Candis
Candis GmbH, Berlin ·www.candis.io· As of: 2026-08-26
Work through this tool with an AI
Our verdict
Invoice approval is a process no customer ever sees. Shortening it saves cycle time and earns early-payment discounts, but it sets you apart from nobody in your own market, because every competitor can order the same software. The benefit is still real and calculable: it hangs on the number of invoices and the number of people a document passes today. That keeps it efficiency in a single case. Anyone hoping to derive an edge from it is looking in the wrong place.
Evidence:Legal form, registered office, register court and number, managing directors, VAT identification number and the named data protection officerOpen sourceFirst registration on 19 June 2015, filed annual accounts for 2017 to 2024 with the 2024 accounts submitted on 1 June 2026, share capital of 169,685 euros as at 22 August 2023Open sourceProcessing agreement version 1.10, signed on 19 November 2024: four named subprocessors with purpose and country, hosting in Frankfurt am Main, service provided exclusively within the European Union or European Economic Area, exclusion of general AI training, return or deletion after the order ends, a retention carve-out of up to ten years, and the technical and organisational measuresOpen sourceNotice periods under clause 7.1, a six-week access window with deletion afterwards and paid extensions under clause 7.3, and the absence of any availability commitment under clause 8.2Open sourceEntry prices of the three packages, billing by document volume, unlimited users and legal entities, included services, contract terms of twelve to thirty-six months, the figure of more than 10,000 companies, and the issuing of credit cards with Varengold BankOpen sourceDescription of the AI functions, storage in Frankfurt am Main, the cloud operator's certifications, the GoBD-certified label, statements on learning within your own data and on forgoing cross-company training, a saving of 13,500 to 34,000 euros a year and up to 91 per cent correctly recorded informationOpen sourceProcessing on behalf of the vendor for its own website with transfers to the United States under the EU-US Data Privacy Framework, and no statement on customer content inside the productOpen sourceSign-in via SAML with Entra ID or Google from the Max plan onwards and only after a request to the vendorOpen sourcePublic status page with ninety-day uptime figures per componentOpen sourceLicensed DATEV interface partner with regular technical review by DATEV, export history, and the scope of the interfaces to DATEV Unternehmen online and DATEV RechnungswesenOpen sourceMulti-step approval rules by amount threshold, approval groups, deputy arrangements during absences, and individually assigned access rightsOpen sourceThird-party certificates and attestations help in choosing a system but do not bind the tax authority, margin number 180 of the German Federal Ministry of Finance letter of 28 November 2019, file reference IV A 4 - S 0316/19/10003 :001Open sourceA funding round of EUR 12 million on 30 July 2020 led by Viola Ventures together with the other participating investorsOpen sourceA funding round of USD 16 million on 14 September 2022 with Viola Fintech, Lightspeed and Viola Ventures, plus USD 30 million across two roundsOpen sourceNo subprocessor page and no security or trust page anywhere in the vendor's own sitemap of 434 addressesOpen source
Who it fits
Solo
not suitable
The entry price is 389 euros a month, and contract terms run from twelve to thirty-six months according to the pricing page. Anyone who works through their incoming invoices in a single morning each month is paying for an approval flow with only one person in it.
Mid-market
suitable
This is where the fit sits. User count and legal entities are unlimited in every package, billing runs on document volume, and setup, training and support are included in the price according to the vendor. The route into the books runs through a licensed DATEV interface, which brings the tax adviser along from day one. One number belongs on the table before signing: how many documents actually come in per month, because that is what the price hangs on rather than the headcount.
Enterprise
suitable with caveats
Three points argue against it, and all three are documented. First, logging in through your own identity provider sits in the top package: SAML sign-in via Entra ID or Google is available from the Max plan according to the help pages, and it has to be requested from the vendor. Second, clause 8.2 of the terms of business expressly promises no availability, while a public status page with uptime figures does exist. Third, the vendor names no security certification for itself; what it names are the cloud operator's attestations. Anyone buying to a group standard negotiates these three points or walks.
