# Lexware Office

> Lexware Office writes quotes and invoices, reads incoming receipts, matches them against the connected bank accounts and turns all of it into bookkeeping up to the advance VAT return (Umsatzsteuer-Voranmeldung) and the cash-basis profit statement (Einnahmen-Überschuss-Rechnung). Payroll, including filings to health insurers and the tax office, can be added as a module, and the tax adviser gets their own access to the same data set.

- Vendor: Haufe Service Center GmbH, Freiburg, a brand of Haufe-Lexware GmbH & Co. KG
- Canonical URL: https://www.convios.com/en/toolbox/lexware-office
- Language version: https://www.convios.com/de/werkzeugkasten/lexware-office
- Area: Operations & finance · Cluster: accounting for small businesses
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-09-28 · Reviewed: 2026-09-28 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: For a small business in Germany a chain of duties hangs off the accounts, and since 1 January 2025 it has grown by the obligation to receive structured e-invoices: record-keeping under the GoBD principles, eight- to ten-year retention, electronic advance VAT returns. Lexware Office closes that chain from version L at EUR 21.90 a month plus VAT, which is why the verdict reads: prevents falling behind. According to the provider, well over 450,000 customers work with the tool (as of 24 September 2026), so anyone using it stands on the same footing as the business next door. The AI features sit in receipt recognition and booking suggestions. Two points stand out in the documents: hard ceilings in the fair usage policy that limit the range of use at the top, and a publicly available processing agreement (Auftragsverarbeitungsvertrag) whose purpose clause reaches further than the commitment in the terms and conditions.

## Suitability by company size

- Solo: suitable — Entry is EUR 7.90 a month for receipt capture and archive; bookkeeping with the advance VAT return and the cash-basis profit statement starts in version L at EUR 21.90, each plus VAT and cancellable monthly. There is no minimum term, and access for the tax adviser is free.
- Mid-market: suitable with caveats — Any number of users is allowed. The permission model knows only four coarse working rights covering documents, financial accounting, payroll and administration, plus a self-service right for one's own payslips, and the right to documents can be withdrawn only from users with self-service access. Every administrator can change the rights of every other administrator. Sign-in via single sign-on is not documented publicly. The fair usage policy caps use at 50,000 documents per calendar year and 50 payroll runs per month, and the payroll module ends at 50 employees in the price table.
- Enterprise: not suitable — The processing agreement states the purpose itself: supporting small and micro businesses. Consolidation across several entities does not appear in the feature overview, liability outside intent and gross negligence is capped per calendar year at 50 per cent of the fees paid, and committed availability is 99 per cent as a monthly average during operating hours, excluding planned maintenance.

## Vendor staying power

Established: Lexware Office belongs to Haufe Group, which describes itself as a family business based in Freiburg. The contracting party and processor is Haufe Service Center GmbH, a subsidiary of Rudolf Haufe Verlag GmbH & Co. KG. Haufe Service Center GmbH is also registered as a payment institution with the Federal Financial Supervisory Authority (BaFin). No stake held by financial investors appears in the documents checked.

- Contracting party and register: Haufe Service Center GmbH, Munzinger Strasse 9, 79111 Freiburg, local court (Amtsgericht) Freiburg HRB 5718, managing directors Christa van der Burgh and Dr Tobias Lagatz (source: https://agb.lexware.de/lexware-office, as of 2026-09-24)
- Brand owner: Haufe-Lexware GmbH & Co. KG, a limited partnership (Kommanditgesellschaft) seated in Freiburg, register court Freiburg HRA 4408, general partner Haufe-Lexware Verwaltungs GmbH, HRB 5557 (source: https://impressum.lexware.de/lexware-office, as of 2026-09-24)
- Registration and ownership: Haufe Service Center GmbH entered in the commercial register on 13 March 2006, parent company Rudolf Haufe Verlag GmbH & Co. KG, annual accounts to 30 June since 2006 (source: https://www.northdata.de/Haufe+Service+Center+GmbH,+Freiburg, as of 2026-09-28)
- Supervision: Haufe Service Center GmbH registered with BaFin as a payment institution for payment initiation and account information services, payment institutions register 156230 (source: https://agb.lexware.de/lexware-office, as of 2026-09-28)
- Group financial year 2024/25: Haufe Group revenue EUR 562 million, growth above 8 per cent, around 2,500 employees, announced 13 August 2025 (source: https://www.haufegroup.com/en/presse/strength-in-change-haufe-group-remains-firmly-on-course-for-growth, as of 2026-09-24)
- Group financial year 2025/26: Revenue above EUR 600 million for the first time, growth of 7 per cent, Lexware grew according to the group, reporting date 30 June 2026, announced 23 July 2026 (source: https://www.presseportal.de/pm/106930/6320059, as of 2026-09-24)
- Customer base as stated by the provider: Well over 450,000 customers, provider figure, retrieved 24 September 2026 (source: https://www.lexware.de/datenschutz-datensicherheit/, as of 2026-09-24)
- Tax adviser access as stated by the provider: More than 50,000 tax advisers in Germany use the free online access to client accounts, provider figure, retrieved 28 September 2026 (source: https://www.lexware.de/preise/, as of 2026-09-28)

