RollingPOS

Tax compliance

Last updated: October 24, 2026. This page is for information; it is not tax advice.

What the law requires

A VAT-registered French business that records its retail customers’ payments in cash register software must use software that guarantees the inalterability, security, conservation and archiving of the data (article 286, I, 3° bis of the French tax code). It must be able to prove it during an inspection, or face a €7,500 fine per system (article 1770 duodecies, inspection procedure).

Since 21 February 2026: the publisher’s attestation is accepted again

The 2026 Finance Law (article 125) restored the option of proving compliance with an individual attestation from the software publisher, alongside a certificate from an accredited body. The tax administration set out the conditions in its guidance (BOI-TVA-DECLA-30-10-30, 25 March 2026) and published the official attestation model (BOI-LETTRE-000242). The attestation is personal: one part is signed by the publisher, the other completed and signed by the business.

Where RollingPOS stands

The RollingPOS individual attestation is being prepared and has not been issued yet. RollingPOS is not certified NF525 or by any other body. We will issue it only once the mechanisms below run in production and our file has been reviewed by a tax adviser. Each merchant will then receive it in their name, in their RollingPOS account, and this page will be updated.

What the software already does

  • Inalterability: every sale, cancellation, refund, cash movement and closing is written to a fiscal ledger that can only be appended to. A completed sale can no longer be changed or deleted, even directly in the database; corrections are new entries (cancellation, refund).
  • Security: each entry is chained to the previous one (SHA-256) and signed (Ed25519) with a key kept outside the database. A verifier detects any entry deleted, altered, reordered or backdated, and any mismatch between sales and the ledger. Each merchant’s data is isolated down to the database.
  • Conservation: automatic daily, monthly and yearly (or fiscal-year) closings, with the period total, the fiscal-year cumulative total and the perpetual total, never reset. Line-level sales data is kept for at least six years.
  • Archiving: a signed archive every month, in open formats (JSON and CSV), with an explanatory notice in French, verifiable without RollingPOS. Archives can be timestamped by a timestamping authority and copied to non-erasable European storage.
  • Versions: every version of the cash register module is identified and recorded in the ledger; any change to these mechanisms triggers a new assessment.

A dedicated automated test suite checks these mechanisms (tampering attempts, closings, archives, isolation between merchants), and its results are kept for each version.

Who is concerned?

  • VAT-registered businesses recording retail customer payments (cash, card, cheque…) in RollingPOS.
  • Businesses under the VAT franchise scheme or making only exempt sales are not concerned (article 286, II).
  • Orders placed on your online shops (Shopify, WooCommerce) or on Discogs are paid through those platforms: RollingPOS manages them for fulfilment and stock, but does not record them as till payments.

Your data

See our privacy policy and data processing agreement. Publisher: Mathieu Abeille Consultant. Questions about compliance? Write to mathieu.abeille@gmail.com.