Buy, switch or build
Off-the-shelf
Stay with the tax adviser and the accounting system
DATEV Unternehmen online can collect documents and have them approved, and for larger houses the same processes sit in the accounts-payable modules of SAP or Microsoft Dynamics 365 Business Central, alongside the classic German vendors for invoice-receipt workflows such as xSuite. This route buys proximity to the system of record and a contracting party procurement already knows. The audit trail stays in one place, and the archive sits where the retention duty is being served anyway. You pay for it in the interface: approval travels to people who want nothing to do with accounting software, and the more awkward it is for them, the longer an invoice sits.
AI-native
Take an AI-native spend tool that brings approval with it
Pleo and Moss come from the corporate card and have added invoice approval, rather than the other way round. The difference lies less in price than in cut: these tools cover card, expense and receipt in one flow and are strong where spending arises in the field. Candis comes from the accounts-payable side and is strong where supplier invoices arrive in volume and have to reach the books. So a single question belongs before any feature comparison: where do the documents that eat time in your own house come from. Anyone wanting to serve both ends buys approval twice and gets two audit trails.
Build it yourself
Build the approval run yourself
The run is manageable: pull the invoice from a mailbox, read out the fields, check against supplier master data and the purchase order, route it by amount and cost centre to the responsible person, collect the approval, hand the posting to DATEV. You build it with Claude Code as the build tool, n8n for the process chain, LiteLLM as the model gateway and Langfuse for the evaluation loop on extraction quality, with document storage in Supabase. Two weeks of build time for the first invoice type is realistic, so at a day rate of 1,200 euros roughly 12,000 euros one-off against 4,668 euros a year for the Basis package. The arithmetic rarely works out anyway, and it does not fail on the build. It fails on retention: archiving for ten years in unalterable form, with procedural documentation, tenant separation and a log that holds up in a tax audit, is the expensive part, and it comes round every year. Add the deputy rule, which nobody builds until the first invoice sits untouched through a manager's holiday. It pays off when your own checking rule is the actual value, for instance an industry logic no standard tool knows. It does not pay off for the normal case that two vendors serve off the shelf.
Our advice
- Solo: Do not buy. At that document volume the entry price does not carry the benefit.
- Mid-market: A fit when the documents run through the DATEV route. Count the monthly volume first and settle the contract term in the order form.
- Enterprise: Only worth a serious look on the Max plan, and put availability, audit-log scope and the current subprocessor list in writing before signing.
Who is behind it
Staying power: Established
The company has been on the commercial register since 19 June 2015 and has therefore been in the market for eleven years. Annual accounts are on file for 2017 through 2024, the most recent filed on 1 June 2026. Two funding rounds are documented with dates, the more recent from 14 September 2022. Share capital has been raised several times and stood at 169,685 euros on 22 August 2023.
