# Qonto

> Runs the payment account, cards, receipts and the handover to accounting in one place, with roles and approvals per person, instead of keeping the bank statement, the receipt pile and the coding apart.

- Vendor: QONTO SA, Paris, with a German branch (Zweigniederlassung) in Berlin
- Canonical URL: https://www.convios.com/en/toolbox/qonto
- Language version: https://www.convios.com/de/werkzeugkasten/qonto
- Area: Operations & finance · Cluster: business payment account
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-08-14 · Reviewed: 2026-08-14 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Efficiency only: Any savings bank runs a business account, and a competitor can open the same one within a week. What this adds is a closed chain from the card purchase through the receipt into the accounting system, plus a role model that sits in a contractual annex rather than a product page. That saves days in the monthly close and questions to the tax adviser. It does nothing for market position: no customer buys because receipts get coded faster.

## Suitability by company size

- Solo: suitable — The Starter plan is free and open to registered sole traders and freelancers, while Basic costs eleven euros a month excluding VAT. A separate accountant login only starts at Smart for twenty-three euros, and the full DATEV connection hangs off that same threshold. Anyone staying on Basic gets only the PIN and TAN connection there.
- Mid-market: suitable — This is where the use case sits. Essential costs fifty-nine euros a month, Business one hundred and nineteen, Enterprise two hundred and forty-nine, each excluding VAT, and from Essential upwards administrators, employees, manager roles and accountant logins are all unlimited. Price therefore follows function and does not grow with headcount, which sets it apart from the usual per-seat models.
- Enterprise: not suitable — What procurement checks is missing. No login through the company directory service is described anywhere in the help centre, nor is a log of access and role changes that the customer can export. The EBICS connection explicitly does not cover the classic signature-based DATEV route. Pooling liquidity across several legal entities is outside the design anyway, since sub-accounts hang off a single contract and are capped at ninety-nine.

## Vendor staying power

Established: Ten years in market, a licensed payment institution under French supervision and active in Germany through the European passport, with an application for a full banking licence filed with the same authority in July 2025. Profitability since 2023 and more than 600,000 business customers are the company’s own figures and cannot be verified in any register.

- Legal entity and register status in France: QONTO SA, SIREN 819 489 626, registered on 4 April 2016, listed as active (source: https://annuaire-entreprises.data.gouv.fr/entreprise/qonto-819489626, as of 2026-08-14)
- German branch: Qonto Zweigniederlassung Deutschland (German branch), Berlin, Amtsgericht Charlottenburg, HRB 213261 B (source: https://qonto.com/de/imprint, as of 2026-08-14)
- Licence and supervision: Payment institution licensed by the French supervisor ACPR, licence number 16958 granted on 21 June 2018, additionally supervised by BaFin in Germany (source: https://qonto.com/de/imprint, as of 2026-08-14)
- Last reported equity round: EUR 486 million, announced on 11 January 2022 (source: https://qonto.com/de/blog/news/qonto/series-d-rekordfundraising-fuer-qonto, as of 2022-01-11)
- Application for a full banking licence: filed with the ACPR in July 2025 in order to offer lending, savings and investment products in its own name (source: https://www.it-finanzmagazin.de/qonto-beantragt-eigene-banklizenz-in-frankreich-229719/, as of 2025-07-07)
- Earnings position and reach, per the company: profitable since 2023, more than 600,000 business customers across eight European countries (source: https://www.it-finanzmagazin.de/qonto-beantragt-eigene-banklizenz-in-frankreich-229719/, as of 2025-07-07)

