Digital filing in accordance with GoBD using open-source tools: What works, what does not

Using open-source tools such as Paperless-ngx and Nextcloud, it is possible to set up a digital filing system that complies with the GoBD requirements can – but not automatically. What matters is not the software alone, but the entire process: immutability, completeness, traceability, retention for the statutory periods, and a process documentation. There is no official “GoBD certification” for software; the company remains responsible.

Important note: This article provides a general overview and does not replace tax or legal advice. Please coordinate your procedure with your tax advisor.

What the GoBD require – in brief

The GoBD (“Principles for the proper keeping and retention of books, records and documents in electronic form and for data access”) are an administrative directive issued by the Federal Ministry of Finance. For filing tax-relevant documents, the following principles are particularly important:

• Completeness: All documents subject to retention are recorded.
• Immutability: Documents must not be altered or deleted unnoticed; changes must be traceable.
• Traceability: It must be clear who did what and when.
• Order and retrievability: Documents must remain readable and evaluable during the retention period, including for a tax audit.
• Procedure documentation: The procedure is described in such a way that an informed third party can understand it.

Retention periods: accounting records such as invoices since 2025 eight years, books and annual financial statements ten years, commercial and business letters six years – details in Digital archiving in the company.

What works well with open-source tools

• Complete capture: Input channels such as scanners, invoice inboxes and uploads can be centrally consolidated – see Capture invoices by email.
• Organization and search: Paperless-ngx makes documents searchable and organizes them by sender, type and keywords.
• Archive format: Paperless-ngx stores an archived PDF/A version alongside the original.
• Logs: Changes to documents and metadata can be logged.
• Data sovereignty: Operation in Germany, no provider that changes access or formats.

Where additional measures are necessary

• Immutability: The tools allow authorized users to edit or delete documents. For tax-relevant records, restrictive permissions are therefore required, as well as immutable storage – for example, storage that locks files against deletion and overwriting for a defined period (WORM principle), plus regular, protected backups.
• Deletion lock beyond the retention period:Deletion before the retention period expires must be prevented organizationally and technically.
• E-invoices:The structured original (XML) must be retained – not just a view.
• Tax authority data access:Documents must be able to be provided in a form suitable for analysis.
• Process documentation:Description of recording, scanning process, storage, rights, backups, and controls – mandatory, regardless of the software.

Substitute Scanning

Paper documents may generally be destroyed after scanning if the scanning is carried out according to a documented procedure and the digital version is properly retained. Exceptions apply to documents that must be kept in their original form under tax or non-tax regulations (GoBD, para. 140) – this includes, for example, opening balance sheets and annual financial statements; deeds such as notarized contracts are also better kept in the original. Which documents are affected in your case is clarified by your tax advisor. The scanning procedure itself must be described in the procedural documentation; the German Federal Chamber of Tax Advisors has published a sample procedural documentation for substitute scanning.

Certificates and Audit Reports

Some vendors advertise audit reports issued by auditors. Such reports can help with selection, but they have no binding effect on the tax authorities – what matters is how the system is used within the company. For open-source tools, such reports are generally not available; this makes your own procedural documentation all the more important.

Pragmatic approach for SMEs

1. Define tax-relevant document types and deadlines.
2. Bundle capture: invoice inbox, scanner, clear responsibilities.
3. Set permissions so that tax-relevant documents cannot be deleted or altered.
4. Set up immutable storage and protected data backup.
5. Write process documentation and coordinate it with the tax advisor.
6. Review regularly: Are all supporting documents fully captured? Do backups and restoration work?

bettersorted relies on open, transparent modules for its customers – operated on servers in Germany and bundled in the automaisa Hub. We provide manufacturer-neutral advice, are a BAFA-registered consultant and authorized INQA coach. Consulting and guided implementationcan be subsidized through INQA-Coaching at 80%; the Funding Check shows the right path. For an initial, non-binding consultation: Contact.

Example: Setting up a filing system for a small business

An illustrative scenario: A service provider with ten employees uses Paperless-ngx for incoming invoices and receipts. Tax-relevant documents are assigned a tag; only two people are allowed to edit them, and no one may delete them. Archived versions are additionally copied daily to storage with a deletion lock for the duration of the retention period. A two-page process documentation describes capture, permissions, backup, and control; the tax advisor has reviewed it. The scenario is illustrative and does not constitute a statement on compliance in any individual case.

What should be included in the process documentation

• General description: which documents, which systems
• Capture: input channels, scanning process, check for completeness
• Storage: formats, immutability, retention periods
• Rights: who is allowed to do what
• Data backup and recovery
• Internal controls and responsibilities

Costs and funding

For a GoBD-oriented filing system, there are no license costs for open-source tools. Costs arise for Setup (planning, installation, integration, testing), Operation (server or hosting in Germany, updates, monitoring, data backup) and Support (training, rules, contact person). We do not quote fixed prices because scope and starting conditions vary greatly.

Eligible for funding is the consulting and guided implementation: The INQA-Coaching covers 80% of coaching costs nationwide (up to €11,520, vouchers until 30.06.2028); a preliminary analysis is subsidized by the BAFA consulting grantwith 80% in the new federal states, Lüneburg and Trier, otherwise 50% – for applications submitted by 31.12.2026.

Frequently asked questions

Is Paperless-ngx GoBD-compliant?

No software is GoBD-compliant on its own. Paperless-ngx can be part of a proper procedure if immutable storage, restrictive permissions, logs, data backup, and procedural documentation are added.

Is there a GoBD certification for software?

No, there is no official certification. Audit opinions from auditors can help with selection, but they are not binding on the tax authorities.

Do I need process documentation?

Yes. The GoBD require a description of the process, regardless of which software you use. It should cover capture, storage, access rights, backups, and controls.

How long do invoices have to be retained?

Since 1 January 2025, eight years, because invoices are considered accounting records. Books and annual financial statements for ten years, business letters for six years.

As of October 2026. No tax or legal advice; the current GoBD and coordination with your tax advisor are authoritative.