# Circula

> Captures employees' travel costs, out-of-pocket expenses and card transactions in an app, calculates meal and mileage allowances under German tax law, runs each submission through approval and review, and hands the result to DATEV, payroll or another accounting system.

- Vendor: Circula GmbH, Berlin
- Canonical URL: https://www.convios.com/en/toolbox/circula
- Language version: https://www.convios.com/de/werkzeugkasten/circula
- Area: Operations & finance · Cluster: travel expenses and benefits
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-09-16 · Reviewed: 2026-09-16 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Efficiency only: Travel expense reporting is mandatory work that no customer ever sees. Speeding it up saves hours in accounting and minutes per trip for employees, and it lowers the risk that a tax audit objects to allowances or input tax. It opens no gap to competitors, because every competitor can order the same licence. The benefit hangs on two numbers you can count before buying: how many trips and receipts arise each month and how many people touch a claim today. That keeps it efficiency in a single case. One special case deserves attention: anyone still working with DATEV Reisekosten classic faces a switch anyway, and the vendor describes itself as that product's successor.

## Suitability by company size

- Solo: not suitable — The pricing page names a minimum of ten licences at 15 euros each per month on annual billing, so a floor of 150 euros a month and 1,800 euros a year, tied to a minimum term of one year. For small teams the vendor points to special models that are not published. Anyone claiming three trips a quarter gets further with the tax adviser's expense form and DATEV Belege online.
- Mid-market: suitable — This is where the fit sits. Licences only fall due for months in which someone actually submits, approves or reviews, which keeps occasional travellers cheap. According to the feature overview, exports to DATEV Unternehmen online, DATEV Kanzlei-Rechnungswesen, LODAS and Lohn und Gehalt are part of the standard package, the vendor is a DATEV premium partner, and employee master data can be taken over from Personio. Sign-in through Google, Okta, Microsoft Entra ID, OneLogin or JumpCloud is set up by the vendor at no extra charge according to the same overview. One question belongs on the table before signing: where the receipts sit in audit-proof form for ten years, because the archive is a paid add-on or runs through DATEV Belege online.
- Enterprise: suitable with caveats — Four documented points hold it back. First, managing several legal entities in one account is a paid add-on, and the connection to SAP S/4HANA is listed as beta in the feature overview. Second, the terms of business cap the typical foreseeable damage for a slightly negligent breach of a cardinal duty at 10,000 euros per case and 100,000 euros in total. Third, fixing business-stopping errors comes with a four-hour response time, measured against normal working hours of eight to five on weekdays. Fourth, no ISO/IEC 27001 certification is documented for the vendor itself, and an audit log customers can evaluate is not publicly described. Anyone buying to a group standard negotiates liability, logging and the multi-entity price before signing.

## Vendor staying power

Established: The company has been on the commercial register since 9 February 2017, initially under the name Beckett Labs GmbH, and has therefore been in the market for more than nine years. Share capital was raised in several steps from 25,000 euros to 122,845 euros as at 3 June 2025. Annual accounts for 2022 and 2023 are on file, submitted on 18 and 19 December 2025. Two financings are documented with dates, the more recent from 7 May 2025. The customer count by the vendor's own account rose from more than 1,700 in March 2024 to more than 2,800 in September 2026.

- Legal entity and commercial register: Circula GmbH, Oranienburger Strasse 74, 10117 Berlin, local court (Amtsgericht) Charlottenburg HRB 183803 B, managing directors Roman Leicht and Nikolai Skatchkov, VAT identification number DE311355971 (source: https://www.circula.com/de/impressum, as of 2026-09-16)
- First registration, share capital and filed accounts: First registered on 9 February 2017 as Beckett Labs GmbH; share capital of 25,000 euros at founding, 122,845 euros as at 3 June 2025; annual accounts for 2022 and 2023 submitted on 18 and 19 December 2025 (source: https://www.northdata.de/Circula+GmbH,+Berlin/HRB+183803+B, as of 2026-09-16)
- Funding round 2022: a double-digit million amount, reported on 24 January 2022, with Alstin Capital, Personio, Peak Capital and Storm Ventures plus the existing backer Capnamic; the report cites around 50 employees (source: https://financefwd.com/de/circula-finanzierung/, as of 2026-09-16)
- Extended funding round 2025: EUR 15 million in an extended Series A round, vendor announcement of 7 May 2025, led by the existing backers Alstin Capital, Capnamic Ventures, Peak Capital, Wenvest Capital and Storm Ventures together with CIBC Innovation Banking; the announcement does not state which part comes as equity and which as debt (source: https://www.circula.com/de/blog/circula-erhalt-15-millionen-euro-in-erweiterter-series-a-runde, as of 2026-09-16)
- Audit under IDW PS 880: Certificate for the travel expense capture software version 6.5, audited under IDW PS 880 against IDW RS FAIT 1 and 3, GoB, GoBD, IDW PS 330 and data protection law, audit report dated 22 August 2025, issued by Eger, Färber & Kollegen Wirtschaftsprüfungs und Beratungs GmbH, Rosenheim (source: https://drive.google.com/file/d/1kgIhBfyS-_vZOw4KNC4x7lakmurW73Ik/view?usp=sharing, as of 2026-09-16)
- Customer count by the vendor's own account, two dates: more than 1,700 customers per the vendor announcement of 20 March 2024; more than 2,800 companies per the pricing page on 16 September 2026; neither figure states a methodology (source: https://www.circula.com/en/blog/circula-on-course-for-transformation-and-growth, as of 2026-09-16)

