Laravel development for Madrid companies

Madrid is two hours behind us and the Spanish working day runs later, so the overlap is wider than the clock suggests - our afternoon sits inside your day rather than at the end of it.

The buyers here are corporates, utilities and companies that sell into the public sector. What arrives is usually an application that already exists and has to keep working while it changes.

Madrid invoicing is a regulated function

This is the Spanish specific that reaches the schema, and it surprises teams who have treated invoicing as a reporting feature.

Where invoicing software carries certification requirements, the document stops being something you can regenerate. Three consequences follow, and all three are schema decisions.

Invoices become immutable once issued. A correction is a new document that references the original, not an edit to it. An application whose invoice row is updated in place cannot express that, and retrofitting it means deciding what the historical rows meant.

Sequence integrity matters. Numbering has to be allocated in a way that does not leave gaps nobody can account for, which rules out allocating a number optimistically and discarding it when something fails. That is a locking question and a transaction-boundary question, not a formatting one.

And the records have to be producible later in a form that still makes sense. That is retention with teeth: knowing where every copy lives, and knowing that the figures stored are the figures that applied rather than ones recomputed from today's configuration. Which is one of the decisions that cannot be undone once there are rows.

One country, more than one set of rules in Laravel

A second thing that catches applications designed for a single national configuration: parts of Spain operate their own regimes alongside the national one.

The engineering consequence is narrow and specific. Whatever determines which rules apply has to be a property of the transaction - recorded at the time, with the record - rather than a setting on the application. A configuration file that says how Spain works is a model with one jurisdiction in it, and the first customer in a region that differs is the bug report.

Selling to the public sector in Madrid changes the schedule

For companies selling into public bodies, the procurement process sits ahead of the engineering, and it is where the dates slip.

So the first week establishes which approvals have the longest lead time - supplier registration, security review, access provisioning - and the phases are ordered so that a blocked dependency stops one phase rather than the whole project.

A Madrid corporate security review arrives before the contract

With a corporate buyer the security questionnaire precedes the work, and it is answered by artefacts rather than by assurances.

The questions repeat across buyers, which is the useful part. Where does the data rest and in which jurisdiction. Who are the sub-processors and what does each do. How is access granted and removed. How are changes reviewed and released. What happens to the data at the end. What is the incident notification commitment. Each has a true answer that takes a paragraph, and having those paragraphs written before the first questionnaire arrives turns a two-week exchange into a day.

The answers have to match the application, which is the part that catches suppliers out. A questionnaire that claims access is reviewed quarterly, against a system with no record of who has access, is a statement that will not survive a follow-up question. So the review tends to produce a short list of things worth building - an access list that can be exported, a deployment record, a log that shows who read what - and all three are cheap when built deliberately and expensive when retrofitted under a deadline.

A penetration test is frequently part of it, commissioned by the buyer or required of the supplier. Scheduling it late is the common error, because the findings take time to remediate and retest, and a contract waiting on a retest is a contract waiting.

Laravel single sign-on against a Madrid corporate directory

In a company of any size, nobody wants another set of credentials, and the security team will not accept one. Single sign-on is therefore a requirement rather than a feature, and it is the requirement most often left until the pilot is nearly over.

Leaving it late is expensive because it changes the identity model rather than adding to it. Users arrive from the directory, so they are not created in the application, and a user record whose email address can be edited by an administrator is wrong once the directory owns that field. What belongs to the application is what the directory does not know - a role within the product, a preference, a scope - and the boundary between the two has to be drawn deliberately.

Group mapping is where the detail lives. The directory has groups that mean something organisationally and the application has roles that mean something functionally, and mapping one to the other is a decision the client's administrators should be able to change without a release. Hard-coding the mapping produces a ticket every time a department reorganises.

Deprovisioning is the half that justifies the whole arrangement. Somebody leaves, their directory account is disabled, and the expectation is that their access to the application ends - which happens only if the application checks on each session rather than trusting a user record created at first login. And a break-glass account exists for the case where the directory itself is unavailable, with its use logged and visible, because the alternative is discovering during an outage that nobody can get in.

Commercially

The invoice comes from Codefacture Yazılım A.Ş., registered in Türkiye, in euros by bank transfer, with no Turkish VAT under the export-of-services exemption. Scope is fixed in writing before work starts and priced per project.

The country-level ground - the certification regime itself, immediate reporting, the regional layer - is on the Spain market page.