ED08 - Retention Periods & Immutability: Git Hooks, Evidence Packages
Problem
GoBD and AO require long-term retention - but in practice, implementation fails:
- "10 years? The cloud takes care of that." - many entrepreneurs believe that cloud software automatically handles retention - but when the account is canceled, the data are often no longer available (see ED01 pain points 6–7)
- Cloud account canceled, data gone - the payroll account was paused, and the old payroll accounts can only be reactivated for additional fees - GoBD violation (§ 146 Abs. 5 AO)
- Old software versions cannot be reactivated - the backups require the old software version, which can no longer be installed - GoBD violation (§ 147 Abs. 2 AO: "promptly readable")
- No immutability - accounting entries changed subsequently without traceability - GoBD violation (Rz. 146)
- No Evidence Packages - during an external audit, the auditor cannot be provided with a data carrier (Z3) - GoBD violation (§ 147 Abs. 6 AO)
- Retention periods not known - 10 years? 8 years? 6 years? Many entrepreneurs do not know the periods applicable to their documents
Core statement
GoBD-compliant retention with Git means:
- Git bundles are self-contained - no cloud account, no
software license, no service provider -
git cloneis sufficient - Retention periods are documented in the repository - every
artifact carries its deadline in the sidecar (
obsolescence+ deadline date) - Immutability through tags and Protected Branches - approved versions are cryptographically immutable
- Evidence Packages for period-end closes -
git bundle+ Static Web (Z3+) for auditors (see ED05) - Deadline check as a Git artifact -
checks/FRISTEN_CHECK.mdwarns of imminent deadlines
Compliance by Design: Retention is not an afterthought - it is created through the choice of medium. Git bundles are self-contained and outlast any cloud lockout, any software version change, and any service provider termination.
Retention periods under AO § 147
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#FBFAF7','primaryTextColor':'#0F1B33','primaryBorderColor':'#6B7280','lineColor':'#6B7280'}}}%%
flowchart TD
AO["AO § 147
Retention periods"] AO --> J10["10 years
§ 147 Abs. 1 Nr. 1"] AO --> J8["8 years
§ 147 Abs. 1 Nr. 4"] AO --> J6["6 years
§ 147 Abs. 1 Nr. 2/3/5"] J10 --> D10["Books, records
Inventories, annual financial statements
Opening balance sheet
Work instructions"] J8 --> D8["Booking vouchers
E-invoices (XML)
Payroll records"] J6 --> D6["Commercial / business letters
Emails (EML)
Other documents"] style AO fill:#0F1B33,stroke:#0F1B33,color:#FBFAF7 style J10 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style J8 fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style J6 fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style D10 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style D8 fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style D6 fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33
Retention periods"] AO --> J10["10 years
§ 147 Abs. 1 Nr. 1"] AO --> J8["8 years
§ 147 Abs. 1 Nr. 4"] AO --> J6["6 years
§ 147 Abs. 1 Nr. 2/3/5"] J10 --> D10["Books, records
Inventories, annual financial statements
Opening balance sheet
Work instructions"] J8 --> D8["Booking vouchers
E-invoices (XML)
Payroll records"] J6 --> D6["Commercial / business letters
Emails (EML)
Other documents"] style AO fill:#0F1B33,stroke:#0F1B33,color:#FBFAF7 style J10 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style J8 fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style J6 fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style D10 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style D8 fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style D6 fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33
| Retention period | Document type | Legal basis | Examples |
|---|---|---|---|
| 10 years | Books, records, inventories, annual financial statements, opening balance sheet, work instructions | § 147 Abs. 1 Nr. 1 AO | Ledger (JSON), process documentation, chart of accounts |
| 8 years | Booking vouchers | § 147 Abs. 1 Nr. 4 AO | E-invoices (XML), payroll statements, social security notices |
| 6 years | Commercial / business letters, other documents | § 147 Abs. 1 Nr. 2/3/5 AO | Emails (EML), correspondence, notes |
Important - Start of the retention period: The period begins at the end of the calendar year in which the last entry was made, the annual financial statements were prepared, the document was received, or the record was made (§ 147 Abs. 4 AO). An accounting entry dated 15.08.2026 starts the period on 31.12.2026 - 10 years end on 31.12.2036.