## Cost of leaving

High: The data comes out easily. A full export as Excel or CSV including attachments is available on every plan, statements can be pulled individually, and closing the account is self-service in the settings. The expensive part is moving the account itself: the IBAN drags along direct debit mandates, standing orders, customer payments, payroll and the details filed with the tax office. The statutory account-switching aid (Kontowechselhilfe) is no help here, because the German Payment Accounts Act (Zahlungskontengesetz) applies to consumers under its section 1.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | not applicable, the vendor is an independent controller — The privacy notice states explicitly that Qonto processes its customers’ data as an independent controller and does not act as a processor, and it grounds this in its own anti money laundering duties. Neither the German nor the English legal document library contains a data processing agreement. Anyone in procurement demanding one is negotiating past the legal position. What remains to be settled is responsibility for the data of employees set up as users. | partially evidenced | 2026-06-01 |
| Storage location | Amazon AWS in France and Germany — The privacy notice names Amazon AWS as the storage provider and France and Germany as the storage locations for data arising in the Paris, Milan, Berlin, Barcelona and Belgrade offices. Customers have no say over the location, which is not envisaged for a supervised payment account either. | evidenced | 2026-06-01 |
| Subprocessors | no maintained list — The only name in the legal documents is Amazon AWS. Further recipients are described in the privacy notice as technical service providers under the outsourcing guidelines of the European Banking Authority, EBA/GL/2019/02, without naming them, their purpose or their country. The single place with names is the artificial intelligence document, which lists OpenAI, Google and Anthropic. | partially evidenced | 2026-06-01 |
| Third-country transfer | adequacy decision, otherwise standard contractual clauses — The privacy notice commits to both routes and refers anyone wanting the transfer instrument itself to a request with the data protection officer. Which recipient operates on which basis does not emerge from the public documents. For the AI features, Google and Anthropic are named as recipients whose parent companies sit outside the European Union. | partially evidenced | 2026-06-01 |
| Training on customer data | excluded, model providers named — The artificial intelligence document in its version of 1 May 2026 prohibits using customer data to train or improve third-party models and names the providers in use: OpenAI for the company name and logo generator as well as the plan recommendation, Google and Anthropic for the Operator and Analyst agents. Qonto improves its own models solely with publicly available content from the help centre. | evidenced | 2026-05-01 |
| Retention and deletion | quantified per purpose, five years for transactions after the account closes — The privacy notice quantifies each period separately: transaction data five years after the account closes, accounting records ten years, contact data three years after the last contact, call recordings six months. A deletion request runs against these duties while they last, which is what one expects from a supervised institution. | evidenced | 2026-06-01 |
| Certifications | ISO 27001 for the e-invoicing solution only — The help centre answers the ISO 27001 question with a qualification: what is certified is the e-invoicing solution under the requirements of the French tax administration, and what is certified further are the platforms of the operators AWS and Outscale. For the vendor itself the same text names no attestation, but ongoing supervision by the ACPR alongside PCI DSS, the Payment Services Directive, the European Banking Authority guidelines and DORA. The article carries the date 5 April 2024. | partially evidenced | 2024-04-05 |
| EU AI Act, Article 50 | dedicated artificial intelligence document, version of 1 May 2026 — The document names the European AI Regulation explicitly, describes four fields of use together with the model providers, and states that the Operator and Analyst agents neither decide nor act without explicit consent. The privacy notice commits to informing users when they interact with artificial intelligence, which carries the transparency duty under Article 50. No certification under ISO/IEC 42001 is named. | evidenced | 2026-05-01 |
| Audit logging | not publicly described — The framework contract anchors a five-level role model in its own annex and makes the account statement the legally valid evidence of payment transactions. A log of access, role changes and approvals that the customer can inspect and export into its own systems is described neither in the contract nor in the help centre. The reach and retention period of any such log therefore remain open, and evidence duties cannot be planned around it. | not evidenced | 2026-06-17 |

## Cost

- Entry: For sole traders and micro-businesses, Starter is free, Basic costs eleven euros, Smart twenty-three and Premium forty-five a month excluding VAT. For small and medium-sized companies, Essential starts at fifty-nine euros, Business at one hundred and nineteen and Enterprise at two hundred and forty-nine a month. The Starter plan is open only to registered sole traders and freelancers. (as of 2026-08-03)
- Where it gets expensive: The payment side. An incoming SWIFT transfer costs five euros on every plan once it reaches five hundred euros. Outgoing international transfers run at 0.56 percent in the four standard currencies and 1.56 percent in all others. On the lower plans a 2 percent FX fee applies to each card payment, dropping to 1 percent from Smart, and every additional administrator there costs ten euros a month. The price list of 3 August 2026 applies to new customers immediately and to existing customers from 1 October 2026.

## Three routes compared

### Account at the house bank, accounting in DATEV

The savings bank or cooperative bank runs the account, DATEV carries the accounting, the tax adviser sits in between. Larger mid-sized firms and corporates stay with this because the bank brings a credit line, guarantees and liquidity pooling across several legal entities, and because a relationship manager is reachable. The price is paid at the seam between the two: receipts get chased, card limits run through an authorised signatory, and there is no approval chain per person.

