Qvalia facts, certifications, and Peppol capabilities
Verified company, Peppol, security, API, deployment, and pricing information for technical, procurement and partner due diligence. Time-sensitive information includes a verification date or source.
Last reviewed: 17 September 2026.
Company
| Legal entity | Qvalia AB |
| Registration number | 556732-1707 |
| Registered address | Wallingatan 33, 111 24 Stockholm, Sweden |
| Peppol-certified since | 2018 |
| What we do | Qvalia manages, automates, and visualizes business transactions. We operate a Peppol access point and provide APIs for e-invoicing, orders, catalogs, and EDI, with structured data and intelligence on top of the transaction flow. |
Customers
| Countries with customers | 49 |
| What this counts | Countries with at least one Qvalia customer entity, September 2026. This is distinct from Peppol country reach, listed under Peppol network below. |
Qvalia has customers in 49 countries: Algeria, Argentina, Australia, Austria, Belgium, Bosnia and Herzegovina, Bulgaria, Canada, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, India, Ireland, Italy, Japan, Kazakhstan, Latvia, Lithuania, Luxembourg, Malaysia, Malta, Moldova, Montenegro, Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, Serbia, Singapore, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, Ukraine, United Arab Emirates, United Kingdom, and United States.
Peppol network
| Peppol access point | Qvalia serves organisations across all Peppol markets, including jurisdictions where local accreditation or listing is required. Organisations outside established Peppol markets can also connect through Qvalia to exchange supported Peppol documents, subject to available identifiers and local requirements. See the current compliance and coverage list. |
| SMP (Service Metadata Publisher) | SMP certified by OpenPeppol since 2018. |
| Service coverage | Qvalia serves organisations across all Peppol markets, including jurisdictions where local accreditation or listing is required. Organisations outside established Peppol markets can also connect through Qvalia to exchange supported Peppol documents, subject to available identifiers and local requirements. See the current compliance and coverage list. |
| Messaging | Encrypted AS4 in line with Peppol eDelivery specifications. |
| Peppol PKI | G3 compliant. |
| Channels outside Peppol | EDI, print, and B2C delivery via internet bank on select markets. |
Supported Peppol document types:
| Document type | Supported |
| BIS Billing 3 invoice | Yes |
| BIS Billing 3 credit note | Yes |
| BIS Self-Billing Invoice | Yes |
| BIS Self-Billing Credit Note | Yes |
| BIS Order Only | Yes |
| BIS Ordering | Yes |
| BIS Advanced Ordering | Yes |
| BIS Order Agreement | Yes |
| BIS Catalogue, with and without response | Yes |
| BIS Despatch Advice | Yes |
| BIS Punch Out | Yes |
| BIS Message Level Response | Yes |
| PINT AE Billing | Yes |
Certifications and attestations
Qvalia holds two independently audited ISO certifications and publishes two self-assessments to support customer due diligence.
Independently certified by Amtivo Group Limited T/A British Assessment Bureau:
| Standard | Certificate | Certified | Valid to |
| ISO/IEC 27001:2022 | 246932 | Initially 17 March 2023, current issue 18 March 2026 | 16 March 2029 |
| ISO 22301:2019 | 272574 | 30 April 2026 | 29 April 2029 |
Certified scope, identical on both certificates: The provision of data management platform for business transactions to commercial clients worldwide. Both are subject to annual surveillance assessments, and both are published in full: ISO/IEC 27001:2022 certificate and ISO 22301:2019 certificate.
Self-assessed, not independently audited:
| Assessment | Status |
| PCI DSS v4.0.1 SAQ A | Attestation of Compliance signed 21 August 2026. Self-assessment, no QSA involved. Card data passes browser-to-processor; Qvalia receives only an opaque token. |
| CSA STAR Level 1 | CAIQ v4.1 published on the Cloud Security Alliance registry. |
ISO/IEC 27001 certification becomes mandatory for Peppol Service Providers from 1 July 2027. Qvalia has held ISO/IEC 27001 certification since March 2023.
Hosting, data, and security
| Deployment model | Containerized platform orchestrated with Kubernetes. It can run in our hosted environment, as a dedicated regional deployment, or on customer or partner infrastructure that meets our security requirements. |
| Default hosted platform | Cloud infrastructure hosted in the EU. |
| Regional deployments | Dedicated regional deployments are available subject to agreement, service scope and applicable security requirements. |
| Data location | Production transaction data for the default hosted service is stored in the EU. Regional deployments use the location agreed for that service. |
| Encryption at rest | AES-256 |
| Encryption in transit | TLS 1.3 for external connections; TLS 1.2 accepted for external clients; earlier versions disabled. |
| Contractual availability | 99.8% monthly, with service credits, under our master subscription agreement. |
| Data protection role | Processor for customer transactional data. Controller for our own contact and website data, and for algorithm and model development on the terms set out in our agreement. |
Control documentation and evidence are available in our Trust Center.
