2B profile.

Earlier sgcSign builds hardcoded SHA-256 in TsgcPFXKeyProvider, which caused FACe to reject submissions with INVALID_INVOICE-122 "los datos de la firma no son correctos". The current profile auto-selects SHA-1 for FacturaeB2B and SHA-256 for VeriFactu and TicketBAI.

spain-facturae.pas

var
  vSigner: TsgcDocumentSigner;
begin
  vSigner := TsgcDocumentSigner.Create(nil);
  try
    vSigner.Profile := spFacturaeB2B;
    vSigner.KeyProvider := vPFXProvider;
    // PFX provider auto-uses RSA-SHA1
    vSigner.SignXML(vInvoiceXML);
  finally
    vSigner.Free;
  end;
end;