## Cost of leaving

Low: Exit is governed by contract. After the contract ends the account stays in a free read-only mode according to the processing agreement, and under clause 13 of the terms on request for the length of the commercial and tax retention periods; export or deletion remain possible throughout. What stays open is what arrives in the new system as a connected whole: locked postings, the activity log and the link between receipt and bank transaction. The processing agreement speaks of common data exchange formats without naming them. The electronic document shuttle (Pendelakte) covers the route to a tax firm; further migration help is charged separately by the provider according to its price list.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | a dedicated agreement under Art. 28 GDPR, published in full and downloadable as a PDF, dated 12 November 2025 — The agreement is published in full, with sub-processors in annex 1 and technical and organisational measures in annex 2. The processor is Haufe Service Center GmbH, the same company that handles contracts under the terms and conditions. It is not tied to any plan. One inconsistency in the wording stands out: the agreement is said to take effect on signature, while the privacy policy speaks of a contract already concluded. Neither page names a signing route. | evidenced | 2026-09-24 |
| Storage location | Amazon Web Services in Frankfurt for all invoicing and accounting functions, AWS Europe for operating the AI-assisted functions — According to the processing agreement all core functions are developed and hosted exclusively in Germany, naming invoicing, receipt processing, payroll and the cash book. The hosting contract party is Amazon Web Services EMEA SARL in Luxembourg. The American parent appears as a separate entry in the list, limited to internal support services and only with prior approval. No surcharge for the region is mentioned. | evidenced | 2026-09-28 |
| Subprocessors | a public list with ten entries including address and service, plus an approval proviso for AWS Inc. — Annex 1 names every firm with address and purpose: two Haufe companies for development and support, Amazon Web Services for hosting, UserVoice for a feedback tool, The Rocket Science Group with Mandrill for sending all kinds of e-mail, Intercom for AI-assisted communication, B+S Banksysteme and BANKSapi for bank retrieval, SorryApp for status notices and Klippa of Groningen for extracting data from receipts. Datadog and Mixpanel appear only in the privacy policy, listed there as the provider's own processing based on legitimate interests, with data held in the EU. The provider must announce any change in advance, and the customer can object, in which case the provider may terminate the contract for cause. | evidenced | 2026-09-28 |
| Third-country transfer | transfers to the US and the United Kingdom for secondary functions, legal basis named in general terms without matching it to each recipient — Core functions stay in Germany. For supplementary functions such as e-mail delivery, the support platform and analytics the provider relies on sub-processors based in the US, naming UserVoice, The Rocket Science Group and Intercom, plus SorryApp in London. As the legal basis the processing agreement names an adequacy decision as the rule and standard contractual clauses otherwise. Which recipient works on which basis is stated nowhere. E-mail delivery has practical consequences: invoices sent from the program travel through an American service. | partially evidenced | 2026-09-24 |
| Training on customer data | training on inputs and outputs of the AI features excluded by contract; the processing agreement reserves analysis and improvement of the service — The terms and conditions as of 11 August 2026 exclude the use of input or output for training purposes in section II clause 2.3. The processing agreement additionally names other purposes, among them analysing and improving the service offering, and it allows the stored data to be used for compatible purposes under Art. 6(4) GDPR. The Intercom support chatbot is an exception; according to the privacy policy it is trained on chat inputs. The provider does not name the model behind the AI features; the list names AWS Europe for operating the AI functions and Klippa for receipt extraction. | partially evidenced | 2026-09-28 |
| Retention and deletion | free read-only access after the contract ends, deletion can be triggered by the customer at any time, trial accounts deleted after 13 months at the latest, no period stated for backups — The processing agreement settles the end of the contract concretely: the account stays readable free of charge, the customer can trigger full deletion and export all data themselves, and a trial account that was never bought is deleted no later than 13 months after the trial ends. The provider may keep backup copies where needed for proper processing. No period after which the backups disappear too is given. A deletion concept beyond the account remains the customer's job. | partially evidenced | 2026-09-28 |
| Certifications | a GoBD attestation under IDW PS 880 is named, viewable only after a form via the portal of an unnamed audit firm; ISO 27001 and PCI DSS apply to the data centres — According to the provider an independent audit firm regularly examines Lexware Office under IDW PS 880, IDW RS FAIT 1 and the GoBD principles. Anyone wishing to see the attestation enters company name, name and e-mail address and is forwarded to the audit firm's report portal; the firm's name, the audit date and the scope are not stated publicly. The ISO 27001 and PCI DSS certifications refer explicitly to the high-security data centres around Frankfurt, and so to the host. No ISO 27001 certification of the provider itself is named. The form was not submitted for this profile. | partially evidenced | 2026-09-24 |
| EU AI Act, Article 50 | the terms name the AI Regulation and rule out prohibited practices and high-risk use; a statement on Article 50 is missing — Clause 2.3 of the terms for SaaS solutions refers explicitly to Regulation (EU) 2024/1689. Prohibited are the practices under Article 5 and any use that would classify the AI features as high-risk, including the areas in Annex III such as personnel management. The provider places responsibility for inputs and results with the customer, together with an indemnity. It says nothing about the transparency duties under Article 50. The AI features in the product work on receipts and booking suggestions and do not face the customer's own customers. | partially evidenced | 2026-09-24 |
| Audit logging | an in-product log of changes and sign-ins with time and IP address, kept for ten years; export into your own systems is not documented — Inside the product the log shows which changes were made when and who signed in from which IP address. According to annex 2 of the processing agreement, customer entries are kept in a GoBD-compliant audit log for ten years, and every access by the provider's own system administrators is logged with ID, timestamp and reason for the same period. No plan restriction is mentioned. None of the pages checked describes how the log can be transferred into your own system. | partially evidenced | 2026-09-24 |

