Efficiency onlyOff-the-shelf productEstablished, AI retrofitted

Circula

Circula GmbH, Berlin ·www.circula.com· As of: 2026-09-16

Captures employees' travel costs, out-of-pocket expenses and card transactions in an app, calculates meal and mileage allowances under German tax law, runs each submission through approval and review, and hands the result to DATEV, payroll or another accounting system.

Work through this tool with an AI

ClaudeChatGPTPerplexity

Our verdict

Travel expense reporting is mandatory work that no customer ever sees. Speeding it up saves hours in accounting and minutes per trip for employees, and it lowers the risk that a tax audit objects to allowances or input tax. It opens no gap to competitors, because every competitor can order the same licence. The benefit hangs on two numbers you can count before buying: how many trips and receipts arise each month and how many people touch a claim today. That keeps it efficiency in a single case. One special case deserves attention: anyone still working with DATEV Reisekosten classic faces a switch anyway, and the vendor describes itself as that product's successor.

Evidence:As of 2026-09-16Legal form, registered office, register court and number, managing directors and VAT identification numberOpen sourceAs of 2026-09-16First registration on 9 February 2017 as Beckett Labs GmbH, share capital development up to 122,845 euros as at 3 June 2025, annual accounts for 2022 and 2023 submitted on 18 and 19 December 2025Open sourceAs of 2026-09-16Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex IOpen sourceAs of 2026-09-16Terms of business dated 20 February 2026: minimum term of one year with automatic renewal and one month's notice, annual price adjustment in line with costs, error classes with a four-hour response time, liability cap of 10,000 euros per case and 100,000 euros in total, return and deletion without any provision for the customer pulling out its data, a separate processing agreement, credit cards through PliantOpen sourceAs of 2026-09-16Privacy policy version 2.4 of 23 March 2026: processing as the vendor's own controllership for admin accounts with transfers to Omni Analytics and Metabase in the United States, Sentry for error tracking with 90-day deletion, PostHog for session recordings with three months, HubSpot for product updates, an external data protection officer through Simpliant, and a reference to certified serversOpen sourceAs of 2026-09-16Entry prices of the four packages, licences only in active months, a minimum of ten licences, add-ons without published prices, a two per cent card exchange fee, DATEV premium partner and successor to DATEV Reisekosten classic by the vendor's own account, more than 2,800 companies by the vendor's own accountOpen sourceAs of 2026-09-16Feature overview: SSO through Google, Okta, Microsoft Entra ID, OneLogin and JumpCloud as a free setup, several entities, day tours, archive and CO2 report as paid add-ons, export formats and bulk export in the standard package, chargeable export and interface customisations, SAP S/4HANA and the AI programme in betaOpen sourceAs of 2026-09-16AI functions using large language models, category prediction from patterns within the company, processing only in the EU, no training on customer data, 24-hour retention, responsibility remains with the companyOpen sourceAs of 2026-09-16Hosting on AWS servers in Germany according to the data protection help pageOpen sourceAs of 2026-09-16GoBD archiving through DATEV Belege online or as an optional service from a software partnerOpen sourceAs of 2026-09-16Certificate under IDW PS 880 for the travel expense capture software version 6.5, audit report dated 22 August 2025, Eger, Färber & Kollegen, audit criteria and reference to the software attestation reportOpen sourceAs of 2026-09-16Self-disclosure on the integrated management system following the requirements of the GDPR and ISO 27001, and link to the GoBD certificateOpen sourceAs of 2026-09-16Financing of a double-digit million amount on 24 January 2022 with Alstin Capital, Personio, Peak Capital, Storm Ventures and Capnamic, around 50 employeesOpen sourceAs of 2026-09-16Extended Series A round of EUR 15 million on 7 May 2025 with the existing backers and CIBC Innovation Banking, and the vendor's claim of an average 80 per cent less manual effortOpen sourceAs of 2026-09-16Vendor announcement of 20 March 2024 with a new leadership team and more than 1,700 customersOpen sourceAs of 2026-09-16DATEV lists the vendor as the cloud solution of a DATEV Marketplace premium partner on its own travel expense management pageOpen sourceAs of 2026-09-16No security, trust or subprocessor page in the vendor's sitemap of 538 addressesOpen sourceAs of 2026-09-16Third-party certificates and attestations help in choosing a system but do not bind the tax authority, margin number 180 of the German Federal Ministry of Finance letter of 28 November 2019Open source

Who it fits

Solo

not suitable

The pricing page names a minimum of ten licences at 15 euros each per month on annual billing, so a floor of 150 euros a month and 1,800 euros a year, tied to a minimum term of one year. For small teams the vendor points to special models that are not published. Anyone claiming three trips a quarter gets further with the tax adviser's expense form and DATEV Belege online.

