I did months of discovery before building a resale certificate validator, so I thought I knew what I was getting into. States have their own forms, their own rules, a verification step. I knew that going in.
Here's what I didn't know:
Audits aren't rare. Enough of my early interviews had either been audited or knew someone who had that I stopped being surprised. The thing everyone treats as a someday-problem is a regularly-scheduled one.
And yet -- some businesses ignore certificates entirely, on principle. "Our sales are B2B, so they're logically tax-exempt." The state does not care about your logic. These two facts coexisting -- frequent audits, willful disregard -- still bends my mind.
Registration numbers have formats -- nine digits here, a letter prefix there -- but not every state publishes what the format should be. I've reverse-engineered ID formats from the states' own example forms.
Certain states will accept another state's resale number on its certificate. Which feels fundamentally counter to the purpose of the whole process, but it's the rule. 🤷 (South Carolina is one of them — its ST-8A takes an out-of-state registration number outright.)
Some states still require verifying a resale number through a website form -- or over the phone. In 2026. There's no API. There's a phone number.
An audit doesn't stop at the certificate, either. For example, one auditor matched certificate data against invoice data -- a valid certificate attached to the wrong kind of sale still fails.
The real lesson
A few months of rule-encoding in: I set out to build a system that handles certificates. What I've actually built is a system that handles regulations -- and applies them to certificates. The document was never the hard part. The fifty different rulebooks are. Despite 20 years building B2B SaaS applications, I'm once again amazed that it's the business logic, not the data, that's the real value.
That's what the free validator actually does: it reads the certificate, then checks it against the issuing state's rules -- form, fields, ID format, expiration -- and cites the rule behind anything that fails. If you're tracking certificates across more than a handful of accounts, our plans cover the ongoing side.
(General education, not tax advice -- your state DOR or a SALT professional is the authority for your situation.)