Four roles, clearly separated permissions
Roles determine what someone may see and do. They can be assigned per company, so a person can have read access in the holding and post entries in the subsidiary.
Full access to master data, users, company settings, payment method and contract details. This role sets up the company and invites other people.
Post entries, review documents, match bank transactions, create and submit filings. No access to the account's contract and payment data.
Submit documents, record time, view their own items. No sight of wages, contracts or other people's documents.
Read access to entries, documents and reports, plus export rights including DATEV. At no extra cost and with no subscription of their own.
Who may do what
The overview shows the default permissions. Individual permissions can be fine-tuned per user, such as read without export.
Traceable, even months later
Collaboration needs a trail. In ZepDesk every change stays visible without anyone having to maintain logs.
Who changed what and when, with the previous and new value. Filterable by user, period and item, exportable for an audit.
Entries and documents do not disappear. Corrections run as a reversal that references the original, as the GoBD require.
Invoices and payments can go through a four-eyes principle. The approval is documented with person and timestamp.
TOTP for every role, enforceable for admin access, with recovery codes.
Automations get their own keys instead of user accounts, revocable at any time.
Our team sees your data only after your approval, and every access is logged.
How the division of work with your tax firm plays out in practice
Day to day, the company posts its own entries: writing invoices, photographing documents, matching bank transactions. That is the part that comes up continuously and takes a few minutes a day in ZepDesk. The tax firm works on the same data instead of collecting documents at the end of the month.
For the closing, the tax firm takes over the judgment calls: accruals and deferrals, provisions, tax elections and the returns. The tax adviser role with read access and export is enough for this; anyone who prefers to post entries themselves gets the accounting role. Neither costs extra, because ZepDesk is billed per company.
If the tax firm is missing a format, the DATEV export delivers posting batches and master data per period. We recommend generating this export once before the move and having the tax firm confirm it.
Questions on users and roles
Does each additional user cost money?
No. Users, documents and entries are unlimited per company. The price depends on the company's legal form, not on the number of people.
Can my tax adviser post entries?
If you want, yes: then they get the accounting role. By default the tax adviser role has read access and export rights, which is enough for review and closing.
Can staff see wages?
No. The staff role has no access to payroll and contract data. Payroll access sits with admin and accounting and can be withdrawn individually.
What happens when someone leaves the company?
You deactivate the user. Their entries and documents remain in the audit log with their name, and access is blocked immediately.
Can two-factor be enforced?
Yes, two-factor sign-in can be made mandatory for admin roles. Without an active second factor, signing in is then not possible.
What the tax adviser sees, what the team sees.
Roles are separated technically, not just by agreement. Here is one item from four perspectives.
Every access is recorded in the audit log with user and timestamp.
Invite your team and tax firm.
Create a user, choose a role, done. Your tax adviser gets their own access, at no extra cost.