Mid-market

suitable

This is where the fit sits. Licences only fall due for months in which someone actually submits, approves or reviews, which keeps occasional travellers cheap. According to the feature overview, exports to DATEV Unternehmen online, DATEV Kanzlei-Rechnungswesen, LODAS and Lohn und Gehalt are part of the standard package, the vendor is a DATEV premium partner, and employee master data can be taken over from Personio. Sign-in through Google, Okta, Microsoft Entra ID, OneLogin or JumpCloud is set up by the vendor at no extra charge according to the same overview. One question belongs on the table before signing: where the receipts sit in audit-proof form for ten years, because the archive is a paid add-on or runs through DATEV Belege online.

Enterprise

suitable with caveats

Four documented points hold it back. First, managing several legal entities in one account is a paid add-on, and the connection to SAP S/4HANA is listed as beta in the feature overview. Second, the terms of business cap the typical foreseeable damage for a slightly negligent breach of a cardinal duty at 10,000 euros per case and 100,000 euros in total. Third, fixing business-stopping errors comes with a four-hour response time, measured against normal working hours of eight to five on weekdays. Fourth, no ISO/IEC 27001 certification is documented for the vendor itself, and an audit log customers can evaluate is not publicly described. Anyone buying to a group standard negotiates liability, logging and the multi-entity price before signing.

Buy, switch or build

Off-the-shelf

Stay with the accounting system or the group-wide tool

In the German mid-market the classic route was DATEV Reisekosten classic, and that route now leads to this vendor: it describes itself as the successor, and DATEV lists it as a premium partner on its own travel expense page. In large groups SAP Concur remains the counterpart, because it bundles travel booking, expense reporting and the SAP connection in one contract, knows subsidiaries worldwide and has long been listed with procurement. The price is implementation effort and an interface employees rarely like. Anyone with SAP as system of record and many countries to settle usually stays there while the vendor's SAP connector is still in beta.

AI-native

Take a card-first spend tool with AI receipt capture

Pleo and Moss come from the corporate card: spending arises on the card, the receipt is matched by photo and text recognition, and out-of-pocket expenses are the exception. That fits where most spending runs through cards anyway, and it is often quicker to roll out. A tool built around a language model from the ground up that keeps pace with German travel expense law is not publicly visible in this cluster. What you give up with the card vendors is depth in travel expense law: meal allowances, the midnight rule, the three-month rule and payroll exports to LODAS are this vendor's core. So the first thing to check is what share of claims comes from multi-day business trips.

Build it yourself

Build the expense run yourself

The run looks small: collect the receipt by photo or email, read out the fields, record the trip with start and end, calculate allowances, route it to the line manager for approval, hand the posting to DATEV and the wage type to LODAS. You build it with Claude Code as the build tool, n8n for the process chain, LiteLLM as the model gateway, Langfuse for the evaluation loop on extraction quality and Supabase for data and receipt storage. At 20 person-days and 1,200 euros a day that is roughly 24,000 euros one-off against at least 1,800 euros a year for ten licences. The arithmetic tips in two places, and neither is the build. The first is rule maintenance: the Federal Ministry of Finance's foreign allowances change every year, plus the midnight rule, the three-month rule, deductions for meals provided and benefit-in-kind values, and every change has to be in the code on time. The second is evidence: ten years of audit-proof storage, procedural documentation and a log that survives a payroll tax audit, without an auditor ever having attested your own run. It pays off when an industry rule is the core, for instance field-service day tours with their own logic. For the ordinary business trip it does not.

