Security & operations

GoBD-compliant documents and audit-proof archiving

The German GoBD rules demand three things: documents must not change after the fact, every change must be traceable, and nothing may get lost. Easy Invoices builds all three into the process instead of leaving them to you as a chore.

  • Documents are immutable once issued – corrections only via cancellation and credit note
  • Every audit-log entry carries a SHA-256 seal that is verified on every read
  • Servers in Germany, ISO 27001-certified data centres, data processing agreement in the app

Immutability and traceability

What has been issued stays as it is. What changes produces a new document referencing the old one.

  • Tax treatment, addresses and amounts are frozen on the document; a later settings change only affects new documents
  • Calculation log per document: which tax line led to which amount
  • Who created which document manually or resolved which item, and when, is logged
  • Integrity seal per log row – a tampered row stands out on export

Storage and data protection

Invoice data is customer data. It sits encrypted in Germany, and you always have a complete export.

  • PDFs encrypted with a shop-specific key; SMTP credentials with AES-256-GCM
  • Hosted at Hetzner in Germany; the data centres are ISO 27001-certified
  • Data processing agreement (DPA) right in the onboarding, transport exclusively via TLS
  • PDF archive and Z3 – plus CSV and DATEV in the closed beta: every export is also your backup

In all honesty

  • Easy Invoices archives your documents GoBD-compliant and audit-proof for 10 years – longer than the eight years § 147 AO has required for invoices since 2025 – for as long as your subscription is active. The retention duty itself lies with you as the issuer by law, so we recommend keeping exported documents in your own storage as well. The yearly scheduled export does exactly that automatically. After cancellation you keep a 3-month window for a complete export via support.
  • ISO 27001 is the data centres’ certification, not the app’s.

Software, not tax advice: We are not tax advisers: Easy Invoices applies the rules you configure to your shop’s data – checking your documents for tax correctness stays with you and your accounting firm. Details in § 2a of the terms

Retention: what we do, what stays with you: Easy Invoices keeps your documents immutable for 10 years while your subscription runs – longer than the 8 years § 147 AO has required for invoices since 2025. The duty itself is yours as the issuer: after cancellation you have 3 months to export, and the yearly scheduled export does that for you. Details on data retention

Frequently asked questions

Can I edit an invoice after the fact?

No – and that is the point. An issued invoice is cancelled and reissued, or corrected by credit note. Both documents are kept, as GoBD and § 14 UStG require.

What happens to my data after cancellation?

You have 3 months to export all documents via support. After that the data is deleted. Details are on the data retention page.

Related capabilities

PDF archive & Z3 export Password-protected PDF archive to your accountant every month, Z3 data carrier for audits. Automatic invoices Invoice, cancellation and credit note on every paid order – no clicks. Error handling & open items No document with a guessed tax rate: the app asks, you click, done.

Try it on your next order

14 days free, billed through Shopify, set up in 10 minutes.

Install on Shopify