GoBD-Compliant Archiving for Small Businesses

Invoices, receipts, contracts, bank statements: whatever is tax-relevant in Germany must be kept for eight or ten years so that the tax office can check it at any time. Unaltered, complete and traceable. That’s what Germans call audit-proof archiving (revisionssichere Archivierung), and it’s at the heart of the GoBD.

This page explains what audit-proof means, what the GoBD require, how Papermerge implements each requirement technically, and which part stays with you.

What does audit-proof mean?

The term isn’t in any law. It has become the common name for an archive that stands up to an audit. Five properties belong to it:

Property	What it means
Completeness	Every document that must be kept is in the archive; none gets lost.
Immutability	An archived document can’t be changed or deleted unnoticed.
Traceability	Every change, access and deletion is logged: who, what, when.
Order	Documents are filed so a third party can find them within a reasonable time.
Availability	Documents stay readable and evaluable for the whole retention period.

A folder on a network drive or in cloud storage misses most of these: files can be overwritten, renamed and deleted without anyone noticing.

What the GoBD require

The GoBD are a circular of the German Federal Ministry of Finance on how companies keep and store digital records. For an archive these points matter most:

• Documents received electronically must be kept electronically. A printout of a PDF invoice isn’t enough.
• Immutability: changes must be logged so the original content stays visible.
• Retention periods: eight years for accounting vouchers such as invoices, ten for books and financial statements, six for business letters.
• Data access: tax auditors may access the data directly in the system (Z1), through evaluations you run for them (Z2), or through a data export (Z3).
• Procedural documentation: you describe how documents are captured, archived and found in your company.

A broader introduction is in What is GoBD?, the individual periods in Retention periods in Germany.

How Papermerge supports GoBD-compliant archiving

Unalterable versions instead of overwriting

Every document has versions. A version starts as a draft and becomes archived once it enters your bookkeeping. Nobody can change an archived version, not even an admin: the database itself prevents it. Corrections create a new version, and the old one stays visible. Every version is also protected with a SHA-256 checksum, so you can show the file is unchanged. More: Document versioning.

A complete audit log

Papermerge logs uploads, changes to metadata, categories and tags, state transitions, deletions and permission changes, each with time and user. Every document has its own history; admins also see the workspace-wide log, filterable by action, user and period. More: Audit log.

Retention periods per category

For each category you set how long its documents are kept, for example eight years for incoming invoices. The period counts from the upload or from a date field, such as the invoice date. Before it ends, nobody can delete an archived document. More: Retention rules.

Deletion only with four-eyes approval

When a period has expired, Papermerge deletes nothing on its own. Expired documents go to a list of deletion requests; only a person or group you set per category approves or rejects the deletion. Both are recorded in the audit log.

Data access in a tax audit

• Z1, direct access: invite the auditor with the auditor role and give read access to exactly the cabinets they may see. The auditor can’t change anything, but can view and download documents and see the audit log.
• Z2, indirect access: you filter for the auditor by category, metadata such as supplier, date or amount, and tags, and hand over the results.
• Z3, data export: you download the requested documents and hand them over. A full workspace export from within the app is in the works.

Roles and cabinets

Documents live in cabinets, such as Accounting or HR. Groups and roles control who may see or edit which cabinet. Accounting sees the invoices but not the personnel files, and your internal controls are easy to show.

Machine evaluability

The GoBD require tax-relevant data to be machine-evaluable. In Papermerge every category has its own metadata fields: invoice number, supplier, date, amount. They can be filtered and sorted. Important for scanned paper: Papermerge doesn’t read text from images (no OCR). Metadata is entered when the document is filed.

Hosted in Frankfurt

Papermerge runs in a data centre in Frankfurt am Main. No server of your own, no updates to install, no archive system to run.

Archiving invoices and receipts: how it works

1. Capture. Upload documents, or forward invoices to the email address of your cabinet. The email and every attachment are kept as originals.
2. Choose the category. That’s the only decision you make. The category sets the metadata fields, retention period and storage location.
3. Enter the metadata. Supplier, invoice date, amount: whatever you or the auditor will search for later.
4. Papermerge files it. Automatic filing moves the document into the right folder of the right cabinet.
5. Archive. From now on the version can’t be changed and is protected from deletion until the end of its retention period.

What stays with your company

To be honest: no software makes a company GoBD-compliant on its own. These points are yours:

• Procedural documentation: describe how documents arrive, who files them and how they’re archived. An outline to copy is in GoBD procedural documentation.
• Completeness: all tax-relevant documents must actually reach the archive, including those arriving by post or in personal mailboxes.
• Prompt capture: file documents promptly, not at year end.
• Paper documents: if you want to destroy originals after scanning, you need a documented scanning process. See Replacement scanning.

Papermerge makes sure the technology is right. You describe the processes around it once, and then they run the same way every day.

Try it

Papermerge costs from €39 a month for up to 3 users, with no setup fee and monthly cancellation. All prices are on the pricing page. Try it free for 14 days, with every feature.