Substitute Scanning with BSI TR-RESISCAN — legally compliant with Docuflair.

TR-RESISCAN is a Technical Guideline from the German Federal Office for Information Security (BSI). It defines requirements for legally compliant substitute scanning, where paper documents are digitised and the originals can subsequently be destroyed while maintaining full legal evidential value.

TR-RESISCAN is particularly relevant for government agencies, public institutions, companies with high compliance requirements, and all organisations that wish to legally destroy paper documents after scanning while retaining full evidential value.

The transfer note documents the scanning process and confirms the correspondence between original and digital copy. It contains information such as scan date, scan operator, settings used and verification results - essential for the evidential value of the digital document.

Visual inspection is an essential part of the TR-RESISCAN process. After scanning, the digital document is compared with the original on screen. The inspector confirms completeness and legibility - this is documented in the transfer note.

For TR-RESISCAN-compliant scanning, you need a suitable scanner, the Docuflair TR-RESISCAN software, and optionally a screen for visual inspection at the device. The software guides you through the entire process and ensures compliance with all requirements.

Yes, when the TR-RESISCAN process is carried out correctly, the original document can subsequently be destroyed. The digital document with transfer note then has the same evidential value as the original.

The system stores all documents in PDF/A format, an ISO standard for long-term archiving. Additionally, it digitally signs and tags them with metadata. This ensures that documents remain readable and verifiable for many years to come.

Implementation is very quick: by installing a single piece of software, legally compliant scanning according to TR-RESISCAN is available to you within minutes. Integration with existing systems is seamless through standardised interfaces.

The base module contains the minimum requirements for all protection categories - from user authentication to the transfer note. The extension modules (Integrity and Confidentiality) apply when there is increased protection need and define additional measures such as digital signatures, encryption and extended access controls.

A process documentation (Verfahrensdokumentation, VDU) describes all organisational, technical and procedural workflows of your scanning process. TR-RESISCAN recommends the structure from Annex V (sample procedure instruction): scope, responsibilities, protection-needs analysis, scanner and software configuration, process flow (intake to destruction), and error and contingency procedures. Docuflair TR-RESISCAN delivers transfer note, audit trail and logs as automated evidence that feeds directly into the VDU. You can download the full practical guide with worked example free of charge.

No, certification is generally not mandatory. TR-RESISCAN serves as a practice-oriented guideline for proper scanning processes. There are three paths to conformity: official BSI certification, the "TR-RESISCAN ready" certificate (VOI-CERT), or a self-declaration with process documentation.

Version 1.5 (December 2024) introduces mobile substitute scanning. You can now digitise TR-RESISCAN-compliantly using mobile devices such as smartphones or tablets with a suitable scanning app. Particularly relevant for field service and decentralised locations.

The German E-Government Act (Section 7 EGovG) requires federal agencies to maintain electronic records and references TR-RESISCAN as state of the art. The Code of Civil Procedure (Section 371b ZPO) governs the evidential value of scanned public documents. The GoBD (principles of proper accounting) also complements TR-RESISCAN for tax-relevant documents.

The protection requirement is assessed separately for the three protection goals: Integrity, Confidentiality, and Availability. The categories are: Normal (limited damage impact), High (considerable impact), and Very High (existential impact). Depending on the classification, the base module and/or extension modules are required.