Our advice

  • Solo: Do not buy. Ten minimum licences do not pay for themselves at a few trips a quarter; a form and DATEV Belege online are enough.
  • Mid-market: A fit, especially when moving off DATEV Reisekosten classic. Settle first where the archive lives, and have the prices of the add-ons you need written into the quote.
  • Enterprise: Only worth a serious look when DATEV carries the accounting. Put the liability cap, log access, the multi-entity price and the status of the SAP connector in writing before signing.

Who is behind it

Staying power: Established

The company has been on the commercial register since 9 February 2017, initially under the name Beckett Labs GmbH, and has therefore been in the market for more than nine years. Share capital was raised in several steps from 25,000 euros to 122,845 euros as at 3 June 2025. Annual accounts for 2022 and 2023 are on file, submitted on 18 and 19 December 2025. Two financings are documented with dates, the more recent from 7 May 2025. The customer count by the vendor's own account rose from more than 1,700 in March 2024 to more than 2,800 in September 2026.

  • Legal entity and commercial register: Circula GmbH, Oranienburger Strasse 74, 10117 Berlin, local court (Amtsgericht) Charlottenburg HRB 183803 B, managing directors Roman Leicht and Nikolai Skatchkov, VAT identification number DE311355971As of 2026-09-16Legal form, registered office, register court and number, managing directors and VAT identification numberOpen source · As of 2026-09-16
  • First registration, share capital and filed accounts: First registered on 9 February 2017 as Beckett Labs GmbH; share capital of 25,000 euros at founding, 122,845 euros as at 3 June 2025; annual accounts for 2022 and 2023 submitted on 18 and 19 December 2025As of 2026-09-16First registration on 9 February 2017 as Beckett Labs GmbH, share capital development up to 122,845 euros as at 3 June 2025, annual accounts for 2022 and 2023 submitted on 18 and 19 December 2025Open source · As of 2026-09-16
  • Funding round 2022: a double-digit million amount, reported on 24 January 2022, with Alstin Capital, Personio, Peak Capital and Storm Ventures plus the existing backer Capnamic; the report cites around 50 employeesAs of 2026-09-16Financing of a double-digit million amount on 24 January 2022 with Alstin Capital, Personio, Peak Capital, Storm Ventures and Capnamic, around 50 employeesOpen source · As of 2026-09-16
  • Extended funding round 2025: EUR 15 million in an extended Series A round, vendor announcement of 7 May 2025, led by the existing backers Alstin Capital, Capnamic Ventures, Peak Capital, Wenvest Capital and Storm Ventures together with CIBC Innovation Banking; the announcement does not state which part comes as equity and which as debtAs of 2026-09-16Extended Series A round of EUR 15 million on 7 May 2025 with the existing backers and CIBC Innovation Banking, and the vendor's claim of an average 80 per cent less manual effortOpen source · As of 2026-09-16
  • Audit under IDW PS 880: Certificate for the travel expense capture software version 6.5, audited under IDW PS 880 against IDW RS FAIT 1 and 3, GoB, GoBD, IDW PS 330 and data protection law, audit report dated 22 August 2025, issued by Eger, Färber & Kollegen Wirtschaftsprüfungs und Beratungs GmbH, RosenheimAs of 2026-09-16Certificate under IDW PS 880 for the travel expense capture software version 6.5, audit report dated 22 August 2025, Eger, Färber & Kollegen, audit criteria and reference to the software attestation reportOpen source · As of 2026-09-16
  • Customer count by the vendor's own account, two dates: more than 1,700 customers per the vendor announcement of 20 March 2024; more than 2,800 companies per the pricing page on 16 September 2026; neither figure states a methodologyAs of 2026-09-16Vendor announcement of 20 March 2024 with a new leadership team and more than 1,700 customersOpen source · As of 2026-09-16

Cost of leaving: Moderate

Posting data is the smaller problem. Anyone exporting through the DATEV route has postings and receipt images flowing continuously into DATEV Unternehmen online, and that is where they stay after a switch. On top of that, the feature overview offers standard exports as CSV and PDF, a receipt archive as PDF or in the original format, and a bulk export for entire financial years. Three things still make switching dearer than an export suggests. First, the section of the terms of business on return and deletion only rules that the customer hands back the software; a period in which the customer can still pull out its own data after notice does not appear there. Clause 10 d of the processing agreement promises deletion or return at the customer's choice after the contract ends, with no period. Second, ten-year archiving under the German bookkeeping rules (GoBD) sits only in the paid add-on with the partner Accantum or in DATEV, not in the base licence. Third, the real effort lies in configuration: travel policies, approval routes, cost-centre logic and customised DATEV exports get rebuilt in the new tool. Anyone switching runs the bulk export before the one-month notice period ahead of the annual term end and settles in writing where the archive lives afterwards.