## Cost

- Entry: Four versions, per month plus VAT: S for receipt capture and archive EUR 7.90, M with quotes, e-invoices and dunning EUR 12.90, L with bookkeeping, cash-basis profit statement and VAT EUR 21.90, XL with EU and progress invoices plus the programming interface EUR 32.90. The provider currently offers half price for the first three months as a promotion (as of 28 September 2026). Payroll starts at EUR 12.90 for up to two employees. Everything can be cancelled monthly, as of 28 September 2026. (as of 2026-09-28)
- Where it gets expensive: Additional costs arise at the limits. The payroll module climbs in steps by headcount up to 50, where the price table ends. The fair usage policy allows 50,000 documents a year and 50 payroll runs a month; anyone growing beyond that faces a change of system. The provider may adjust prices once a year, and a special right of termination arises only above 10 per cent. Migration support beyond the plain export is charged separately according to the price list.

## Three routes compared

### Keep the books through the tax firm in DATEV

The usual counterpart is DATEV Unternehmen online, set up through your own tax firm, which works in DATEV format and maintains the data set there. Lexware Office starts with the business: the business does its own bookkeeping and hands over to the tax firm via the electronic document shuttle (Pendelakte) (as of 28 September 2026).

### AI-native bookkeeping with a free core

Norman is a counterpart that makes AI bookkeeping itself the product. According to the provider, bookkeeping and e-invoicing come in the free plan. The advance VAT return (Umsatzsteuer-Voranmeldung) costs self-employed users EUR 28 a month plus VAT in the Pro plan, and companies EUR 52 in the Max plan (as of 28 September 2026). Norman is therefore cheaper only for users who file no advance VAT return. Two things need checking before a switch, both documented for Lexware Office and not checked for the counterpart in this profile: payroll with filing routes to health insurers and the tax office, and a publicly available processing agreement with a list of sub-processors.

### Building the document run yourself

The document run could be built: n8n chains inbox and filing without custom code, Claude Code writes the evaluation steps, LiteLLM keeps the model calls interchangeable and Langfuse measures the hit rate per document type. Ten person-days at EUR 1,200 (estimate) put EUR 12,000 against EUR 262.80 a year for version L. On top come three points the self-build would have to cover itself: filing to the tax office, the eight- to ten-year archive compliant with the GoBD principles, and for payroll the social insurance filings, which may only be made from system-certified software or via a filing aid such as sv.net. If the builder leaves, nobody is left to check the run against changed rules.

Recommendation by size:

- Solo: Buy it, with version L once VAT applies, and switch on two-step sign-in for every user: without it, clause 3.3 of the terms makes the customer answerable for any misuse in every case.
- Mid-market: Buy it while the fair usage ceilings are far off, and from around 30 employees (estimate) plan the exit route before the payroll limit of 50 is reached.
- Enterprise: Unsuitable for groups: the processing agreement names small and micro businesses as its purpose, liability outside intent and gross negligence is capped at 50 per cent of the fees paid per year, and consolidation does not appear in the feature overview.

