What the Business Records Ordinance truly requires, why a hard drive with a backup is not enough, and how digital archiving can be pragmatically implemented in everyday SME operations.
Anyone responsible for accounting or management in a Swiss SME has probably, at some point, asked the question: How long do we actually have to keep this? And in what form? The answer is provided by the Business Records Ordinance (GeBüV), which, together with the Code of Obligations and the VAT Act, defines the legal framework for retention and archiving. What is soberly formulated in the law has significant consequences in everyday life, from the choice of filing system to the question of whether a backup qualifies as an archive. We show what is truly required, how DeepCloud and Abacus map these requirements, and what matters in day-to-day business.
First things first: This article does not replace legal advice. If a specific case arises, such as a company succession or a VAT audit with particular circumstances, consulting with a fiduciary or a qualified lawyer is the right approach. What we show here is the framework in which most SMEs operate, and the typical pitfalls that repeatedly emerge in consulting practice.
What the Law Truly Requires
The essential points for a Swiss SME can be condensed into a few statements:
Retention period 10 years. Business records, accounting vouchers, and business correspondence must be retained for ten years after the end of the financial year. For VAT-relevant documents, the period is also ten years, with possibilities for extension in ongoing proceedings or for real estate.
Form of retention. Annual reports and audit reports must be available in paper form. All other documents can be archived electronically, provided certain requirements are met: legible, accessible at all times, secured against alteration, traceable.
Integrity and authenticity. Data must be stored in such a way that it cannot be altered unnoticed. A Word file on a network drive does not meet this requirement because it can be overwritten at any time. A PDF file with a qualified electronic signature or a WORM storage (write once, read many), however, does.
Access for the entire period. Anyone who still needs to read an invoice in ten years should consider the legibility of file formats. An old proprietary format without software support can become a problem. PDF/A is the established long-term standard here.
Anyone who takes these points seriously has already understood a good part of the requirements. What makes the difference in day-to-day business is the implementation.
Why a Backup is Not an Archive
A common misconception in SMEs is: “We do daily backups, so archiving is done.” Unfortunately, that’s not true. Backup and archive have different purposes, with different requirements.
A backup secures the current data inventory in case something is lost: a hardware defect, a ransomware attack, an accidentally deleted folder. A backup is usually rotated, older versions are overwritten, and changes to the original are included in the next backup.
An archive, on the other hand, preserves the state at a specific point in time. An archived invoice from 2019 must still be as legible in 2029 as it was then. If someone had changed the invoice in the meantime, the archive value would be lost. This is precisely why an archive belongs on storage that prevents changes or at least meticulously logs them.
This is not a quibble. During a tax audit or a revision, precisely this question is examined: whether the archived documents are unchanged since the original date or whether they could have been manipulated in the interim. A hard drive with normal write access does not meet this criterion.
Retention Periods at a Glance
| Document Type | Retention Period | Form | Note |
|---|---|---|---|
| Annual and Audit Report | 10 years | Paper | Only mandatory in paper form |
| Accounting Vouchers (Invoices, Receipts) | 10 years | Paper or electronic | If electronic: audit-proof |
| Business Correspondence | 10 years | Paper or electronic | Includes relevant emails |
| VAT-Relevant Documents | 10 years, for real estate 20 years | Paper or electronic | Extension in ongoing proceedings |
| Payroll Documents | 10 years, OASI-relevant documents 10 years | Paper or electronic | Withholding tax 10 years |
| Personnel Files after Departure | 10 years | Paper or electronic | Observe data protection, only necessary documents |
| Contracts and Powers of Attorney | 10 years after contract end | Paper or electronic | Significantly longer for real estate |
What DeepCloud and Abacus Specifically Deliver
DeepCloud is the archiving and document platform that handles audit-proof storage within the Abacus ecosystem. In conjunction with the accounting modules, it creates a seamless connection between the booking entry and the original document. Specifically, this means:
Direct document reference in the booking entry. Anyone posting an invoice in accounts payable can see the original document directly in the booking entry. The invoice is stored once in DeepCloud, saved there in an audit-proof manner, and can be found by any authorized employee in seconds.
