Legally compliant storage of digital invoices — what you need to know
With the e-invoicing mandate comes a question that many businesses underestimate: how are e-invoices correctly archived? The answer is not trivial, as German GoBD regulations set clear requirements for digital storage — and a simple PDF printout is far from sufficient.
This article explains the GoBD requirements for archiving e-invoices, shows the differences between XRechnung and ZUGFeRD in terms of storage, and provides concrete recommendations for a legally compliant archiving solution.
The five principles of proper digital storage
The German GoBD (Principles for the Proper Management and Storage of Books, Records and Documents in Electronic Form and for Data Access) define clear requirements for digital archiving:
Archived documents must not be altered after storage. Any change must be traceable. The archiving software must ensure the original content cannot be manipulated — through hash values, digital signatures or technical write protection.
All tax-relevant documents must be archived without gaps. For e-invoices, this means both incoming and outgoing invoices must be stored, including all related documents.
Every access to archived documents must be logged. A complete audit trail documents who accessed which document when and whether any changes were made.
Invoices must be retained for at least 10 years. The period begins at the end of the calendar year in which the invoice was received or issued.
Digital invoices must be stored in a format that enables machine processing. The XML data must be archived in the original format, not as a screenshot or paper printout.
Important: GoBD regulations explicitly require that digital documents be stored in their original format. For XRechnung, this is the XML file; for ZUGFeRD, it is the PDF/A-3 file with embedded XML. A printout or format conversion does not replace original archiving.
What to consider for XRechnung and ZUGFeRD
With XRechnung, the invoice exists as a pure XML file. This XML file must be archived in its original format — it is the tax-relevant document. A PDF printout is useful for human-readable display but does not replace XML archiving.
With ZUGFeRD, the situation is simpler: the PDF/A-3 document already contains both the visual representation and the structured XML data. It must be archived as a whole — PDF and XML must not be separated.
| Criterion | XRechnung | ZUGFeRD |
|---|---|---|
| Format to archive | XML file (mandatory) | PDF/A-3 with XML (as a unit) |
| PDF printout as substitute? | No — XML must be archived | No — archive PDF/A-3 with XML |
| Machine readability | Provided by XML | Provided by embedded XML |
| Human-readable view | Additional PDF visualisation recommended | Included in PDF/A-3 |
| Archive format | XML + optional PDF/A | PDF/A-3 (already archive-ready) |
Technical measures for legally compliant storage
When archiving, a cryptographic hash value (e.g. SHA-256) is calculated. This hash is a unique digital fingerprint. Any subsequent check can verify whether the document has been altered.
A qualified timestamp documents the exact point of archiving, proving the document existed in a specific state at a specific time. Qualified timestamps are issued by certified providers and carry legal weight.
GoBD regulations require process documentation describing how digital documents are captured, processed and archived. The documentation must be comprehensible to a qualified third party.
Access to archived documents must be governed by a role-based permissions system. At the same time, complete access must be guaranteed for tax auditors upon request.
Pitfalls to avoid
An employee opens the XRechnung in a viewer, prints the view as PDF and saves it to a network drive. The XML is deleted. Result: the machine-readable original invoice is lost — a GoBD violation.
Many businesses leave e-invoices in the email inbox. This is not audit-proof archiving: emails can be deleted or altered, there is no audit trail, and data can be lost during server migrations.
Storing invoices on a network drive without technical safeguards does not meet the immutability requirement. Files can be renamed, moved or overwritten without logging.
Some systems extract the XML for processing and archive only the PDF (or vice versa). This destroys the integrity of the original document. Always archive the complete ZUGFeRD file.
Tip: Docuflair Archive automatically archives e-invoices in their original format — XRechnung as XML, ZUGFeRD as complete PDF/A-3 file. Hash verification, timestamps and audit trail are built in.
Docuflair Archive stores e-invoices in a legally compliant way in the original format — with hash verification, timestamps and audit trail. PDF/A conversion and OCR full-text search included. Schedule a free demo.
Answers to the most important questions about e-invoice archiving
No. German GoBD regulations require that digital invoices be stored in their original format. For XRechnung, this is the XML file; for ZUGFeRD, it is the PDF/A file with embedded XML. A paper printout or a simple PDF print does not replace legally compliant digital archiving.
E-invoices must be retained for at least 10 years according to the German tax code (Section 147 AO) and GoBD. The period begins at the end of the calendar year in which the invoice was received or issued.
PDF/A is an ISO-standardised format specifically designed for long-term archiving. Unlike regular PDF, PDF/A embeds all required fonts and avoids external dependencies. This ensures the document can be displayed faithfully even decades later.
Yes. With ZUGFeRD, the PDF and XML are inseparably connected — the XML is embedded within the PDF/A-3 file. Archive the ZUGFeRD file as a whole. Do not separate PDF and XML, as this would compromise the document's integrity.