Regulation and data

How to read the traffic lightHow to read the traffic lightThe traffic light rates how well a point is evidenced, not how good the tool is. It draws only on the value, note and source held in the profile. Where a statement is missing, it rates the absence, not a guess. A well-reasoned "unclear" on a point that matters little for this tool is yellow. A missing source on a point that decides whether you can use it at all is red.documented, no condition attacheddocumented, tied to a conditiondocumented, but unfavourableopen on a point that decides usability
Data processing agreementScale for this point: Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann.documented, no condition attachedpublicly available as EU standard contractual clauses under Article 28, version 2.7As of 2026-09-16Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex IOpen sourceThe processing agreement is linked from the legal page as a file without a login and follows the European Commission's standard contractual clauses under Article 28(7) of the General Data Protection Regulation, supplemented by a commitment to the Swiss data protection act. The terms of business provide for a separate agreement in the section on confidentiality and data protection, and it is tied to no tariff. Three inconsistencies in the file belong on the checklist before signing: the file name says version 2.5 while the document itself says version 2.7; Annex I still lists the processor at the former address Schönhauser Allee 148; and it names Boris Arendt as data protection officer, whereas the privacy policy of 23 March 2026 names an external officer provided through Simpliant.As of 2026-09-16
Storage locationScale for this point: Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt.documented, no condition attachedEuropean Union, operated on Amazon Web Services, in Germany according to the help pagesAs of 2026-09-16Hosting on AWS servers in Germany according to the data protection help pageOpen sourceAnnex III of the processing agreement states that the vendor runs no data centres of its own, that the platform runs on Amazon Web Services EMEA SARL and that processing takes place within the European Union, encrypted in transit and at rest. Annex IV names the EU as the place of processing for every subprocessor. The data protection help page goes further and names servers in Germany. What is contractually committed is the European Union; Germany appears only on the help page. There is no tariff attached and no choice to make.As of 2026-09-16
SubprocessorsScale for this point: Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren.documented, tied to a conditioneight named with purpose and location in the contract, further services inside the product only in the privacy policyAs of 2026-09-16Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex IOpen sourceAnnex IV of the processing agreement lists eight subprocessors with address, service, data category and EU place of processing: Amazon Web Services for hosting, Intercom for customer enquiries, Mailjet for transactional email, Mindee for reading receipts, Accantum for the archive in the add-on module, MessageBird for text messages used in two-factor sign-in, Google Ireland for AI extraction via Vertex AI, and torq.partners Finance for onboarding services. The condition comes from comparing it with the privacy policy. That document names services running inside the product itself that are missing from Annex IV, because the vendor treats them as its own controllership: Sentry for error tracking in the web application, PostHog for session recordings after consent, Omni Analytics and Metabase for admin account data, and HubSpot for product updates. Anyone who has to verify that no receipt data leaks through those services has only the vendor's own classification to go on publicly.As of 2026-09-16
Third-country transferScale for this point: Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt.documented, tied to a conditionnone for receipt data per the contract, transfers to the United States for app usage dataAs of 2026-09-16Privacy policy version 2.4 of 23 March 2026: processing as the vendor's own controllership for admin accounts with transfers to Omni Analytics and Metabase in the United States, Sentry for error tracking with 90-day deletion, PostHog for session recordings with three months, HubSpot for product updates, an external data protection officer through Simpliant, and a reference to certified serversOpen sourceFor customer content the position is clear: Annex IV of the processing agreement names the EU as place of processing for every subprocessor, and Annex II expressly restricts AI extraction via Vertex AI to the Union. Alongside this, the privacy policy of 23 March 2026 describes a separate area in which the vendor is itself controller for the app. There, name, company, email address and usage data of admin accounts go to Omni Analytics and Metabase in the United States, error data from the web application to Sentry and data for product updates to HubSpot, each based on the EU-US Data Privacy Framework and on standard contractual clauses; for Metabase the policy names standard contractual clauses only. The grounds are named per recipient, but these transfers sit outside the contract with the customer, and what an error report from the web application carries with it is not publicly described.As of 2026-09-16
