GoBD-Compliant Archiving & Z3 Export for German Tax Audits

GoBD-compliant archiving means keeping every tax-relevant document tamper-proof, complete, and traceable, and retaining it for the statutory period — usually ten years. When a tax audit (Betriebsprüfung) happens, the tax office must be able to reach that data via Z1, Z2, or Z3 access. Prepare for this once, and you stay ready to answer at any time.

For Shopify merchants this is more than paperwork. Invoices, credit notes, and accounting records are born digital and must be archived digitally, in their original format. Printing a PDF and filing it away is explicitly not enough. This guide explains the core GoBD requirements, what audit-proof archiving actually means, and how to prepare for the dreaded Z3 export.

What are the GoBD?

The GoBD are Germany's "Principles for the Proper Management and Retention of Books, Records and Documents in Electronic Form and for Data Access." Issued by the Federal Ministry of Finance, they define how tax-relevant data must be captured, processed, and retained electronically.

They apply to everyone who keeps books or maintains records for tax purposes — from sole traders to large companies. The moment you process orders and generate invoices in Shopify, you fall within their scope.

The three foundational principles

Three principles form the bedrock of any GoBD-compliant archive.

1. Immutability

Once a document has been recorded, it must not be silently changed or deleted. Corrections are allowed, but they must be logged so the original content remains recognizable at all times. In practice: an issued invoice is never overwritten — a correction is made via a cancellation invoice or a corrected follow-up invoice with its own gap-free number.

2. Traceability and verifiability

An expert third party — the auditor — must be able to gain an overview of your business transactions within a reasonable time. This requires so-called process documentation (Verfahrensdokumentation): a written description of how documents are created, processed, and stored. From the Shopify order through invoice generation to storage, every document's path must be documented.

3. Completeness, accuracy, and timeliness

All business transactions must be recorded without gaps — no missing invoice numbers, no "vanished" orders. Documents must be booked promptly and assigned to the correct period. A continuous, gap-free invoice numbering scheme is your single most important piece of evidence here.

Retention periods: how long, for what?

Retention periods depend on the document type:

• 10 years: invoices, accounting records, annual financial statements, inventories, balance sheets, and all books/records.
• 6 years: received and sent commercial and business correspondence, plus other tax-relevant documents.

The clock starts at the end of the calendar year in which the document was created. An invoice issued in 2026 must therefore be retained until the end of 2036. Note: if an audit or an appeal is still ongoing when the period would end, the retention obligation is extended accordingly.

What does audit-proof archiving mean?

"Audit-proof" (revisionssicher) is not a single product feature but the interplay of technology and organization that fulfills the GoBD principles in practice. An audit-proof archive ensures that documents are:

• stored immutably (e.g. write-once storage, versioning, hash values),
• filed completely and in an orderly way,
• findable at all times and machine-analyzable,
• protected against loss (backups, redundant storage),
• backed by process documentation.

A plain cloud folder is not enough if files can be overwritten at any time. What matters is that tampering is either technically prevented or logged without gaps.

Z1, Z2, Z3: the three types of audit data access

During a tax audit, the tax office has a right to data access — in three possible forms. The auditor decides which one to use.

Z1 – Direct access

The auditor inspects the data directly in your system, in read-only mode, navigating the accounting or invoicing software themselves. You provide read access and a brief introduction to the system.

Z2 – Indirect access

You (or your tax advisor) evaluate the data according to the auditor's specifications and hand over the results. The auditor defines the analysis; you operate the system.

Z3 – Data carrier handover

The auditor requests the tax-relevant data as a machine-analyzable export — classically on a data carrier, today usually as a file. This export must be in a structured, analyzable format that the tax authority's audit software (IDEA) can read: typically a GDPdU/GoBD data export made of CSV files plus a description file (index.xml / INDEX.XML with gdpdu-01-08-2002.dtd).

Z3 is the most common request in practice — and the one most likely to break down if your data exists only as a pile of PDFs. PDFs are not machine-analyzable in the IDEA sense. What's needed is structured transaction data: document number, date, amount, tax rate, tax amount, customer, and so on — row by row.

The classic pitfall for Shopify merchants

Shopify is an excellent shop system, but it is not a GoBD archive. You can export order data, yet:

• invoices in the legally required format are not generated automatically,
• immutability and gap-free numbering are not guaranteed,
• an IDEA-readable Z3 export is not provided,
• you must supply process documentation yourself in any case.

By the time the audit notice lands in your mailbox, improvised PDF-gathering becomes a real risk. Missing invoice numbers, retroactively altered documents, or a non-analyzable export can trigger objections — up to and including an estimated assessment.

How to stay audit-ready with Easy Invoices

Easy Invoices is built for exactly this problem: GoBD-compliant, GDPR-compliant invoicing with audit-proof (revisionssicher) archiving straight out of Shopify. Concretely, that means:

• Automatic, gap-free invoice numbers — every paid order (including advance payment / Vorkasse) gets a sequential document with no gaps, plus a separate credit-note sequence.
• Traceable corrections: issued invoices are never overwritten; corrections go through automatic cancellation invoices (Storno) and credit notes (Gutschrift) on cancellation or refund, each with its own number.
• Audit-proof (revisionssicher) archiving of your invoice PDFs in their original format — stored GoBD-compliant and retained for 10 years.
• Document export as a PDF ZIP (all invoices & credit notes for a period, organized by year/month, plus a manifest) — emailed as a download link to your accountant. A structured DATEV/CSV export for machine-analyzable Z3 access is in development.

This shifts your preparation from "scramble in an emergency" to "answer at the push of a button, anytime."

Your tax-audit checklist

1. Ensure gap-free invoice numbering — and document how numbers are assigned.
2. Archive all documents in their original format immutably for 10 years.
3. Create process documentation: how do your documents get created, processed, and stored?
4. Test the Z3 export before the auditor arrives — is the data structured and analyzable?
5. Clarify access rights: who can set up read access for Z1?
6. Verify backups of your archived data regularly.

Conclusion

GoBD-compliant archiving isn't optional — it's mandatory, and entirely manageable with the right preparation. Take immutability, traceability, and retention seriously, rehearse the Z3 export in advance, and you can face a tax audit calmly. For Shopify merchants, a solution like Easy Invoices helps close the gap between the shop system and audit-ready bookkeeping — with GoBD-compliant, audit-proof (revisionssicher) archiving, gap-free numbering, and traceable corrections.

Tip: Don't wait for the audit notice. A properly set up archiving and export process saves days of rework when it counts — and protects you from costly objections.