## Cost of leaving

Moderate: Posting data is the smaller problem. Anyone exporting through the DATEV route has postings and receipt images flowing continuously into DATEV Unternehmen online, and that is where they stay after a switch. On top of that, the feature overview offers standard exports as CSV and PDF, a receipt archive as PDF or in the original format, and a bulk export for entire financial years. Three things still make switching dearer than an export suggests. First, the section of the terms of business on return and deletion only rules that the customer hands back the software; a period in which the customer can still pull out its own data after notice does not appear there. Clause 10 d of the processing agreement promises deletion or return at the customer's choice after the contract ends, with no period. Second, ten-year archiving under the German bookkeeping rules (GoBD) sits only in the paid add-on with the partner Accantum or in DATEV, not in the base licence. Third, the real effort lies in configuration: travel policies, approval routes, cost-centre logic and customised DATEV exports get rebuilt in the new tool. Anyone switching runs the bulk export before the one-month notice period ahead of the annual term end and settles in writing where the archive lives afterwards.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | publicly available as EU standard contractual clauses under Article 28, version 2.7 — The processing agreement is linked from the legal page as a file without a login and follows the European Commission's standard contractual clauses under Article 28(7) of the General Data Protection Regulation, supplemented by a commitment to the Swiss data protection act. The terms of business provide for a separate agreement in the section on confidentiality and data protection, and it is tied to no tariff. Three inconsistencies in the file belong on the checklist before signing: the file name says version 2.5 while the document itself says version 2.7; Annex I still lists the processor at the former address Schönhauser Allee 148; and it names Boris Arendt as data protection officer, whereas the privacy policy of 23 March 2026 names an external officer provided through Simpliant. | evidenced | 2026-09-16 |
| Storage location | European Union, operated on Amazon Web Services, in Germany according to the help pages — Annex III of the processing agreement states that the vendor runs no data centres of its own, that the platform runs on Amazon Web Services EMEA SARL and that processing takes place within the European Union, encrypted in transit and at rest. Annex IV names the EU as the place of processing for every subprocessor. The data protection help page goes further and names servers in Germany. What is contractually committed is the European Union; Germany appears only on the help page. There is no tariff attached and no choice to make. | evidenced | 2026-09-16 |
| Subprocessors | eight named with purpose and location in the contract, further services inside the product only in the privacy policy — Annex IV of the processing agreement lists eight subprocessors with address, service, data category and EU place of processing: Amazon Web Services for hosting, Intercom for customer enquiries, Mailjet for transactional email, Mindee for reading receipts, Accantum for the archive in the add-on module, MessageBird for text messages used in two-factor sign-in, Google Ireland for AI extraction via Vertex AI, and torq.partners Finance for onboarding services. The condition comes from comparing it with the privacy policy. That document names services running inside the product itself that are missing from Annex IV, because the vendor treats them as its own controllership: Sentry for error tracking in the web application, PostHog for session recordings after consent, Omni Analytics and Metabase for admin account data, and HubSpot for product updates. Anyone who has to verify that no receipt data leaks through those services has only the vendor's own classification to go on publicly. | partially evidenced | 2026-09-16 |
| Third-country transfer | none for receipt data per the contract, transfers to the United States for app usage data — For customer content the position is clear: Annex IV of the processing agreement names the EU as place of processing for every subprocessor, and Annex II expressly restricts AI extraction via Vertex AI to the Union. Alongside this, the privacy policy of 23 March 2026 describes a separate area in which the vendor is itself controller for the app. There, name, company, email address and usage data of admin accounts go to Omni Analytics and Metabase in the United States, error data from the web application to Sentry and data for product updates to HubSpot, each based on the EU-US Data Privacy Framework and on standard contractual clauses; for Metabase the policy names standard contractual clauses only. The grounds are named per recipient, but these transfers sit outside the contract with the customer, and what an error report from the web application carries with it is not publicly described. | partially evidenced | 2026-09-16 |