- Legal entity and commercial register: Candis GmbH, Karl-Liebknecht-Strasse 5, 10178 Berlin, local court (Amtsgericht) Charlottenburg HRB 168078 B, first registered 19 June 2015, managing directors Christian Ritosek and Linnar Schwarz, VAT identification number DE300859729Legal form, registered office, register court and number, managing directors, VAT identification number and the named data protection officerOpen source · As of 2026-08-26
- Filed accounts and share capital: Annual accounts filed for the financial years 2017 to 2024, the 2024 accounts submitted on 1 June 2026; share capital 169,685 euros after several increases as at 22 August 2023First registration on 19 June 2015, filed annual accounts for 2017 to 2024 with the 2024 accounts submitted on 1 June 2026, share capital of 169,685 euros as at 22 August 2023Open source · As of 2026-08-26
- Funding round 2020: EUR 12 million Series B announced on 30 July 2020, led by Viola Ventures, with Rabo Frontier Ventures, Lightspeed Venture Partners, Point Nine Capital, Speedinvest, main incubator and 42CAPA funding round of EUR 12 million on 30 July 2020 led by Viola Ventures together with the other participating investorsOpen source · As of 2026-08-26
- Funding round 2022 and cumulative total: USD 16 million from Viola Fintech, Lightspeed and Viola Ventures, reported on 14 September 2022; the same report cites USD 30 million across two rounds. No later round has been publicly reported.A funding round of USD 16 million on 14 September 2022 with Viola Fintech, Lightspeed and Viola Ventures, plus USD 30 million across two roundsOpen source · As of 2026-08-26
- Ongoing operations: Public status page with ninety-day uptime figures per component, retrieved on 26 August 2026: web application 99.77 per cent, interface 100 per cent, external services including DATEV 98.96 per centPublic status page with ninety-day uptime figures per componentOpen source · As of 2026-08-26
- Customer count by the vendor's own account: more than 10,000 companies since 2015, the vendor's own figure on the pricing page, with no methodology and no cut-off dateEntry prices of the three packages, billing by document volume, unlimited users and legal entities, included services, contract terms of twelve to thirty-six months, the figure of more than 10,000 companies, and the issuing of credit cards with Varengold BankOpen source · As of 2026-08-26
Cost of leaving: High
One half is uncritical: postings and master data flow continuously into your own accounting system through the DATEV interface, and that is where they stay after a switch. The other half sits in the platform, and a clock runs on it. Clause 7.3 of the terms of business grants six weeks from receipt of notice to download the content and documents put in; after that they are deleted. Extensions are available on written request in one-month steps, each against the agreed monthly fee. The wording covers the content and documents the customer put in. Whether the approval history comes along, meaning who approved what when under which rule, is not stated there. That history is exactly the part a tax audit wants to see, and the duty to retain it stays with the company for ten years under section 147 of the German Fiscal Code (Abgabenordnung). The advertised ten-year archiving applies for the term of the contract; the access window afterwards is six weeks. Anyone switching therefore plans the replacement of the archive first and the new tool second.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedpublicly available, signed, version 1.10 of 19 November 2024Processing agreement version 1.10, signed on 19 November 2024: four named subprocessors with purpose and country, hosting in Frankfurt am Main, service provided exclusively within the European Union or European Economic Area, exclusion of general AI training, return or deletion after the order ends, a retention carve-out of up to ten years, and the technical and organisational measuresOpen sourceThe processing agreement is available as a signed file for download without a login, and its preamble describes it as an appendix to the user agreement and the terms of business. It is therefore tied to no tariff and to no enquiry. Attached are the technical and organisational measures plus a schedule of the categories of data processed. The named officer is the external data protection officer Ali Tschakari of Bitkom Servicegesellschaft mbH, reachable at datenschutz@candis.io.As of 2026-08-26 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, no condition attachedGermany, Frankfurt am MainProcessing agreement version 1.10, signed on 19 November 2024: four named subprocessors with purpose and country, hosting in Frankfurt am Main, service provided exclusively within the European Union or European Economic Area, exclusion of general AI training, return or deletion after the order ends, a retention carve-out of up to ten years, and the technical and organisational measuresOpen sourceClause 7.3 of the processing agreement names Amazon Web Services EMEA with the purpose of hosting in the Frankfurt data zone in Germany. Clause 7.4 stipulates that the contractually agreed service is provided exclusively in a member state of the European Union or the European Economic Area. This is tied to no tariff, and there is accordingly no choice to make either. The product page states the same thing in sales form.As of 2026-08-26 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a conditionfour named, with purpose and country, list dated 19 November 2024Processing agreement version 