Audit-Proof Records and CO, GeBüV and Tax Compliance — a Fiduciary's View
What the CO and GeBüV actually require, where a Drive mirror stands, and when you need a certified archive — the fiduciary's view.
By Roman Brüngger — Fiduciary with a Swiss federal diploma · Founder rombro ag
As of: July 2026 · This article is not legal advice.
The short answer: yes — Google Drive meets the technical requirements for keeping digital receipts in an audit-proof way, compliant with the CO, GeBüV and tax law. You don’t need to buy an expensive, “certified” archive solution for this. There is no state-issued GeBüV certification anyway — you maintain compliance yourself, and the requirements for doing so are manageable. I’ll also answer the second question business owners ask me most often, clearly: yes, you’re allowed to throw away paper receipts after scanning them — with two exceptions, which I cover below.
I’m writing this as a fiduciary with a Swiss federal diploma and years of practice with Swiss SMEs — not as a software salesperson, and not as a lawyer hedging behind ten caveats. Many guides on this topic stay so cautious that the reader ends up knowing less than before. A tradesperson who wants to know whether their receipt filing in Google Drive holds up legally deserves a clear answer. Here it is — with the reasoning behind it.
What the SME owner actually wants to know
To feel on the safe side, you don’t need a specialty solution that slaps “audit-proof” on its label. The law is technology-neutral: it doesn’t require a specific product, but specific properties of your filing system — integrity, order, availability, traceability. Once you know the requirements, you can meet them with standard tools. Google Drive covers the technical side of these properties; the small organizational remainder is yours to handle — I’ll show you how below, template included.
The technical requirements — and how Google Drive meets them
GeBüV (SR 221.431) sets six core requirements for a digital filing system. At a glance:
| Requirement (GeBüV) | What’s required | Google Drive |
|---|---|---|
| Integrity (Art. 3) | Receipts must “not be alterable without the alteration being detectable” | Met: every change is logged and traceable via activity history and version control; earlier versions can be restored |
| Duty of care (Art. 5) | Store records “carefully, in an orderly manner, and protected against harmful influences” | Met — user error aside: geo-redundant storage protects more reliably against fire, water and fading than any binder ever could |
| Availability (Art. 6) | Authorized parties must be able to view and inspect receipts “within a reasonable period” | This is where Drive really scores: with OCR full-text search a receipt is found in seconds — faster than in any physical folder |
| Organization (Art. 7) | Separate archived from current information; define responsibilities | Met — user error aside: folder structure, permissions, versioning and logging are in place; the ordering itself is your job |
| Archive (Art. 8) | Systematic filing, protection against unauthorized access, logging of access | Met: access control and access logs are built into the system — more secure than any physical archive, which you’d have to protect against natural hazards under GeBüV just the same |
| Permitted storage medium (Art. 9) | For alterable storage: integrity assurance, provable storage timestamp, compliant procedures, retained logs | Met: timestamps and logs are generated by the system on every filing and change |
That’s the core of my position: Google Drive covers the technical side of the requirements. What remains isn’t technical in nature — and it’s less than most people think.
What the legislator intended — and what it didn’t
With all due respect for my legal colleagues’ caution: it was never the intent of the SME-friendly legislator to burden a trade business with archiving bureaucracy. The requirements are formulated with a sense of proportion (“depending on the nature and scope of the business,” Art. 4 GeBüV), and the authorities don’t run preventive proceedings over your choice of filing system. What gets checked is whether your receipts are there, whether they’re unaltered, and whether the audit trail to the accounting matches — not which brand name is on the storage. In my entire practice, I have not experienced a single case where an orderly digital filing system was flagged simply because it lives in the cloud.
What you have to handle yourself (and how simple that is)
Two requirements no system in the world can take off your hands — not even “certified” archive software:
1. The procedural documentation (Art. 4 GeBüV). The organization, responsibilities and processes for record keeping belong in a work instruction. For a small SME, one page answering five questions is enough:
- Who is responsible for filing receipts (including a deputy)?
- How are receipts captured (scan app, email import, upload)?
- Where are they stored (system, folder structure, naming scheme)?
- How is the backup done (second copy, location, cadence)?
- How is it checked (annual spot-check for legibility)?