| Training on customer data | excluded by contract, including the model provider — Annex II of the processing agreement describes the AI functions, meaning extraction of receipt fields, enrichment with category and cost centre, and checks against policies, and names Google Cloud Vertex AI as the primary provider with processing exclusively in the European Union. It states that customer data is never used to train models, that retention at the model provider is limited to 24 hours, and that further AI services may only be added under the same commitments. The AI help page repeats this. Alongside, it describes category prediction learning from historical spending patterns within the company. Together that reads: no third-party model is trained on customer data, and learning within your own data does take place. | evidenced | 2026-09-16 |
| Retention and deletion | deletion or return after the contract ends promised, with no period — Clause 10 d of the processing agreement promises deletion with certification, or return, at the customer's choice after the contract ends, unless a statutory retention duty applies. Annex II adds that the retention period is generally up to ten years, that receipts are therefore only deleted on express instruction, and that user accounts are deleted after the contract ends. That leaves only side areas quantified: 24 hours at the AI provider, 90 days for error data at Sentry and three months for session recordings according to the privacy policy. A period within which receipts disappear from the vendor after notice appears in no public document, and the terms of business name no access window for the customer either. | partially evidenced | 2026-09-16 |
| Certifications | software attestation under IDW PS 880 dated 22 August 2025; no ISO/IEC 27001 certification for the vendor — One attestation is documented with standard, auditor and date: the certificate linked from the compliance page confirms that the travel expense capture software in version 6.5 was audited under IDW PS 880 against IDW RS FAIT 1 and 3, GoB, GoBD, IDW PS 330 and data protection law, with an audit report dated 22 August 2025 by Eger, Färber & Kollegen in Rosenheim. The certificate itself refers to notes in the software attestation report, and that report is not publicly available. The certificate still shows the former address on Schönhauser Allee. On information security there is only self-disclosure: the vendor says it runs an integrated management system covering the requirements of ISO 27001, oriented on that standard's structure according to Annex III. The mention of certified servers in the privacy policy refers to the cloud operator. Under margin number 180 of the German Federal Ministry of Finance letter on the GoBD, third-party attestations can help in choosing a system but do not bind the tax authority. | partially evidenced | 2026-09-16 |
| EU AI Act, Article 50 | no statement on the regulation, the AI works inward and is described in the contract — The product contains an AI system within the meaning of Regulation 2024/1689: the help pages name large language models for receipt capture, plus category prediction, duplicate detection and an address check in beta. The vendor mentions the regulation itself in none of the documents read and names no certification under ISO/IEC 42001. Toward employees and accounting the functions appear as suggestions that can be changed before submission, and they do not speak to end customers. The help page states that approvals and responsibility stay with the company. Annex II of the processing agreement describes purpose, data categories and model provider of the AI processing, which gives a usable basis for your own documentation. | partially evidenced | 2026-09-16 |
| Audit logging | described by the vendor, a log customers can evaluate is not publicly documented — Annex III of the processing agreement states under input control that every change to data in the production system is logged with time, user and changed value, and under access control that successful and attempted access is logged. That describes the vendor's side. Whether customers can view or export a change log, how long it is kept and what it covers appears neither in the feature overview nor on the help pages read. The IDW PS 880 certificate supports the regularity of processing but does not replace this information. Because the output flows into payroll and financial accounting, a written answer on this belongs before the signature. | partially evidenced | 2026-09-16 |