1.10, signed on 19 November 2024: four named subprocessors with purpose and country, hosting in Frankfurt am Main, service provided exclusively within the European Union or European Economic Area, exclusion of general AI training, return or deletion after the order ends, a retention carve-out of up to ten years, and the technical and organisational measuresOpen sourceClause 7.3 of the processing agreement lists four subprocessors with address and part-service: Amazon Web Services EMEA in Luxembourg for hosting in Frankfurt, Gini GmbH in Munich for reading out invoice data, Mailjet SAS in Paris for notifications, and Google Cloud EMEA in Dublin for the automatic distinction of document types. All four are based in the European Union. There is no maintained subprocessor page; the list exists only inside that contract file, and clause 7.2 points to that same list for changes. The condition follows from the date: the version is from 19 November 2024, while the vendor today advertises an interplay of its own software with unnamed AI providers. Before signing, the current version belongs on the table, checked against the marketing copy.As of 2026-08-26 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, no condition attachednone for the product, anchored in the contractProcessing on behalf of the vendor for its own website with transfers to the United States under the EU-US Data Privacy Framework, and no statement on customer content inside the productOpen sourceClause 7.4 of the processing agreement rules out relocation to a third country without the client's prior consent and requires the conditions of Articles 44 et seq. of the General Data Protection Regulation in that case. All four subprocessors sit inside the Union. The privacy policy has to be read separately from this: it expressly deals with visits to the website and lists numerous transfers to the United States there, based on the EU-US Data Privacy Framework, among others to Vercel, Google, Microsoft, Meta, Segment, Intercom and Salesforce. Those transfers concern visitors to the website and not the documents inside the product.As of 2026-08-26 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, no condition attachedgeneral training excluded by contract, learning within your own data does take placeProcessing agreement version 1.10, signed on 19 November 2024: four named subprocessors with purpose and country, hosting in Frankfurt am Main, service provided exclusively within the European Union or European Economic Area, exclusion of general AI training, return or deletion after the order ends, a retention carve-out of up to ten years, and the technical and organisational measuresOpen sourceClause 7.9 of the processing agreement permits the use of artificial intelligence and large language models only on condition that data processed within the contractual relationship is not used for general training, and it binds the processor with regard to every AI system it uses. That is the enforceable commitment. Alongside it, the vendor describes the system learning from the invoices of the individual company and recognising patterns after roughly thirty days, while cross-company training takes place neither technically nor legally. Together that reads: no training across customer boundaries, but learning inside your own data.As of 2026-08-26 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a conditiondeletion promised, access window quantified, the vendor's own retention left openNotice periods under clause 7.1, a six-week access window with deletion afterwards and paid extensions under clause 7.3, and the absence of any availability commitment under clause 8.2Open sourceThe period on the customer's side is quantified: six weeks from receipt of notice to download, deletion afterwards, extension in one-month steps against the monthly fee, per clause 7.3 of the terms of business. Clause 3.12 of the processing agreement promises return or deletion after the order ends, though on the client's request and without a period of its own. Clause 3.9 expressly carves out whatever the vendor continues to hold under its own statutory retention duties, naming up to ten years. What remains with the vendor once the six weeks expire, and when it disappears there, is not publicly determined.As of 2026-08-26 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, but unfavourablenone for the vendor itself, what is named belongs to the cloud operatorThird-party certificates and attestations help in choosing a system but do not bind the tax authority, margin number 180 of the German Federal Ministry of Finance letter of 28 November 2019, file reference IV A 4 - S 0316/19/10003 :001Open sourceNo attestation is named for the company itself, neither ISO/IEC 27001 nor an audit report under SOC 2. The product page cites ISO 27001 and SOC 2 expressly for the cloud operator, and the appendix to the processing agreement refers to Amazon Web Services documentation for physical access control to the server rooms. A sitemap of 434 addresses carries no security or trust page. The label GoBD-certified appears on the pricing page and the product page. The tax administration's own position belongs beside it: under margin number 180 of the German Federal Ministry of Finance letter of 28 November 2019, file reference IV A 4 - S 0316/19/10003 :001, third-party certificates or attestations may help in choosing a system but do not bind the tax authority. What is documented is the status as a licensed DATEV interface partner, which includes regular technical review by DATEV. It says nothing