2. The periodic review (Art. 10 GeBüV). Data holdings must be checked regularly for integrity and legibility. If you’re already using Google Drive daily anyway, this happens along the way — you’ll notice right away if something is missing or no longer legible. An annual spot-check, documented in one line, is enough.
Checklist: record keeping for Swiss SMEs
- Capture all receipts digitally (scan or original PDF) — exceptions:
- Annual report (financial statements) — in writing and signed
- Auditor’s report — in writing and signed
- Recommended (not mandatory): contracts and deeds whose original signature carries evidentiary value in a dispute
- Keep the annual report and auditor’s report additionally in signed form.
- Assign receipts to a system (accounting software), rather than collecting them in loose folders.
- Create a one-page procedural documentation (Art. 4 — template above).
- Maintain an automatic second copy outside the system — your own drive, your own storage, your own control.
- Keep retention periods under control: don’t dispose of anything before the 10-year period expires; for real-estate records, 20 years and until the tax statute of limitations.
- Test once a year: can you find any receipt from three years ago in under a minute — and is it still legible (Art. 10)?
Retention periods in Switzerland: the table
| Document | Period | Form | Basis |
|---|---|---|---|
| Annual report (financial statements) | 10 years | In writing and signed | Art. 958f para. 2 CO |
| Auditor’s report | 10 years | In writing and signed | Art. 958f para. 2 CO |
| Business books (general ledger, journals) | 10 years | Paper or electronic | Art. 958f paras. 1+3 CO |
| Accounting records (invoices, receipts; contracts and correspondence, insofar as they document a booking) | 10 years | Paper or electronic | Art. 958f CO; FTA VAT Info 16 |
| Documents relating to immovable property (purchase agreements, construction cost statements, related invoices) | 20 years — thereafter until the tax statute of limitations expires | Paper or electronic | Art. 70 para. 3 VAT Act; FTA VAT Info 16 §1.6.2 |
| After a company’s liquidation | 10 years from deregistration | In a secure location | Art. 747 CO |
| Private individuals | No general statutory duty (recommended: until the tax assessment is final) | — | — |
The period runs from the end of the financial year, not from the receipt date (Art. 958f para. 1 CO): a receipt from January 2026 must remain available until the end of 2036. For VAT purposes, retention generally runs until the absolute statute of limitations on the tax claim (Art. 70 para. 2 in conjunction with Art. 42 para. 6 VAT Act) — which can slightly exceed the CO deadline.
From practice: what audits actually flag
As fiduciaries, we look after more than 100 Swiss SMEs who keep their receipts digitally in bexio and mirror them to Google Drive. In not a single audit — whether by the statutory auditor, a VAT inspection, the tax authority, or social insurance — has this digital record keeping ever been flagged. What does get flagged in practice are other things: missing receipts, no link to the booking, no second copy after switching providers. Exactly the points you’ve already covered by having an orderly, automatically mirrored filing system in the first place.
That’s also why we built quintio: the mirror files your bexio receipts automatically, in order, unaltered and searchable, in your own Google Drive — the orderly filing system from this article, without you having to think about it.
Frequently asked questions (FAQ)
Is Google Drive audit-proof? Google Drive meets the technical requirements for audit-proof, GeBüV-compliant filing (integrity, logging, availability, access protection). But audit-proof record keeping isn’t a product feature you can buy — it results from the system plus orderly use. You handle the organizational part yourself (one-page procedural documentation, annual check). The direct answer to the compliance question is in “Is Google Drive GeBüV-compliant?”.
Do I need a certified archive solution? No. There is no state-issued GeBüV certification; certificates are private audits. What matters is whether your filing system meets the statutory properties — not which label the product carries.
Can I destroy paper receipts after scanning them? Yes — except for the annual report and auditor’s report (in writing and signed, Art. 958f para. 2 CO). Contracts with an original signature of evidentiary relevance are additionally kept on a voluntary basis. The detailed answer with legal basis.
quintio.ch continuously mirrors every document from bexio into your own Google Drive — orderly, unaltered, searchable. Your record keeping, ready for any audit.
Sources
quintio automatically mirrors your bexio documents into your own Google Drive.
Sign up free