Training on customer dataScale for this point: Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt.documented, no condition attachedexcluded by contract, including the model providerAs of 2026-09-16Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex IOpen sourceAnnex II of the processing agreement describes the AI functions, meaning extraction of receipt fields, enrichment with category and cost centre, and checks against policies, and names Google Cloud Vertex AI as the primary provider with processing exclusively in the European Union. It states that customer data is never used to train models, that retention at the model provider is limited to 24 hours, and that further AI services may only be added under the same commitments. The AI help page repeats this. Alongside, it describes category prediction learning from historical spending patterns within the company. Together that reads: no third-party model is trained on customer data, and learning within your own data does take place.As of 2026-09-16
Retention and deletionScale for this point: Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung.documented, tied to a conditiondeletion or return after the contract ends promised, with no periodAs of 2026-09-16Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex IOpen sourceClause 10 d of the processing agreement promises deletion with certification, or return, at the customer's choice after the contract ends, unless a statutory retention duty applies. Annex II adds that the retention period is generally up to ten years, that receipts are therefore only deleted on express instruction, and that user accounts are deleted after the contract ends. That leaves only side areas quantified: 24 hours at the AI provider, 90 days for error data at Sentry and three months for session recordings according to the privacy policy. A period within which receipts disappear from the vendor after notice appears in no public document, and the terms of business name no access window for the customer either.As of 2026-09-16
CertificationsScale for this point: Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden.documented, tied to a conditionsoftware attestation under IDW PS 880 dated 22 August 2025; no ISO/IEC 27001 certification for the vendorAs of 2026-09-16Certificate under IDW PS 880 for the travel expense capture software version 6.5, audit report dated 22 August 2025, Eger, Färber & Kollegen, audit criteria and reference to the software attestation reportOpen sourceOne attestation is documented with standard, auditor and date: the certificate linked from the compliance page confirms that the travel expense capture software in version 6.5 was audited under IDW PS 880 against IDW RS FAIT 1 and 3, GoB, GoBD, IDW PS 330 and data protection law, with an audit report dated 22 August 2025 by Eger, Färber & Kollegen in Rosenheim. The certificate itself refers to notes in the software attestation report, and that report is not publicly available. The certificate still shows the former address on Schönhauser Allee. On information security there is only self-disclosure: the vendor says it runs an integrated management system covering the requirements of ISO 27001, oriented on that standard's structure according to Annex III. The mention of certified servers in the privacy policy refers to the cloud operator. Under margin number 180 of the German Federal Ministry of Finance letter on the GoBD, third-party attestations can help in choosing a system but do not bind the tax authority.As of 2026-09-16
EU AI Act, Article 50Scale for this point: EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen.documented, tied to a conditionno statement on the regulation, the AI works inward and is described in the contractAs of 2026-09-16AI functions using large language models, category prediction from patterns within the company, processing only in the EU, no training on customer data, 24-hour retention, responsibility remains with the companyOpen sourceThe product contains an AI system within the meaning of Regulation 2024/1689: the help pages name large language models for receipt capture, plus category prediction, duplicate detection and an address check in beta. The vendor mentions the regulation itself in none of the documents read and names no certification under ISO/IEC 42001. Toward employees and accounting the functions appear as suggestions that can be changed before submission, and they do not speak to end customers. The help page states that approvals and responsibility stay with the company. Annex II of the processing agreement describes purpose, data categories and model provider of the AI processing, which gives a usable basis for your own documentation.As of 2026-09-16
Audit loggingScale for this point: Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält.documented, but unfavourabledescribed by the vendor, a log customers can evaluate is not publicly documentedAs of 2026-09-16Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex IOpen sourceAnnex III of the processing agreement states under input control that every change to data in the production system is logged with time, user and changed value, and under access control that successful and attempted access is logged. That describes the vendor's side. Whether customers can view or export a change log, how long it is kept and what it covers appears neither in the feature overview nor on the help pages read. The IDW PS 880 certificate supports the regularity of processing but does not replace this information. Because the output flows into payroll and financial accounting, a written answer on this belongs before the signature.As of 2026-09-16