about information security.As of 2026-08-26 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, but unfavourableno statement on the regulation, self-description carries a contradictionDescription of the AI functions, storage in Frankfurt am Main, the cloud operator's certifications, the GoBD-certified label, statements on learning within your own data and on forgoing cross-company training, a saving of 13,500 to 34,000 euros a year and up to 91 per cent correctly recorded informationOpen sourceThe product contains an AI system within the meaning of Regulation 2024/1689, whose transparency duties under Article 50 have applied since 2 August 2026. The vendor mentions the regulation in no public document and names no certification under ISO/IEC 42001. In practice the labelling duty here mostly falls on the deploying company anyway, because the tool works inward and does not speak to end customers. The contradiction on the vendor's own AI page stands out: it says data capture uses large language models, and a few paragraphs later that hallucinations are a feature of generative models while its own AI works on a different basis. Anyone who has to set the labelling in their own house settles first which function runs on which model.As of 2026-08-26 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourabledescribed by the vendor, scope and period openProcessing agreement version 1.10, signed on 19 November 2024: four named subprocessors with purpose and country, hosting in Frankfurt am Main, service provided exclusively within the European Union or European Economic Area, exclusion of general AI training, return or deletion after the order ends, a retention carve-out of up to ten years, and the technical and organisational measuresOpen sourceThe appendix to the processing agreement names technical logging of data changes under input control, and logged and regularly evaluated transfer processes under transfer control. Visible inside the product are an export history for the DATEV interface and the approval trail on the individual document. Beyond that the vendor points to procedural documentation and an internal control system. What the log captures in detail, how long it is kept and whether it can be exported into your own systems appears in no public document. For a tool whose output ends up in a tax audit, this is the point somebody asks about later.As of 2026-08-26 |
What it really costs
Entry price
Three packages with published entry prices: Basis from 389 euros a month, Plus from 599 euros, Max from 789 euros. Billing runs on invoice or document volume; user count and number of legal entities are unlimited in every package. Setup, training, storage and support are included according to the vendor. Thirty days can be trialled free of charge.Entry prices of the three packages, billing by document volume, unlimited users and legal entities, included services, contract terms of twelve to thirty-six months, the figure of more than 10,000 companies, and the issuing of credit cards with Varengold BankOpen source
As of 2026-08-26
What gets expensive
In three places. First the document volume, because that is what the price hangs on: uploaded invoices and contracts are billed, attachments such as quotes and delivery notes stay free. Anyone who does not know their own volume does not know their price. Second the package that holds the group-scale function: sign-in through your own identity provider starts at the Max plan, and the jump there from Basis roughly doubles the base price. Third the commitment. Two statements about the term diverge: the pricing page names twelve, twenty-four or thirty-six months with three months' notice, while clause 7.1 of the terms of business names two months to the end of the billing cycle for annual base prices and four weeks to month end for monthly ones. Both were retrieved on 26 August 2026. Which one applies belongs in the order form.
What it displaces
- Carrying invoices through the building on paper or as attachments and getting them approved by email
- Tracking approvals in shared mailboxes and spreadsheets
- Keying document data for the tax adviser by hand
Interfaces
- DATEV Unternehmen online and DATEV Rechnungswesen as a licensed interface partner, with postings and master data added for Rechnungswesen
- SAP Business One with document data export and reconciliation of master data and purchase orders
- Microsoft Dynamics 365 Business Central, Sage 100, Sesamsoft, Addison OneClick and Agenda
- Its own programming interface for systems that are not listed
- Notifications and approval requests into Slack and Microsoft Teams
- Corporate Visa credit cards issued together with Varengold Bank in Hamburg
- Download of the content and documents put in, for six weeks after notice of termination
Matching methods
- Constraint Detection (Five-Layer Scan)The method looks for the layer where work actually stalls. This tool pays off precisely when the bottleneck sits in approval rather than in posting itself or in the question of who is allowed to order at all.
- Regulatory Density TestThe process carries retention and evidence duties from German tax law, and the method measures how much of that sits on a given run. That density is exactly what decides against building it yourself here.
- Randomized Measurement of AI Productivity GainsThe vendor puts the saving at 13,500 to 34,000 euros a year and data capture at up to 91 per cent correctly recorded information. The method describes how to measure figures like that in your own operation instead of taking them from the sales deck.