Structured metadata. Date, supplier, amount, VAT code, document number: all this information is automatically stored during filing. A search for “invoices over 5000 francs from supplier X in the second quarter of 2024” yields a hit list in a few seconds, without anyone having to leaf through folders.
Versioning and audit log. Every access, every change, every release is logged. During an audit, it can be proven who accessed which document and when. This builds trust and reduces discussions during an audit.
Retention rules. Depending on the document type, deadlines and organizational retention rules can be defined. After legal or internal retention periods expire, documents should be reviewed and, if necessary, deleted, which is often even required from a data protection perspective.
Access protection. Who is allowed to see which documents is regulated granularly. The management’s payroll statement belongs to different permissions than the accounting department’s incoming invoices. DeepCloud allows this separation cleanly.
Practical Example: Fiduciary Firm with Client Archive
Before the transition, a fiduciary firm with 14 employees and around 220 clients had a classic mixed solution. Documents in paper folders, scanned versions on a network drive, some client communication in Outlook, some in a predecessor’s document management system. During a VAT audit of a client mandate, employees needed an average of 12 to 18 minutes to find a single document from the previous year.
After the introduction of DeepCloud, combined with a migration of the existing archive from the last five years and a clear filing structure per client, this was the situation after eight months:
- Search time per document: around 30 to 60 seconds instead of the previous 12 to 18 minutes.
- Duplicate filings: practically disappeared because the system recognizes duplicates.
- Compliance effort per mandate during audits: around one hour instead of half a day previously.
- Physical archive in the basement: can be dissolved in the medium term because everything is digitally archived in an audit-proof manner.
What management particularly appreciates, besides efficiency: the issue of trust. For clients with confidential documents, it can now be seamlessly proven who accessed which documents and when. In the fiduciary sector, this is not only a compliance argument but also a quality feature.
Where it Still Falters in Practice
Three points that come up in almost every archiving project.
Migration of the existing archive. Anyone wanting to transfer 15 years of paper and hard drives into a modern archiving solution has a project ahead of them that won’t be completed in two weeks. A pragmatic solution is often a gradual migration: older records remain physical or in the old system, while new documents are stored in DeepCloud from a cut-off date. After ten years, the retention period for the older records expires.
Email archiving. Business-relevant emails are subject to retention requirements, which many SMEs underestimate. A pure Outlook storage does not meet the requirements because emails there can be changed or deleted at any time. There are specific solutions that work with DeepCloud, or standalone email archives that are connected to the mail server.
Team acceptance. A new filing structure is not met with enthusiasm everywhere, especially among employees who have built their own logic over years. Here, no technical argument helps, but rather a clear decision from management and training that shows how the system specifically helps. Anyone who has found something themselves three times in the first week is usually convinced.
Data Protection and Archiving in Balance
Since the revised Data Protection Act (nDSG), which came into force in September 2023, archiving has an additional dimension. Personal data may only be retained for as long as necessary for the original purpose or legal obligation. Specifically, this means: an applicant who was not hired has a right to have their documents deleted, provided there is no other retention obligation.
A pure “keep everything forever” strategy is therefore not only questionable from a data perspective but also legally problematic. A modern archiving solution must be able to selectively delete when the deadline expires.
Conclusion: Archiving is an Investment, Not a Burden
Clean archiving is often seen as a mandatory exercise, a topic that simply has to be done because the law requires it. In reality, it is one of the most rewarding digitalization investments an SME can make. It saves time searching, reduces stress during audits, creates transparency in day-to-day business, and forms the basis for any further automation. Anyone who wants modern accounting cannot do without a well-thought-out archive.
What is needed for this is an honest assessment of what exists today, a pragmatic migration strategy, and a clear concept for permissions and retention periods. This is initial work that pays off within a few months, as the ongoing efficiency gains quickly outweigh the initial effort. At the latest with the first use case (an audit, a client request, a dispute over an old invoice), every management realizes why the step was worthwhile.
Would you like to put your archiving to the test?
We will analyze with you what is currently stored where, what gaps exist regarding the GeBüV and the Data Protection Act, and how a pragmatic migration to DeepCloud can look. Including realistic effort and time planning, as well as training for those involved.