### Agents on the account

The young class promises that an agent assigns receipts, flags deviations and prepares payments, so that humans only see exceptions. Switching vendors purely for that rarely pays, because the established houses are adding the same agents. Qonto described its two in a dedicated legal document on 1 May 2026, and Pleo announced its own on 11 June 2026. Whoever switches also swaps the payment licence, and that is where the real risk sits.

### Self-building pays off one level above the account

Running a payment account requires a licence as a payment or e-money institution, anti money laundering processes and ongoing supervision. No software company between one and fifty million euros in revenue builds that. The sensible build sits one layer above: your own liquidity and contract view that joins the account export with subscriptions, contracts and cost centres. As a build tool, n8n from this catalogue handles collection over EBICS or an interface, with the accounting in DATEV as the building block. Something like this is built in a few days. It fails later in operation, because the account mapping has to be maintained and nobody remembers how it came about once the person who built it has left the company.

Recommendation by size:

- Solo: Take it, the entry costs nothing and receipt discipline comes with it.
- Mid-market: Buy, after weighing the international payment costs against your own volume.
- Enterprise: Settle first how login and access logging are meant to be handled.

## Context

- Implements method: [Cash Flow Trough](https://www.convios.com/en/methods/cash-flow-trough) — The trough describes how deep the account falls between upfront cost and incoming payment, and that depth can only be read continuously when payments in and out, including their due dates, sit in one place.
- Implements method: [Client-Financed Acquisition (30-Day Cash Rule)](https://www.convios.com/en/methods/client-financed-acquisition) — The calculation stands or falls on whether the customer’s money arrives within thirty days, and nobody measures that period reliably from a statement posted only after the monthly close.
- Implements method: [Value Creation Plan (Lever Categories and Execution Rate)](https://www.convios.com/en/methods/value-creation-plan) — The plan reports a quarterly implementation rate per lever, and cost-side levers can only be evidenced when every outlay carries its receipt and cost centre at the moment of payment.
- Alternative: [Pleo](https://www.convios.com/en/toolbox/pleo)
- Alternative: [DATEV](https://www.convios.com/en/toolbox/datev)
- Displaces: Paper statements and a folder full of receipts, A single company card held by the managing director for everyone, Handing receipts to the tax adviser as a monthly folder

## Evidence

- Legal form, registered office, branch registration numbers, payment institution licence and supervision by ACPR and BaFin — https://qonto.com/de/imprint (as of 2026-08-14)
- Independent controllership instead of processing, storage locations, third-country transfers and the quantified retention periods — https://qonto.pactsafe.io/versions/6a1dc4e59770d520dd1be18f.pdf (as of 2026-06-01)
- AI fields of use, named model providers, training exclusion and the reference to the European AI Regulation — https://qonto.pactsafe.io/versions/69f893dc3da14116fe89a9ac.pdf (as of 2026-05-01)
- Plans, user limits, FX and transfer fees for the German market including the staggered effective dates — https://qonto.pactsafe.io/versions/6a6a1afe563f29aaabe8d4bd.pdf (as of 2026-08-03)
- Role and permission model in the contractual annex, the statement as evidence, termination — https://qonto.pactsafe.io/versions/6a325d541b4d50fa59bd1418.pdf (as of 2026-06-17)
- Absence of a data processing agreement and of a sub-processor list across the entire legal document library — https://legal.qonto.com/de (as of 2026-08-14)
- Scope of the ISO 27001 certification and the supervisory regimes that apply instead — https://support-de.qonto.com/api/v2/help_center/en-us/articles/23949214506385.json (as of 2024-04-05)
- EBICS connection, plan-bound payment initiation from the ERP from October 2026 and the exception for the classic DATEV route — https://support-de.qonto.com/api/v2/help_center/de/articles/40191465029393.json (as of 2026-07-30)
- Application for a full banking licence with the ACPR, earnings position and customer count per the company — https://www.it-finanzmagazin.de/qonto-beantragt-eigene-banklizenz-in-frankreich-229719/ (as of 2025-07-07)
- Equity round of EUR 486 million — https://qonto.com/de/blog/news/qonto/series-d-rekordfundraising-fuer-qonto (as of 2022-01-11)
- Register status of QONTO SA in France — https://annuaire-entreprises.data.gouv.fr/entreprise/qonto-819489626 (as of 2026-08-14)
- Scope of the German Payment Accounts Act, limited to consumers — https://www.gesetze-im-internet.de/zkg/__1.html (as of 2026-08-14)