## Context

- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The test asks how much regulation sits in a market. For Lexware Office, e-invoicing, the GoBD principles and filing routes to social insurance and the tax office apply.
- Implements method: [Good-Better-Best Pricing](https://www.convios.com/en/methods/good-better-best) — The four versions from S to XL tier the scope: bookkeeping begins in the third tier (L), the programming interface in the fourth (XL).
- Implements method: [Data Monetization: Improve, Wrap, Sell](https://www.convios.com/en/methods/data-monetization-improve-wrap-sell) — The method distinguishes whether data improves the product, wraps it or is sold, and the purpose clause of the processing agreement on analysing and improving the service is the first of those, written into the contract.
- Alternative: [DATEV](https://www.convios.com/en/toolbox/datev)
- Alternative: [Candis](https://www.convios.com/en/toolbox/candis)
- Displaces: Invoices in Word and Excel with hand-kept number ranges, Receipt folders that go to the tax firm at quarter end, Typing up bank statements by hand and making transfers from online banking, Payroll commissioned separately from a payroll bureau

## Evidence

- Brand owner, legal form, register court and register numbers, supervisory authority BaFin — https://impressum.lexware.de/lexware-office (as of 2026-09-24)
- Contracting party, register number HRB 5718, management, payment institutions register 156230, terms including clauses on AI use, training exclusion, liability, availability, price changes, two-factor sign-in and contract end, dated 11 August 2026, read-only access for the retention periods under clause 13, liability outside intent and gross negligence capped at 50 per cent — https://agb.lexware.de/lexware-office (as of 2026-09-28)
- Processing agreement with purpose clause, hosting in Germany, sub-processors in annex 1, right to object with the provider's right to terminate for cause, exception for backup copies, technical and organisational measures including a ten-year audit log in annex 2 and rules for contract end, dated 12 November 2025 — https://avv.lexware.de/lexware-office (as of 2026-09-28)
- Privacy policy separating the provider's own controllership from processing on instruction, Datadog, Mixpanel, training of the Intercom support chatbot on chat inputs and third-country rules, dated 23 September 2026 — https://datenschutz.lexware.de/lexware-office (as of 2026-09-28)
- Usage ceilings: 50,000 documents per calendar year, 50 payroll runs per month, dated 13 November 2025 — https://agb.lexware.de/lexware-office/fair-usage-policy (as of 2026-09-24)
- Prices of versions S to XL, payroll module, promotional discount for the first three months, tax adviser access used by more than 50,000 tax advisers according to the provider, and number of partner extensions — https://www.lexware.de/preise/ (as of 2026-09-28)
- Data centres around Frankfurt with ISO 27001 and PCI DSS, audit under IDW PS 880, customer count as stated by the provider — https://www.lexware.de/datenschutz-datensicherheit/ (as of 2026-09-24)
- GoBD attestation only after a form via the report portal of the commissioned audit firm — https://www.lexware.de/gobd-zertifikat/ (as of 2026-09-24)
- Four working rights plus a self-service right for one's own payslips, the right to documents withdrawable only for self-service users, any number of users, administrators can change the rights of other administrators — https://help.lexware.de/de-form/articles/548789-benutzer-und-berechtigungen-verwalten (as of 2026-09-28)
- Log of changes and sign-ins with time and IP address — https://help.lexware.de/de-form/articles/548626-was-kann-ich-tun-wenn-ich-unbefugten-zugriff-auf-meinen-lexware-office-account-vermute (as of 2026-09-24)
- Entry of Haufe Service Center GmbH in the commercial register on 13 March 2006 and parent company — https://www.northdata.de/Haufe+Service+Center+GmbH,+Freiburg (as of 2026-09-28)
- Haufe Group revenue for financial year 2024/25, announced 13 August 2025 — https://www.haufegroup.com/en/presse/strength-in-change-haufe-group-remains-firmly-on-course-for-growth (as of 2026-09-24)
- Haufe Group revenue for financial year 2025/26, announced 23 July 2026 — https://www.presseportal.de/pm/106930/6320059 (as of 2026-09-24)
- Renaming of lexoffice to Lexware Office with contracts unchanged — https://www.lexware.de/lexoffice/ (as of 2026-09-24)
- Norman plans: bookkeeping and e-invoicing in the free plan, advance VAT return for the self-employed in the Pro plan at EUR 28 and for companies in the Max plan at EUR 52, each per month plus VAT — https://norman.finance/pricing (as of 2026-09-28)
- Retention periods since 1 January 2025: ten years for books and financial statements, eight years for accounting vouchers (section 147(3) of the Fiscal Code, Abgabenordnung) — https://www.gesetze-im-internet.de/ao_1977/__147.html (as of 2026-09-28)
- Programs and filing aids for social insurance filings need a system check before first use (section 19 of the data capture and transmission ordinance, DEÜV) — https://www.gesetze-im-internet.de/de_v/__19.html (as of 2026-09-28)