- Operating Model Grid (Standardization and Integration)The method separates standardisation from integration, and that is what the decision turns on here: the accounting system stays the system of record, while only the document's path up to approval gets standardised.
Sources
- 1.Legal form, registered office, register court and number, managing directors, VAT identification number and the named data protection officer (opens in a new tab)candis.io/impressum · As of 2026-08-26
- 2.First registration on 19 June 2015, filed annual accounts for 2017 to 2024 with the 2024 accounts submitted on 1 June 2026, share capital of 169,685 euros as at 22 August 2023 (opens in a new tab)northdata.de/Candis+GmbH,+Berlin/HRB+168078 · As of 2026-08-26
- 3.Processing agreement version 1.10, signed on 19 November 2024: four named subprocessors with purpose and country, hosting in Frankfurt am Main, service provided exclusively within the European Union or European Economic Area, exclusion of general AI training, return or deletion after the order ends, a retention carve-out of up to ten years, and the technical and organisational measures (opens in a new tab)assets.ctfassets.net/…/DPA_1.10_candis.io.pdf · As of 2026-08-26
- 4.Notice periods under clause 7.1, a six-week access window with deletion afterwards and paid extensions under clause 7.3, and the absence of any availability commitment under clause 8.2 (opens in a new tab)candis.io/agb · As of 2026-08-26
- 5.Entry prices of the three packages, billing by document volume, unlimited users and legal entities, included services, contract terms of twelve to thirty-six months, the figure of more than 10,000 companies, and the issuing of credit cards with Varengold Bank (opens in a new tab)candis.io/preise · As of 2026-08-26
- 6.Description of the AI functions, storage in Frankfurt am Main, the cloud operator's certifications, the GoBD-certified label, statements on learning within your own data and on forgoing cross-company training, a saving of 13,500 to 34,000 euros a year and up to 91 per cent correctly recorded information (opens in a new tab)candis.io/candis-ki · As of 2026-08-26
- 7.Processing on behalf of the vendor for its own website with transfers to the United States under the EU-US Data Privacy Framework, and no statement on customer content inside the product (opens in a new tab)candis.io/datenschutz · As of 2026-08-26
- 8.Sign-in via SAML with Entra ID or Google from the Max plan onwards and only after a request to the vendor (opens in a new tab)hilfe.candis.io/de/articles/573852-single-sign-on-sso · As of 2026-08-26
- 9.Public status page with ninety-day uptime figures per component (opens in a new tab)status.my.candis.io · As of 2026-08-26
- 10.Licensed DATEV interface partner with regular technical review by DATEV, export history, and the scope of the interfaces to DATEV Unternehmen online and DATEV Rechnungswesen (opens in a new tab)candis.io/produkt/schnittstellen-und-exporte · As of 2026-08-26
- 11.Multi-step approval rules by amount threshold, approval groups, deputy arrangements during absences, and individually assigned access rights (opens in a new tab)candis.io/produkt/rechnungsfreigabe · As of 2026-08-26
- 12.Third-party certificates and attestations help in choosing a system but do not bind the tax authority, margin number 180 of the German Federal Ministry of Finance letter of 28 November 2019, file reference IV A 4 - S 0316/19/10003 :001 (opens in a new tab)haufe.de/… · As of 2026-08-26
- 13.A funding round of EUR 12 million on 30 July 2020 led by Viola Ventures together with the other participating investors (opens in a new tab)prnewswire.com/… · As of 2026-08-26
- 14.A funding round of USD 16 million on 14 September 2022 with Viola Fintech, Lightspeed and Viola Ventures, plus USD 30 million across two rounds (opens in a new tab)deutsche-startups.de/2022/09/14/dealmonitor-riskmethods-candis · As of 2026-08-26
- 15.No subprocessor page and no security or trust page anywhere in the vendor's own sitemap of 434 addresses (opens in a new tab)candis.io/sitemap.xml · As of 2026-08-26
Last reviewed: 2026-08-26 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.