What it really costs

Entry price

Four packages with published entry prices per month on annual billing: expenses and travel from 15 euros per licence, corporate cards from a 99-euro platform price with unlimited cards, incoming invoices from 149 euros including 100 invoices, employee benefits from 1 euro per licence. A licence only falls due for months in which someone submits, approves, reviews or creates a report, with a minimum of ten licences. A free trial is offered.As of 2026-09-16Entry prices of the four packages, licences only in active months, a minimum of ten licences, add-ons without published prices, a two per cent card exchange fee, DATEV premium partner and successor to DATEV Reisekosten classic by the vendor's own account, more than 2,800 companies by the vendor's own accountOpen source

As of 2026-09-16

What gets expensive

In four places. First the add-ons whose prices are not published: the GoBD archive, management of several legal entities, day tours, the CO2 report and extended support. Anyone with several entities and no DATEV archive only learns the price from the quote. Second customisations to exports and interfaces: according to the feature overview, changed DATEV posting texts, SFTP exports, Business Central and Diamant are chargeable and some only available above a certain customer size, and the AI programme is due to become chargeable after its beta phase. Third the card: a two per cent fee applies on top of the VISA exchange rate. Fourth the commitment. The contract runs for one year and renews for a further year each time unless notice is given one month before expiry, and the terms of business allow a price adjustment at most once per calendar year in line with the vendor's own costs.

What it displaces

  • Travel expense claims in spreadsheets with paper receipts stapled on
  • Recalculating meal allowances and mileage by hand
  • Keying receipts and wage types into DATEV and payroll
  • Managing meal subsidies and benefits in kind with paper vouchers or spreadsheets

Interfaces

  • DATEV Unternehmen online and DATEV Kanzlei-Rechnungswesen for financial accounting, by direct transfer or file
  • DATEV LODAS and DATEV Lohn und Gehalt for payroll, plus DATEV Eigenorganisation comfort
  • Microsoft Dynamics 365 Business Central via a connector from Finclair, chargeable; ADDISON OneClick, Diamant and Exact Online
  • SAP S/4HANA as a beta connection
  • Personio for employee master data
  • Lanes & Planes, Perk and Onesto for travel bookings
  • Corporate credit cards through Pliant, issued by Pliant Oy in Helsinki
  • Sign-in via Google, Okta, Microsoft Entra ID, OneLogin and JumpCloud
  • Exports as CSV, PDF, SEPA and receipt archive, plus bulk export of entire financial years

Matching methods

  • Constraint Detection (Five-Layer Scan)The method looks for the layer where work actually stalls. The tool pays off when the bottleneck lies in capturing and recalculating trips, and less so when claims mainly sit waiting for approval.
  • Regulatory Density TestTravel expenses carry allowances, payroll tax consequences and retention duties at once. The method measures that density, and here it decides against building in-house, because annual rule maintenance is the expensive part.
  • Operating Model Grid (Standardization and Integration)The method separates standardisation from integration. What gets standardised is how a trip is claimed, while DATEV or SAP stay integrated as systems of record, and that seam is exactly where the chargeable export customisations arise.
  • Randomized Measurement of AI Productivity GainsThe vendor puts the relief at an average 80 per cent less manual effort. The method describes how to measure a figure like that in your own house, for instance with a group that keeps claiming on the old form.