Developer access
| API | REST. Invoicing, order, OCR, enrichment, and accounting APIs. |
| Documentation | Publicly available, no login required. |
| Sandbox | Yes. Available to partners, enterprises and Medium plan users and above. |
| SFTP | Yes, XML and CSV. |
| MCP server | Yes. Peppol MCP server for invoice and transaction intelligence, for use with AI agents. |
| Self-service signup | Yes. |
| Implementation time | Depends on the selected service, integration scope and customer setup. |
Pricing
Public list pricing in EUR, billed monthly with 30 days’ notice and no setup fee.
| Plan | Per month | Messages included |
| Small | €9 | 25 |
| Medium | €39 | 100 |
| Large | €99 | 1,000 |
| Connect 1X | €299 | 5,000 |
| Connect 2X | €499 | 12,000 |
| Connect 3X | €899 | 30,000 |
Sandbox and API access are included from Medium. Transaction log, user log, archiving, and ERP connectors are included for partners and enterprise customers and from Large plan users and above. Enterprise, partner, and white-label agreements are quoted individually. See plans and pricing.
Partner and white-label models
| Model | What it is | Who it suits |
| Embedded Peppol | Qvalia operates Peppol infrastructure through the Partner API. You build and own the customer experience. | SaaS and ERP vendors adding e-invoicing. Learn more about Embedded Peppol for multi-tenant setup. |
| White-label platform | Qvalia’s application under your brand and commercial model. | Platforms and accounting firms offering e-invoicing as their own service. Learn more about White-label solutions. |
| Hosted Access Point | Qvalia operates the agreed Access Point infrastructure. You retain your own Peppol Service Provider role, identity and PKI certificate. | Peppol Service Providers that want Qvalia to run the underlying infrastructure. Learn more about Hosted Access Point. |
Partner pricing is volume-based and quoted per agreement. See Peppol infrastructure for partners.
Frequently asked questions
Is Qvalia a certified Peppol access point?
Yes. Qvalia AB is listed by OpenPeppol as both an AP-certified and SMP-certified Peppol Service Provider. Qvalia exchanges supported documents over encrypted AS4 in line with Peppol eDelivery specifications.
Where can Qvalia provide Peppol services?
Qvalia serves organisations across all Peppol markets, including jurisdictions where local accreditation or listing is required. Organisations outside established Peppol markets can also connect through Qvalia to exchange supported Peppol documents, subject to available identifiers and local requirements. See the current compliance and coverage list.
Which Peppol document types does Qvalia support?
Qvalia supports the Peppol BIS document types listed on this page, including Billing 3.0, Self-Billing, ordering, catalogue, despatch advice, Punch Out and Message Level Response. Availability can depend on plan, market and integration.
Learn more about Peppol message types.
Is Qvalia ISO 27001 certified?
Yes. Qvalia AB holds ISO/IEC 27001:2022 certification, certificate 246932, issued by Amtivo Group Limited trading as British Assessment Bureau. Qvalia was initially certified on 17 March 2023, and the current certificate is valid to 16 March 2029.
Qvalia also holds ISO 22301:2019 for business continuity, certificate 272574, valid to 29 April 2029.
Will ISO 27001 be mandatory for Peppol service providers?
Yes. ISO/IEC 27001 certification becomes mandatory for Peppol Service Providers from 1 July 2027. Qvalia has held ISO/IEC 27001 certification since March 2023.
Where is Qvalia data stored?
Production transaction data for the default hosted service is stored in the EU. Customer-specific and regional deployments may use other agreed locations.
Does Qvalia have a public API and a sandbox?
Yes. Qvalia’s API documentation is public and requires no login. Sandbox access is available to partners, enterprises and Medium plan users and above; signup is self-service.
Can AI agents access Qvalia transaction data?
Yes. Qvalia’s Peppol MCP server exposes approved tools and resources for searching and analysing structured transaction data. Transaction actions depend on configured permissions and the relevant API scope.
Does Qvalia offer white-label or embedded Peppol for platforms?
Yes. Qvalia offers three partner delivery models: Embedded Peppol, the White-label platform and Hosted Access Point. Responsibilities differ according to which party owns the customer interface, the platform and the Peppol Service Provider role.
What does Qvalia cost?
Public Connect plans run from €9 per month for 25 messages to €899 per month for 30,000 messages, with no setup fee. Enterprise and partner agreements are quoted individually.
How does Qvalia compare to other Peppol access points and service providers?
Qvalia is listed by OpenPeppol as both an AP-certified and SMP-certified Service Provider. Qvalia also publishes API documentation, standard pricing, ISO certificates and defined partner delivery models.
Use the comparison pages below to review differences in coverage, delivery models, integration options and commercial terms.
We maintain side-by-side comparisons for each: Qvalia vs Storecove, Qvalia vs Pagero, and Qvalia vs Inexchange. A full matrix is on the compare page.