GoBD Compliance
This page explains how Papermerge helps you meet the requirements of the GoBD.
What is GoBD?
Section titled “What is GoBD?”GoBD (Grundsätze zur ordnungsmäßigen Führung und Aufbewahrung von Büchern, Aufzeichnungen und Unterlagen in elektronischer Form sowie zum Datenzugriff) is the German regulation that defines how businesses must manage, store, and archive electronic documents and records for tax purposes. If you operate a business in Germany, your document management system must comply with these principles. Non-compliance can result in your bookkeeping being rejected by tax authorities during an audit.
GoBD Requirements
Section titled “GoBD Requirements”Retention of Electronically Received Documents
Section titled “Retention of Electronically Received Documents”Documents that you receive must be retained electronically. A paper printout alone is not sufficient.
Papermerge is designed to store documents in their original electronic format. When you upload a PDF invoice received by email, it remains stored as a PDF. The original file is preserved alongside any subsequent versions.
Immutability of Archived Documents
Section titled “Immutability of Archived Documents”Once a document enters your bookkeeping chain, it cannot be suppressed, overwritten without notice, deleted, or falsified. Any changes must be logged so that both the original content and the fact that a change occurred remain visible.
Papermerge tracks each document modification as a separate document version.
A version starts as draft, becomes archived once it enters the bookkeeping
chain, and can no longer be modified after that.
When you need to correct an archived document, superseding it immediately
creates a new draft version and marks the previous one as superseded — it
is never deleted or overwritten. The complete version history is always
accessible, and every change is recorded with the date and the user who made
it.
See Document Lifecycle for what each state means, and Document Versioning for how this supports compliance.
Unique Document ID
Section titled “Unique Document ID”According to GoBD requirements, every document must have a unique, persistent identifier that is never reused. The link between a document’s ID and its index data must be maintained for the entire retention period.
Every document in Papermerge receives a UUID (Universally Unique Identifier) upon creation. This ID is permanent — it is never reassigned, even after a document is deleted. UUIDs are randomly generated and cannot be guessed or fabricated. The connection between the Document ID and all associated metadata is maintained at the database level throughout the document’s lifecycle.
A Document ID looks like this:
d2ab50ed-0376-4a3e-a1a0-fb6ac7e05c54
Audit Logs
Section titled “Audit Logs”According to GoBD, every creation, modification, deletion, permission change, and administrative action must be logged with a timestamp and user ID. Earlier states must remain fully traceable.
Papermerge maintains an audit log that records the following actions:
- Document uploads and imports
- Document deletions
- Version changes and state transitions
- Metadata modifications
- Tag changes
- Document category changes
- Permission changes
- Administrative actions
Each log entry includes the exact timestamp and the user who performed the action, allowing you to reconstruct the history of any document.
Read more in Audit Logs.
No Deletion Before End of Retention Period
Section titled “No Deletion Before End of Retention Period”Documents may not be deleted before their retention period has elapsed. There must be no automated deletion, and any deletion requires explicit organisational approval.
In Papermerge, a user can delete only documents in the draft state. Once a
document transitions to the archived state, the user cannot delete the
document until the retention period associated with it has expired. When the
retention period has expired, another authorized user must confirm the
deletion. Only after confirmation — and retention period expiration — will the
document be permanently deleted from the system.
Machine Evaluability
Section titled “Machine Evaluability”Tax-relevant documents and data must be machine-evaluable, meaning software can process them — not just display them for human reading. Specifically, documents must be:
- Machine-readable — content can be read by software
- Filterable and selectable — you can query by date, supplier, amount, etc.
- Sortable — you can sort by any index field
- Full-text searchable — you can search across document content
- Mathematically analysable — you can sum totals, calculate VAT, aggregate amounts
Papermerge provides Document categories with custom fields that allow you to capture structured metadata for every document. Even if you upload a scanned image without a text layer, you can fill in custom fields such as:
- Invoice number
- Invoice date
- Supplier name
- Total amount
- VAT amount
This structured metadata is fully machine-evaluable — it can be filtered, sorted, summed, and exported. The tax authority can analyse this metadata and view the original image to verify the data.
Role-Based Access Control (IKS)
Section titled “Role-Based Access Control (IKS)”Papermerge provides a comprehensive permission system:
- User roles and groups — assign users to groups with specific permissions
- Folder-level permissions — control who can view, edit, or delete documents in each folder
- Document-level permissions — fine-grained access control for individual documents
- Search respects permissions — users only see documents they are authorised to access
Auditor Read-Only Access (Z1/Z2/Z3)
Section titled “Auditor Read-Only Access (Z1/Z2/Z3)”Tax authorities must be able to access all tax-relevant documents through three defined access methods:
| Access Type | Description |
|---|---|
| Z1 | Direct read-only access to the live system |
| Z2 | You run queries on behalf of the auditor according to their specifications |
| Z3 | Full data export including all metadata and structural information |
In Papermerge you can create a dedicated auditor user account with read-only permissions. This account can:
- Browse and view all tax-relevant documents
- Search across the document archive
- Export documents and metadata as needed
The system remains stable during audit access — read-only users cannot modify any data.
Final Document Version / Archive Status
Section titled “Final Document Version / Archive Status”There must be a clear distinction between working versions (drafts) and the final archived version. The archive status must be unambiguously defined.
In Papermerge, this is exactly the draft / archived distinction described
above — see Document Lifecycle for the complete set of
states.
System Migration Must Preserve Machine Evaluability
Section titled “System Migration Must Preserve Machine Evaluability”When you migrate to a new system, all data must transfer completely and equivalently. Only format changes are allowed — no content changes. The new system must support the same level of machine analysis.
Papermerge stores documents in standard formats (PDF, images) and maintains all metadata in a structured database. If you ever need to migrate to another system, all documents and their associated metadata can be exported.
Converting Structured Data to Non-Structured Formats is Forbidden
Section titled “Converting Structured Data to Non-Structured Formats is Forbidden”You may not convert structured data (such as XML, CSV, or ZUGFeRD documents) to image-only formats (such as TIFF or image-only PDF) if this reduces machine evaluability.
Papermerge preserves documents in their original format. When you upload a ZUGFeRD PDF or an XML file, it remains stored in that format. The system does not automatically convert structured documents to image formats.