Sources

  1. 1.Legal form, registered office, register court and number, managing directors and VAT identification number (opens in a new tab)circula.com/de/impressum · As of 2026-09-16
  2. 2.First registration on 9 February 2017 as Beckett Labs GmbH, share capital development up to 122,845 euros as at 3 June 2025, annual accounts for 2022 and 2023 submitted on 18 and 19 December 2025 (opens in a new tab)northdata.de/Circula+GmbH,+Berlin/HRB+183803+B · As of 2026-09-16
  3. 3.Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex I (opens in a new tab)cdn.prod.website-files.com/… · As of 2026-09-16
  4. 4.Terms of business dated 20 February 2026: minimum term of one year with automatic renewal and one month's notice, annual price adjustment in line with costs, error classes with a four-hour response time, liability cap of 10,000 euros per case and 100,000 euros in total, return and deletion without any provision for the customer pulling out its data, a separate processing agreement, credit cards through Pliant (opens in a new tab)circula.com/de/agb · As of 2026-09-16
  5. 5.Privacy policy version 2.4 of 23 March 2026: processing as the vendor's own controllership for admin accounts with transfers to Omni Analytics and Metabase in the United States, Sentry for error tracking with 90-day deletion, PostHog for session recordings with three months, HubSpot for product updates, an external data protection officer through Simpliant, and a reference to certified servers (opens in a new tab)circula.com/de/datenschutz · As of 2026-09-16
  6. 6.Entry prices of the four packages, licences only in active months, a minimum of ten licences, add-ons without published prices, a two per cent card exchange fee, DATEV premium partner and successor to DATEV Reisekosten classic by the vendor's own account, more than 2,800 companies by the vendor's own account (opens in a new tab)circula.com/de/preise · As of 2026-09-16
  7. 7.Feature overview: SSO through Google, Okta, Microsoft Entra ID, OneLogin and JumpCloud as a free setup, several entities, day tours, archive and CO2 report as paid add-ons, export formats and bulk export in the standard package, chargeable export and interface customisations, SAP S/4HANA and the AI programme in beta (opens in a new tab)help.circula.com/…/662053-circula-funktionen-im-uberblick · As of 2026-09-16
  8. 8.AI functions using large language models, category prediction from patterns within the company, processing only in the EU, no training on customer data, 24-hour retention, responsibility remains with the company (opens in a new tab)help.circula.com/de/articles/533930-wie-circula-ki-funktioniert · As of 2026-09-16
  9. 9.Hosting on AWS servers in Germany according to the data protection help page (opens in a new tab)help.circula.com/de/articles/279521-datenschutz · As of 2026-09-16
  10. 10.GoBD archiving through DATEV Belege online or as an optional service from a software partner (opens in a new tab)help.circula.com/…/279448-dokumentenmanagementsystem-dms · As of 2026-09-16
  11. 11.Certificate under IDW PS 880 for the travel expense capture software version 6.5, audit report dated 22 August 2025, Eger, Färber & Kollegen, audit criteria and reference to the software attestation report (opens in a new tab)drive.google.com/…/view?usp=sharing · As of 2026-09-16
  12. 12.Self-disclosure on the integrated management system following the requirements of the GDPR and ISO 27001, and link to the GoBD certificate (opens in a new tab)circula.com/de/compliance · As of 2026-09-16
  13. 13.Financing of a double-digit million amount on 24 January 2022 with Alstin Capital, Personio, Peak Capital, Storm Ventures and Capnamic, around 50 employees (opens in a new tab)financefwd.com/de/circula-finanzierung · As of 2026-09-16
  14. 14.Extended Series A round of EUR 15 million on 7 May 2025 with the existing backers and CIBC Innovation Banking, and the vendor's claim of an average 80 per cent less manual effort (opens in a new tab)circula.com/… · As of 2026-09-16
  15. 15.Vendor announcement of 20 March 2024 with a new leadership team and more than 1,700 customers (opens in a new tab)circula.com/…/circula-on-course-for-transformation-and-growth · As of 2026-09-16
  16. 16.DATEV lists the vendor as the cloud solution of a DATEV Marketplace premium partner on its own travel expense management page (opens in a new tab)datev.de/…/software-reisekostenmanagement · As of 2026-09-16
  17. 17.No security, trust or subprocessor page in the vendor's sitemap of 538 addresses (opens in a new tab)circula.com/sitemap.xml · As of 2026-09-16
  18. 18.Third-party certificates and attestations help in choosing a system but do not bind the tax authority, margin number 180 of the German Federal Ministry of Finance letter of 28 November 2019 (opens in a new tab)haufe.de/… · As of 2026-09-16

Last reviewed: 2026-09-16 by Dr. Oliver Gausmann, Convios GmbH

Details out of date? Let us know.

From tool to decision

The offer that fits this tool

A tool profile tells you what the tool does and what it means for compliance. Whether it gets priority in your company is a management decision, and it takes one working day: the executive AI workshop ranks your initiatives by business value, risk, data readiness and ownership.

See the executive AI workshopCalculate cost per solved task
← Back to the toolbox