BAO compliance
Which BAO requirements SimpliServ covers technically and how GoBD fits in
This article describes how SimpliServ implements BAO requirements technically.
BAO at a glance
In Austria, the Federal Fiscal Code (BAO) governs how books, records and receipts must be kept, retained and made processable in case of an audit.
For software systems this means in particular:
- completeness and orderly keeping,
- traceability of changes,
- retention for the statutory period,
- machine analysability and auditability.
About GoBD (how it fits in)
GoBD is a German administrative regulation for proper digital bookkeeping and receipt retention. Its substance overlaps strongly with BAO requirements: immutability, traceability, order and analysability. How SimpliServ archives and exports is described in detail in GoBD archiving.
SimpliServ uses these base principles as a technical guideline, while the primary legal assessment for Austrian businesses is made via BAO.
How SimpliServ covers BAO technically
1) Unified compliance archive (WORM)
All archived objects (invoices, proposals, receipts, DEP7 artifacts) sit in a shared S3 archive bucket with Object Lock retention.
archives/{tenant_id}/{year}/{month}/...That makes immutability and tenant separation technically clean.
2) Structured, immutable document snapshots
Each archived document contains:
archive.json(canonical business data, metadata, manifest),document.pdf(document rendering).
This creates a reproducible audit trail.
3) Integrity and traceability data
Archive records contain hashes, timestamps and references to artifacts. That keeps tampering detectable and the history traceable.
4) Direct exportability for audits
SimpliServ provides direct ZIP exports for archived document areas:
/api/v1/archives/exports/invoices/api/v1/archives/exports/proposals/api/v1/archives/exports/receipts
Each export contains the artifacts plus index.csv and export_manifest.json.
5) DEP7 export straight from archive data
DEP7 is provided as a ZIP directly from the archived monthly objects. That makes the output consistent and auditable. The detailed guide to the DEP export (RKSV) is in its own article.
6) Retention above the minimum level
BAO §132 generally requires 7 years of retention (extended where relevant to ongoing proceedings). The 10-year retention in use is stricter and therefore conservative.
BAO mapping (technical view)
BAO §131 (proper keeping / machine records)
Technical coverage:
- ordered storage structure by tenant/year/month/type,
- canonicalized records and deterministic exports,
- machine-analysable data and direct output (ZIP + files).
BAO §132 (retention and legibility)
Technical coverage:
- immutable retention,
- retention above the statutory minimum,
- export/download function for audit access.
BAO §131b / §132a (register and receipt context)
Technical coverage:
- DEP7 artifacts are archived and exportable,
- receipts are archived in final fiscal states,
- audit-ready retrieval paths are available.
What still has to be ensured organizationally
Full compliance depends not only on technology but also on organization and operations:
- process documentation,
- role and process controls in production,
- documented change and incident management,
- evidence that Object Lock and retention are correctly active in production.
Conclusion
SimpliServ thus offers a robust BAO-oriented technical basis for document and DEP7 evidence: immutable storage, structured retention, direct exportability and traceable archive records.
For formal compliance confirmations, coordination with tax/legal advisors and organizational documentation remains necessary.
Legal sources
Related topics
- GoBD archiving — how SimpliServ archives and exports in an audit-proof way
- DEP export (RKSV) — export the DEP7 data collection log per register and period
- RKSV logic & fiscalization — fiscalization, POS receipts and number ranges in SimpliServ
- FinanzOnline — cash register web service for reporting to the tax office
How is this guide?