Overview

The GoBD require that tax-relevant documents remain unalterable, traceable and available throughout the statutory retention period. Kyvento enforces these requirements technically – you don't need to configure anything for it. This article explains the protective mechanisms so that you can put them into context for auditors and your tax advisor.

Immutability of finalized invoices

Finalization freezes an invoice: from that moment on, the invoice number, amounts, invoice date and the e-invoice data are write-protected – the lock applies both in the application and directly at the database level. Reverting to draft status is also ruled out.

You therefore never correct content errors on the original: for finalized documents, Kyvento knows only the cancellation – a standalone document with negative amounts, its own number and a reference to the original. Only unfinished drafts can be deleted; they don't yet carry an invoice number, so no gaps arise.

Integrity protection via checksum

For every finalized invoice, Kyvento calculates SHA-256 checksums and stores them with the document:

• over the invoice PDF – any subsequent tampering with the file would be immediately detectable,
• over the invoice's financial data (amounts, line items) as a frozen snapshot,
• over the generated e-invoice file (XML).

In addition, Kyvento checks the number ranges for gaplessness per year – details in the article "Invoice numbers: gapless and sequential".

Retention: 10 years

Invoice and dunning documents are subject to the statutory retention period of 10 years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)). Kyvento records the retention end date for each document and protects it from any deletion until then.

GoBD and GDPR: no contradiction

If a customer requests the deletion of their data, this seemingly collides with the retention obligation. Kyvento resolves the conflict cleanly: during a GDPR anonymization, the personal customer data is rendered unrecognizable – but finalized invoices and their PDFs are fully retained within the retention period. Even when deleting entire data sets, GoBD-protected documents remain untouched until the end of the retention period.

What this means in practice

1. Only finalize invoices once their content has been checked – after that, only the cancellation route is possible.
2. Handle corrections consistently via cancellation documents – see "Credit notes and cancellations".
3. Describe the protective mechanisms in your procedural documentation (Verfahrensdokumentation) – see "Creating a procedural documentation".

Next steps

• Number assignment in detail – see "Invoice numbers: gapless and sequential"
• Retain terminated contracts in an orderly way – see "Archiving cancelled subscriptions"
• Meet your own documentation obligation – see "Creating a procedural documentation"