Digital filing in accordance with GoBD using open-source tools: What works, what does not

Using open-source tools such as Paperless-ngx and Nextcloud, it is possible to set up a digital filing system that meets the requirements of the GoBD can – but not automatically. What matters is not the software alone, but the entire process: immutability, completeness, traceability, retention for the statutory periods, and a process documentation. There is no official “GoBD certification” for software; the company remains responsible.

Important notice: This article provides a general overview and does not replace tax or legal advice. Coordinate your procedure with your tax advisor.

What the GoBD require – in brief

The GoBD (“Principles for the proper keeping and retention of books, records and documents in electronic form and for data access”) are an administrative directive issued by the Federal Ministry of Finance. For filing tax-relevant documents, the following principles are particularly important:

• Completeness: All documents subject to retention are recorded.
• Immutability: Documents must not be changed or deleted unnoticed; changes must be traceable.
• Traceability: It must be clear who did what and when.
• Order and retrievability: Documents must remain readable and analyzable during the retention period, including for a tax audit.
• Procedure documentation: The procedure is described in such a way that an informed third party can understand it.

Retention periods: accounting records such as invoices since 2025 eight years, books and annual financial statements ten years, commercial and business correspondence six years – details in Digital archiving in the company.

What works well with open-source tools

• Complete capture: Input channels such as scanners, invoice inboxes and uploads can be centrally consolidated – see Capture invoices by email.
• Organization and search: Paperless-ngx makes documents searchable and organizes them by sender, type and keywords.
• Archive format: Paperless-ngx stores an archived PDF/A version alongside the original.
• Logs: Changes to documents and metadata can be logged.
• Data sovereignty: Operation in Germany, no provider that changes access or formats.

Where additional measures are necessary

• Immutability: The tools allow authorized users to edit or delete documents. For tax-relevant records, therefore, restrictive permissions and immutable storage are required – for example, storage that locks files against deletion and overwriting for a defined period (WORM principle), plus regular, protected backups.
• Deletion lock beyond the retention period:Deletion before the retention period expires must be prevented organizationally and technically.
• E-invoices:The structured original (XML) must be retained – not just a view.
• Tax authorities’ data access:Documents must be able to be provided in a form that can be evaluated.
• Process documentation:Description of capture, scanning process, storage, access rights, backups, and controls – mandatory, regardless of the software.

Substitutive Scanning

Paper documents may generally be destroyed after scanning if the scanning is carried out according to a documented procedure and the digital version is properly retained. Exceptions apply to certain documents. TODO: review – coordinate specific exceptions and requirements for the scanning procedure with the tax advisor.

Certificates and Attestations

Some vendors advertise audit certificates from certified public accountants. Such attestations can help with selection, but they are not binding on the tax authorities – what matters is how the system is used within the company. For open-source tools, such attestations are generally not available; this makes the company’s own procedural documentation all the more important.

Pragmatic Approach for SMEs

1. Define tax-relevant document types and deadlines.
2. Bundle capture: invoice inbox, scanner, clear responsibility.
3. Set permissions so that tax-relevant documents cannot be deleted or altered.
4. Set up immutable storage and protected data backup.
5. Write process documentation and coordinate it with the tax advisor.
6. Review regularly: Are all receipts fully captured? Do backups and restoration work?

bettersorted relies for its customers on open, transparent modules – operated on servers in Germany and bundled in the automaisa Hub. We provide manufacturer-neutral advice, are a BAFA-registered consultant and an authorized INQA coach. Consulting and guided implementationcan be subsidized through INQA-Coaching at 80%; the Funding Check shows the right path. For a non-binding initial consultation: Contact.

Example: Setting up a filing system for a small business

An illustrative scenario: A service provider with ten employees uses Paperless-ngx for incoming receipts. Tax-relevant documents are assigned a tag; only two people are allowed to edit them, and no one may delete them. Archived versions are additionally copied daily to storage with a deletion lock for the duration of the retention period. A two-page procedural documentation describes capture, permissions, backup, and control; the tax advisor has reviewed it. The scenario is illustrative and does not constitute a statement on compliance in any individual case.

What belongs in the procedural documentation

• General description: which documents, which systems
• Capture: input channels, scanning process, completeness check
• Storage: formats, immutability, retention periods
• Rights: who may do what
• Data backup and recovery
• Internal controls and responsibilities

Costs and funding

For a GoBD-oriented filing system, there are no license costs for open-source tools. Costs arise for Setup (planning, installation, integration, testing), Operation (server or hosting in Germany, updates, monitoring, data backup) and Support (training, rules, contact person). We do not quote fixed prices because scope and starting conditions vary greatly.

Eligible for funding is the consulting and guided implementation: The INQA-Coaching covers 80% of coaching costs nationwide (up to €11,520, vouchers until 30.06.2028); a preliminary analysis is subsidized by the BAFA consulting grantwith 80% in the new federal states, Lüneburg and Trier, otherwise 50% – for applications submitted by 31.12.2026.

Frequently asked questions

Is Paperless-ngx GoBD-compliant?

No software is GoBD-compliant on its own. Paperless-ngx can be part of a proper procedure if immutable storage, restrictive permissions, logs, data backup, and procedural documentation are added.

Is there a GoBD certification for software?

No, there is no official certification. Auditors’ certificates can help with selection, but they are not binding on the tax authorities.

Do I need process documentation?

Yes. The GoBD require a description of the process, regardless of which software you use. It should cover capture, storage, access rights, backups, and controls.

How long do invoices have to be retained?

Since January 1, 2025, eight years, because invoices are considered accounting records. Books and annual financial statements for ten years, business letters for six years.

As of October 2026. No tax or legal advice; the current GoBD and coordination with your tax advisor are authoritative.