Immutability through Git
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#FBFAF7','primaryTextColor':'#0F1B33','primaryBorderColor':'#6B7280','lineColor':'#6B7280'}}}%%
flowchart TD
B["Accounting entry
Commit"] B --> H["SHA-256 hash
of the commit"] H --> T["Tag
(approval marker)"] T --> P["Protected Branch
(no force push)"] P --> U["Immutability
GoBD Rz. 146"] K["Correction required"] K --> NC["New commit
+ obsolescence marker"] NC --> O["Original remains
traceable"] style B fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style H fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style T fill:#10A987,stroke:#0A7F5C,color:#FBFAF7 style P fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style U fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style K fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style NC fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style O fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33
Commit"] B --> H["SHA-256 hash
of the commit"] H --> T["Tag
(approval marker)"] T --> P["Protected Branch
(no force push)"] P --> U["Immutability
GoBD Rz. 146"] K["Correction required"] K --> NC["New commit
+ obsolescence marker"] NC --> O["Original remains
traceable"] style B fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style H fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style T fill:#10A987,stroke:#0A7F5C,color:#FBFAF7 style P fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style U fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style K fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style NC fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style O fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33
| Mechanism | Git feature | GoBD reference |
|---|---|---|
| Commit hash | SHA-256 hash per commit - every change creates a new hash | Rz. 146 (immutability) |
| Tags | Immutable markers for approved versions | Rz. 146 (approval) |
| Protected Branches | main protected, no force push, no rebase |
Rz. 146 (no rewriting) |
| Obsolescence | Corrections as new commits with superseded_by |
Rz. 146 (traceability) |
| GPG signature | Signed commits - authenticity can be proven | Rz. 146 (authorship) |
Important - Linear history: Only linear history without rewriting is GoBD-compliant.
git rebase,git commit --amendandgit push --forceonmainare prohibited. The pre-commit hook ensures that no force pushes take place and that corrections are made as new commits with an obsolescence marker.
Evidence Packages for retention
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#FBFAF7','primaryTextColor':'#0F1B33','primaryBorderColor':'#6B7280','lineColor':'#6B7280'}}}%%
flowchart TD
FY["Fiscal year
e.g. FY2026"] FY --> EP["Tenant Evidence Package
(period-end close)"] EP --> GB["git bundle
self-contained archive"] EP --> SW["Static Web
(Z3+ browser)"] EP --> MF["Manifest
+ SHA-256 checksums"] GB --> USB["USB drive
or off-site backup"] SW --> USB MF --> USB USB --> PR["Auditor
git clone or index.html
offline, without IAM] style FY fill:#0F1B33,stroke:#0F1B33,color:#FBFAF7 style EP fill:#10A987,stroke:#0A7F5C,color:#FBFAF7 style GB fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style SW fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style MF fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style USB fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style PR fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33
e.g. FY2026"] FY --> EP["Tenant Evidence Package
(period-end close)"] EP --> GB["git bundle
self-contained archive"] EP --> SW["Static Web
(Z3+ browser)"] EP --> MF["Manifest
+ SHA-256 checksums"] GB --> USB["USB drive
or off-site backup"] SW --> USB MF --> USB USB --> PR["Auditor
git clone or index.html
offline, without IAM] style FY fill:#0F1B33,stroke:#0F1B33,color:#FBFAF7 style EP fill:#10A987,stroke:#0A7F5C,color:#FBFAF7 style GB fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style SW fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style MF fill:#DBEAFE,stroke:#1D4ED8,color:#0F1B33 style USB fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style PR fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33
A Tenant Evidence Package (see ED05 Z3+) for a fiscal year contains:
| Component | Content | GoBD reference |
|---|---|---|
| git bundle | Complete repository (history, commits, tags) | § 147 Abs. 6 AO (Z3 data carrier) |
| Static Web | Browser-navigable website (HTML/PDF/JSON) | Z3+ (auditor access without IAM) |
| Manifest | SHA-256 checksums per file, V7GUID index | Rz. 146 (integrity) |
| Process documentation | Rendered as HTML | Rz. 64–91 (process documentation) |
| DMS documents | All documents (PDF, XML, EML) | § 147 Abs. 1 (retention) |
| Contracts | Documents spanning multiple periods | § 147 Abs. 1 Nr. 2/3 (commercial letters) |
The safest form of retention: A USB drive with
git bundle+ Static Web + Manifest is self-contained, offline, without IAM, without a cloud account, and without a software license. It outlasts any service provider termination, any software version change, and any cloud lockout. This is the safest form of GoBD-compliant retention - because there are no dependencies.Of course, the physical security of the USB drive must be taken into account (safe, fire protection, off-site backup).
