Candis
Automated invoice processing and approval workflows for German SMBs
- Data residency
- EU only
- DPA available
- Yes
- Pricing
- Subscription
- Art. 9 data
- Not suitable
Who this tool is for
Industries
- Finance teams automating accounts payable
- German SMBs with high invoice volume
- Companies needing structured approval workflows
- Businesses preparing for E-Rechnungspflicht 2025
Candis is a Berlin-based invoice automation platform for German SMBs. It uses OCR to digitise incoming invoices, runs them through configurable approval workflows, and exports the booked data to DATEV for the tax advisor.
Data is hosted on AWS in the EU, a GDPR DPA is available, and the platform holds a SOC 2 Type II attestation. Candis is already prepared for the E-Rechnungspflicht 2025, making it a fit for finance teams that want to automate accounts-payable processing while keeping a clear audit trail and EU data residency.
Pros and cons
Strengths
- OCR-based invoice digitisation
- Configurable approval workflows
- DATEV export for tax advisors
- SOC 2 Type II attestation
- Ready for E-Rechnungspflicht 2025
Trade-offs
- No free tier available
- Relies on AWS as sub-processor
- Focused on invoice processing, not full accounting
Where it sits with GDPR
Good fit for
- Processing invoices with EU-based AWS hosting
- Relying on a SOC 2 Type II attestation
- Signing the available GDPR DPA
Think twice / not suitable for
- Processing special-category personal data (Art. 9)
- Setups requiring no US-headquartered sub-processor
Data protection note
Berlin HQ; AWS EU; SOC 2 Type II; DATEV-Export; ready for E-Rechnungspflicht 2025.
Frequently asked questions
Is Candis ready for the 2025 e-invoicing mandate?
Yes, Candis is prepared for the E-Rechnungspflicht 2025.
Does Candis export to DATEV?
Yes, Candis provides DATEV export of booked invoice data.
Is Candis SOC 2 certified?
Candis holds a SOC 2 Type II attestation.
Where does Candis store data?
Candis hosts data on AWS in the EU and offers a GDPR DPA.
Reviews are written and reviewed by Eduardo personally. They describe what a tool does and where it sits with data protection, but they do not constitute legal advice.