## Cost

- Entry: Four packages with published entry prices per month on annual billing: expenses and travel from 15 euros per licence, corporate cards from a 99-euro platform price with unlimited cards, incoming invoices from 149 euros including 100 invoices, employee benefits from 1 euro per licence. A licence only falls due for months in which someone submits, approves, reviews or creates a report, with a minimum of ten licences. A free trial is offered. (as of 2026-09-16)
- Where it gets expensive: In four places. First the add-ons whose prices are not published: the GoBD archive, management of several legal entities, day tours, the CO2 report and extended support. Anyone with several entities and no DATEV archive only learns the price from the quote. Second customisations to exports and interfaces: according to the feature overview, changed DATEV posting texts, SFTP exports, Business Central and Diamant are chargeable and some only available above a certain customer size, and the AI programme is due to become chargeable after its beta phase. Third the card: a two per cent fee applies on top of the VISA exchange rate. Fourth the commitment. The contract runs for one year and renews for a further year each time unless notice is given one month before expiry, and the terms of business allow a price adjustment at most once per calendar year in line with the vendor's own costs.

## Three routes compared

### Stay with the accounting system or the group-wide tool

In the German mid-market the classic route was DATEV Reisekosten classic, and that route now leads to this vendor: it describes itself as the successor, and DATEV lists it as a premium partner on its own travel expense page. In large groups SAP Concur remains the counterpart, because it bundles travel booking, expense reporting and the SAP connection in one contract, knows subsidiaries worldwide and has long been listed with procurement. The price is implementation effort and an interface employees rarely like. Anyone with SAP as system of record and many countries to settle usually stays there while the vendor's SAP connector is still in beta.

### Take a card-first spend tool with AI receipt capture

Pleo and Moss come from the corporate card: spending arises on the card, the receipt is matched by photo and text recognition, and out-of-pocket expenses are the exception. That fits where most spending runs through cards anyway, and it is often quicker to roll out. A tool built around a language model from the ground up that keeps pace with German travel expense law is not publicly visible in this cluster. What you give up with the card vendors is depth in travel expense law: meal allowances, the midnight rule, the three-month rule and payroll exports to LODAS are this vendor's core. So the first thing to check is what share of claims comes from multi-day business trips.

### Build the expense run yourself

The run looks small: collect the receipt by photo or email, read out the fields, record the trip with start and end, calculate allowances, route it to the line manager for approval, hand the posting to DATEV and the wage type to LODAS. You build it with Claude Code as the build tool, n8n for the process chain, LiteLLM as the model gateway, Langfuse for the evaluation loop on extraction quality and Supabase for data and receipt storage. At 20 person-days and 1,200 euros a day that is roughly 24,000 euros one-off against at least 1,800 euros a year for ten licences. The arithmetic tips in two places, and neither is the build. The first is rule maintenance: the Federal Ministry of Finance's foreign allowances change every year, plus the midnight rule, the three-month rule, deductions for meals provided and benefit-in-kind values, and every change has to be in the code on time. The second is evidence: ten years of audit-proof storage, procedural documentation and a log that survives a payroll tax audit, without an auditor ever having attested your own run. It pays off when an industry rule is the core, for instance field-service day tours with their own logic. For the ordinary business trip it does not.

Recommendation by size:

- Solo: Do not buy. Ten minimum licences do not pay for themselves at a few trips a quarter; a form and DATEV Belege online are enough.
- Mid-market: A fit, especially when moving off DATEV Reisekosten classic. Settle first where the archive lives, and have the prices of the add-ons you need written into the quote.
- Enterprise: Only worth a serious look when DATEV carries the accounting. Put the liability cap, log access, the multi-entity price and the status of the SAP connector in writing before signing.

## Context

- Implements method: [Constraint Detection (Five-Layer Scan)](https://www.convios.com/en/methods/constraint-detection) — The method looks for the layer where work actually stalls. The tool pays off when the bottleneck lies in capturing and recalculating trips, and less so when claims mainly sit waiting for approval.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — Travel expenses carry allowances, payroll tax consequences and retention duties at once. The method measures that density, and here it decides against building in-house, because annual rule maintenance is the expensive part.
- Implements method: [Operating Model Grid (Standardization and Integration)](https://www.convios.com/en/methods/operating-model-raster) — The method separates standardisation from integration. What gets standardised is how a trip is claimed, while DATEV or SAP stay integrated as systems of record, and that seam is exactly where the chargeable export customisations arise.
- Implements method: [Randomized Measurement of AI Productivity Gains](https://www.convios.com/en/methods/ki-produktivitaet-rct) — The vendor puts the relief at an average 80 per cent less manual effort. The method describes how to measure a figure like that in your own house, for instance with a group that keeps claiming on the old form.
- Displaces: Travel expense claims in spreadsheets with paper receipts stapled on, Recalculating meal allowances and mileage by hand, Keying receipts and wage types into DATEV and payroll, Managing meal subsidies and benefits in kind with paper vouchers or spreadsheets