Retention period management in the repository
checks/FRISTEN_CHECK.md
# Deadline Check
## Lead time (until 010926) - PRIORITY 1
- [ ] 200826: Request ELSTER organizational certificate
- [ ] 250826: Determine the premium tariff authority
- [ ] 300826: D&O insurance for managing director liability
## Retention periods (ongoing)
| Retention period | Document type | Ends | Status |
|---:|:---|---:|:---|
| 10 years | Ledger FY2026 | 31.12.2036 | active |
| 8 years | E-invoices FY2026 | 31.12.2034 | active |
| 6 years | Emails FY2026 | 31.12.2032 | active |
Automatic warning for imminent deadlines
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#FBFAF7','primaryTextColor':'#0F1B33','primaryBorderColor':'#6B7280','lineColor':'#6B7280'}}}%%
flowchart LR
FC["Deadline check
(Git artifact)"] FC --> P14["more than 14 days
green"] FC --> P7["7–14 days
yellow"] FC --> P0["less than 7 days
orange/red"] P0 --> W["Warning
to entrepreneur"] style FC fill:#0F1B33,stroke:#0F1B33,color:#FBFAF7 style P14 fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style P7 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style P0 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style W fill:#FDBA74,stroke:#C2410C,color:#0F1B33
(Git artifact)"] FC --> P14["more than 14 days
green"] FC --> P7["7–14 days
yellow"] FC --> P0["less than 7 days
orange/red"] P0 --> W["Warning
to entrepreneur"] style FC fill:#0F1B33,stroke:#0F1B33,color:#FBFAF7 style P14 fill:#D1FAE5,stroke:#0A7F5C,color:#0F1B33 style P7 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style P0 fill:#FDBA74,stroke:#C2410C,color:#0F1B33 style W fill:#FDBA74,stroke:#C2410C,color:#0F1B33
| Deadline type | Warning | Action |
|---|---|---|
| Retention period expires | 30 days beforehand | Document destruction after expiry |
| Authority deadline (ELSTER, SV) | 14 days beforehand | Prepare submission |
| Statute of limitations (§ 169 AO) | 90 days beforehand | Do not destroy documents |
Risk leverage
| Today (low-cost) | Tomorrow (audit-proof) | Risk mitigated |
|---|---|---|
git bundle as a self-contained archive |
10-year retention without a cloud account | GoBD violation due to account cancellation |
| Tags + Protected Branches | Immutability after approval | GoBD violation due to a subsequent change |
| Evidence Package (Z3+) | Auditor access without IAM, offline | GoBD violation due to inaccessible data |
| Deadline check as a Git artifact | Missed deadlines avoided | Late fees § 152 AO |
| Obsolescence marker | Corrections are traceable | Concealed changes |
| GPG-signed commits | Authenticity can be proven | Denial of authorship |
| Static Web (Z3+) | Browser navigability for auditors | GoBD violation due to auditor-unfriendly data |
Harness requirement (preview)
Derivable from ED08:
| ID | Requirement | Priority |
|---|---|---|
| FA-4.1 | Deadline check file (checks/FRISTEN_CHECK.md) |
MUST |
| FA-4.2 | Deadline entries with date, type, tenant, document reference | MUST |
| FA-4.3 | Automatic warning for deadlines < 14 days | SHOULD |
| FA-6.5 | 10-year retention via Evidence Packages (Git bundles) | MUST |
| FA-6.6 | Immutability after approval (Tags, Protected Branches) | MUST |
| FA-6.7 | Static Web generator for period-end close (Z3+) | SHOULD |
| TA-2.4 | Pre-commit: obsolescence status check | SHOULD |
The complete list of requirements is in Harness-Anforderungen.md.
Sources
- GoBD (BMF circular, Rz. 146 - Immutability, Rz. 152 - Retention periods)
- AO (§ 146 Abs. 5 - Availability, § 147 - Retention periods of 10/8/6 years, § 147 Abs. 4 - Start of the retention period, § 147 Abs. 6 - Z3 data access)
GitCover.Ledger/docs/02-Tenant-Evidence-Package.md- Tenant Evidence Package conceptE1/agents/(anonymized) - SSoT concept with deadline check, Evidence Packages
Source topology and CDN reference links
| Role | Location | Purpose |
|---|---|---|
| Primary / SSoT | git.gitcover.org/GCC | Canonical storage (GPG-signed, versioned) |
| Public OSS Mirror / CDN | codeberg.org/gitcover-commons | Read-only mirror; FLOSS discovery |
| Community Hub | github.com/gitcover-commons | Issues & Discussions; source code reference on Codeberg |
Note: This mapping of sources, mirror, and community hub reflects the current status and may change. Please check the respective canonical source on gitcover.org for the current status.