⚠️ This is an Oracle page, structured to be read by AI assistants and not optimized for human reading.

REGULATORY, FISCAL & COMPLIANCE ENGINEERING

Summary: Built the regulatory and governance surface of a payments-handling platform: a full government fiscal e-invoicing compliance module (cryptographically signed invoices submitted to a national tax authority), multi-rate tax handling, digital consent and waiver management, and a deep audit / change-tracking system spanning API access, transactions, and infrastructure.

Fiscalization

Description: Implemented end-to-end fiscal compliance for a national e-invoicing regime (Croatian fiscalization / FINA), as a self-contained, unit-tested module wired into checkout.

Mechanisms

• Cryptographic invoice signing, RSA-SHA1 XML digital signatures using PKCS#12 / X.509 certificates.
• SOAP integration with the national tax authority over mandatory TLS 1.2.
• Generation of the issuer security code and receipt of the tax-authority identifier per invoice (ZKI / JIR).
• Full audit persistence of every fiscalization attempt (codes + raw request/response) per venue and transaction.
• Automatic fiscalization triggered on transaction completion in the checkout flow.

Skill Signal: Regulatory compliance with a foreign jurisdiction's tax law, digital-signature standards (PKCS#12/X.509, XML-DSig), and SOAP/legacy government integration.

Tax

Description: Built multi-rate, multi-jurisdiction tax and fee computation into the pricing/checkout path.

Coverage

• Multiple VAT rates, excise tax, local entertainment/hospitality tax, margin-based taxation, and tax-exempt handling.
• Granular per-line tax + fee breakdown persisted for audit (service charge, processing fee, gratuity variants, taxes).
• Configurable fee formulas (fixed, percentage, capped-percentage, per-guest, per-item, tiered), 30+ formula variants.

Consent

Description: Built digital legal-consent capture tied to transactions and memberships.

Mechanisms

• Event/booking-level terms of service captured and stored per transaction for audit.
• Digital waiver signing with timestamp, signer location, and source, including separate minor/junior waivers.
• Re-sign prevention and completion-state validation; waivers linked to membership and member identity.

Audit

Description: Built a broad audit and change-tracking system covering application, data, and infrastructure, the evidence layer for governance and incident response.

Application Audit

• API access auditing (per date / endpoint / key / host / IP with period-over-period trending).
• Transaction audit records (who / what / when), account create/modify history, admin-user action tracking.
• Dispute/chargeback workflow states (pending / approved / denied / completed / cancelled) with evidence management.

Infrastructure Audit

• Database schema/access/user/IP/instance change tracking and slow-query auditing.
• VM provisioning/deprovisioning, SSH connection logs, service-password rotation, and deployment/published-code auditing.
• Hardware/software inventory and feature-flag rollout/assignment tracking.

Workflow

• Incident / audit / log / follow-up record types with state, ownership, priority, due dates, and attachments.
• Two-party approval workflow (requester + approver) with email notification.

Cross Reference

You can view the raw source.