## Evidence

- Legal form, registered office, register court and number, managing directors and VAT identification number — https://www.circula.com/de/impressum (as of 2026-09-16)
- First registration on 9 February 2017 as Beckett Labs GmbH, share capital development up to 122,845 euros as at 3 June 2025, annual accounts for 2022 and 2023 submitted on 18 and 19 December 2025 — https://www.northdata.de/Circula+GmbH,+Berlin/HRB+183803+B (as of 2026-09-16)
- Processing agreement as EU standard contractual clauses version 2.7: deletion or return under clause 10 d, description of processing and AI functions with Vertex AI, exclusion of training and 24-hour retention at the model provider in Annex II, technical and organisational measures including logging in Annex III, eight subprocessors with EU place of processing in Annex IV, former address and named data protection officer in Annex I — https://cdn.prod.website-files.com/65e82de5fac5e8a0bf813f65/688b4f344ba5e29ca36fceed_123021a819321f049f067d016f2f4738_Circula%20-%20DE%20-%20AVV%20%28EU-SCC%29%20-%20Website%20-%202.5.pdf (as of 2026-09-16)
- Terms of business dated 20 February 2026: minimum term of one year with automatic renewal and one month's notice, annual price adjustment in line with costs, error classes with a four-hour response time, liability cap of 10,000 euros per case and 100,000 euros in total, return and deletion without any provision for the customer pulling out its data, a separate processing agreement, credit cards through Pliant — https://www.circula.com/de/agb (as of 2026-09-16)
- Privacy policy version 2.4 of 23 March 2026: processing as the vendor's own controllership for admin accounts with transfers to Omni Analytics and Metabase in the United States, Sentry for error tracking with 90-day deletion, PostHog for session recordings with three months, HubSpot for product updates, an external data protection officer through Simpliant, and a reference to certified servers — https://www.circula.com/de/datenschutz (as of 2026-09-16)
- Entry prices of the four packages, licences only in active months, a minimum of ten licences, add-ons without published prices, a two per cent card exchange fee, DATEV premium partner and successor to DATEV Reisekosten classic by the vendor's own account, more than 2,800 companies by the vendor's own account — https://www.circula.com/de/preise (as of 2026-09-16)
- Feature overview: SSO through Google, Okta, Microsoft Entra ID, OneLogin and JumpCloud as a free setup, several entities, day tours, archive and CO2 report as paid add-ons, export formats and bulk export in the standard package, chargeable export and interface customisations, SAP S/4HANA and the AI programme in beta — https://help.circula.com/de/articles/662053-circula-funktionen-im-uberblick (as of 2026-09-16)
- AI functions using large language models, category prediction from patterns within the company, processing only in the EU, no training on customer data, 24-hour retention, responsibility remains with the company — https://help.circula.com/de/articles/533930-wie-circula-ki-funktioniert (as of 2026-09-16)
- Hosting on AWS servers in Germany according to the data protection help page — https://help.circula.com/de/articles/279521-datenschutz (as of 2026-09-16)
- GoBD archiving through DATEV Belege online or as an optional service from a software partner — https://help.circula.com/de/articles/279448-dokumentenmanagementsystem-dms (as of 2026-09-16)
- Certificate under IDW PS 880 for the travel expense capture software version 6.5, audit report dated 22 August 2025, Eger, Färber & Kollegen, audit criteria and reference to the software attestation report — https://drive.google.com/file/d/1kgIhBfyS-_vZOw4KNC4x7lakmurW73Ik/view?usp=sharing (as of 2026-09-16)
- Self-disclosure on the integrated management system following the requirements of the GDPR and ISO 27001, and link to the GoBD certificate — https://www.circula.com/de/compliance (as of 2026-09-16)
- Financing of a double-digit million amount on 24 January 2022 with Alstin Capital, Personio, Peak Capital, Storm Ventures and Capnamic, around 50 employees — https://financefwd.com/de/circula-finanzierung/ (as of 2026-09-16)
- Extended Series A round of EUR 15 million on 7 May 2025 with the existing backers and CIBC Innovation Banking, and the vendor's claim of an average 80 per cent less manual effort — https://www.circula.com/de/blog/circula-erhalt-15-millionen-euro-in-erweiterter-series-a-runde (as of 2026-09-16)
- Vendor announcement of 20 March 2024 with a new leadership team and more than 1,700 customers — https://www.circula.com/en/blog/circula-on-course-for-transformation-and-growth (as of 2026-09-16)
- DATEV lists the vendor as the cloud solution of a DATEV Marketplace premium partner on its own travel expense management page — https://www.datev.de/web/de/unternehmen/loesungen/lohn-und-personal/software-reisekostenmanagement (as of 2026-09-16)
- No security, trust or subprocessor page in the vendor's sitemap of 538 addresses — https://www.circula.com/sitemap.xml (as of 2026-09-16)
- Third-party certificates and attestations help in choosing a system but do not bind the tax authority, margin number 180 of the German Federal Ministry of Finance letter of 28 November 2019 — https://www.haufe.de/id/beitrag/grundsaetze-ordnungsmaessiger-buchhaltung-in-elektronischer-12-zertifizierung-von-softwaresystemen-HI7498152.html (as of 2026-09-16)