In a perfect world, a "Valid" response from the VIES system would be enough. In the real world of EU tax audits, if you can't produce the proof three years later, that "Valid" status might as well not exist. With ViDA 2026 and 2030 reforms looming, tax authorities are moving toward a "show me the evidence" model.
1 The "Must-Have" List: What to Keep
To protect your business from VAT liability and fines, every cross-border B2B transaction should be linked to a specific validation record. Don't just store a "Yes/No" flag; store the raw data.
| Data Point | Why It Matters |
|---|---|
| VAT Number | The primary key for the transaction. |
| Timestamp | Proves you checked the status at the time of sale. |
| Validation Result | The official "Valid" or "Invalid" status. |
| Consultation Number | The unique ID provided by VIES for the specific check. |
| Technical Response | The raw XML/JSON data (for deep technical audits). |
| PDF Certificate | A human-readable proof for quick manual inspections. |
2 The 10-Year Rule
Under Article 63c of Council Implementing Regulation (EU) No 282/2011, businesses involved in schemes like the One-Stop Shop (OSS) must keep records for 10 years. Even for standard intra-community trade, many national laws require 6–10 years of record-keeping.
Pro Tip
Storage must be durable. A screenshot on a local laptop that might crash next month is not a compliance strategy. Use a secure, cloud-based vault.
3 Best Practices for Data Residency & GDPR
Since VAT numbers can be linked to sole traders or small partnerships, they often fall under GDPR protection.
Keep your tax data on servers within the EU (e.g. Germany) to ensure compliance with both tax and privacy laws.
Data should be encrypted both at rest and in transit.
You must be able to export or download certificates by VAT number, date, or order reference at a moment's notice.
How VIESAC Automates Your Audit Trail
Managing a decade of PDF certificates manually is impossible for a growing business. VIESAC does the heavy lifting for you:
- →Automatic PDF Generation: Every validation triggers the creation of a downloadable, time-stamped certificate.
- →10+ Years of Retention: We store your audit trail securely for the long haul, meeting the highest EU standards.
- →Developer-First API: Link your validations directly to your order IDs via our API for a seamless "Order → Validation → Invoice" connection.
- →WooCommerce Ready: Our plugin automatically stores the validation proof right inside your WordPress dashboard for every checkout.
Stop worrying about "what if" — Build a "here it is" archive
Pro Tip
EU VAT record keeping requirements: 10 years for OSS, 6–10 years in many Member States. How to download a VIES certificate for audit? Use a system that stores the consultation number and technical response. VIESAC keeps everything in the EU (Germany), GDPR-ready. API · WooCommerce. See also what to do when VIES is unavailable.