Settings

Administration → Settings bundles the entire tenant configuration — from fiscal years and approval rules to email delivery. The page is organized into five sections: General (workflows, region & currency), Approvals (approval stages and thresholds), Finance & taxes (country & tax rates, fiscal years, categories), Security & data (encryption, DPA, AI assistant, data export), and API.

Fiscal years

The Fiscal years card defines your planning periods: per year a label plus start and end date. All budgets, bookings and reports relate to a fiscal year.

At year end:

1. Create the new fiscal year.
2. Carry over plan values with the budget rollover.
3. Mark the old year with Close — it remains available for reports and year-over-year comparisons and can be reactivated with Reopen.

A closed fiscal year is fully locked: besides budget maintenance, you also can no longer record or import bookings for that year (including via DATEV or BMD), create or mark purchase orders as paid, or approve budget requests against it. This keeps closed figures permanently unchanged. Reopen lifts the lock again whenever needed.

Accidentally created fiscal years can be corrected: a year that lies entirely in the future and does not yet carry any budgets or budget requests can be removed via Delete (with a confirmation dialog). Once the year has started or data is attached to it, the button is hidden — closing the year is then the only option.

Budget categories

Categories (e.g. Software & licenses, Cloud services, Hardware) structure the budget matrix; per category you set the cost type — OPEX (recurring) or CAPEX (investment). When creating a category you can optionally set a general ledger account — it is used per booking in the DATEV/BMD export as the account number. New categories are available immediately in budgets, bookings and contracts. Unused categories can be deleted: if data still depends on them (budgets, bookings, purchase orders as well as assigned contracts and investments), Contrixt shows the number and requires explicit approval of the co-deletion via a checkbox before the irreversible deletion.

Workflows & thresholds

The Workflows & thresholds card controls approvals, budget warnings and the cancellation radar for the entire tenant:

Setting	Effect
Budget warning threshold (%)	From this utilization a budget cell turns yellow and triggers notifications
Radar "soon" / "urgent" (days)	Lead times at which the cancellation radar classifies contract deadlines
Auto-approve up to (€)	Budget requests below the amount are approved automatically (0 = off)
Four-eyes principle	Requesters may not decide their own requests

You configure multi-stage approval stages and approval requirements for purchase orders/investments under Approval workflow.

Cost anomaly alerts

The Cost anomaly alerts card under Finance & taxes automatically detects unusual spending spikes: for every cost center, contract and cloud connection, Contrixt compares the completed previous month with the average of the preceding months. If a month exceeds both the percentage threshold and the minimum amount, an anomaly finding is created — as an in-app notification, by email, optionally in Microsoft Teams/Slack, and as a signed webhook event (see Channel notifications & outgoing webhooks). Findings also appear in the Reports module, where they can be dismissed as reviewed once checked.

The feature is disabled by default. Check Enable cost anomaly alerts to turn it on, then set:

Setting	Default	Effect
Percentage threshold (%)	30%	Relative deviation from the average at which a finding is created
Minimum amount (€)	€250	Additional absolute minimum deviation, so small amounts don't trigger findings
Comparison period (months)	3	How many preceding months are used to calculate the average

A finding is only created when both thresholds — percentage and minimum amount — are exceeded together.

IT costs per employee (allocation key)

The IT costs per employee card under Finance & taxes determines the allocation key used to distribute IT costs that can't be attributed directly (contracts, cloud, virtual machines, depreciation, license shares not tied to a person) across cost centers:

Key	Basis
Employee count	The employee count maintained on the cost center
License users	Number of users detected via license sources per cost center (determined automatically)
Manual weights	A freely assigned weight on the cost center
Even distribution	Split equally across all cost centers with cost allocations

The selected key applies tenant-wide. You maintain employee count and weight directly on the relevant cost center; independent of that, per-person license costs are always attributed directly to that person's cost center. You'll find the result in the Reports → IT costs per employee module.

Employee directory (grouping attribute)

The Employee directory card under Finance & taxes determines the attribute the employee directory under Reports is grouped by default: Department (default), Cost center, Division, Organization, Employee number, Location, Company, City, Country or Job title.

Department, cost center, employee number, division and organization come from your identity provider's SCIM provisioning (see Employee attributes (enterprise schema)); the remaining values are taken, where available, from the license sync (M365/Google/Adobe). For privacy reasons, the employee directory itself is restricted to the Administrator and Controlling roles.

API keys and REST API

The API access (Power BI, Excel, integrations) card creates keys for the full Contrixt REST API (base https://app.contrixt.com/api/v1, or your tenant subdomain). It covers all core data types: cost centers, budget categories, fiscal years, budgets, actuals, orders/commitments, contracts, vendors, invoices (read-only), investments, budget requests (read-only), applications, savings, licenses (read-only), users (read-only), SaaS discovery results (read-only), PSA tickets (read-only), RMM devices (read-only), webhook endpoints (read/write), cost anomalies (read-only), IT costs per employee (read-only), and employee costs (read-only). The key is shown once and stored only as a hash; afterwards it can only be deactivated or deleted.

When creating a key, you set the permission for each data type: No access, Read, or Read & write. For example, a BI tool can be given read-only access to budgets and actuals, while an integration key can also create or update orders. Existing keys keep their previous behavior (read access, or the write access previously enabled) unchanged.

Actuals also have a dedicated bulk import endpoint: POST /api/v1/actuals/bulk imports multiple bookings in a single call and supports a dry run (dryRun) that checks every row without booking anything — handy for testing your own integration against the same validation logic as the import wizard under Bookings → Import.

The interactive documentation at https://app.contrixt.com/api-docs lets you browse every endpoint and try it out directly. For code generators, the OpenAPI description is available at /api/v1/openapi.json.

A key only ever acts within the permissions assigned to it; all write calls are recorded in the audit log.

The outgoing webhooks themselves can also be fully managed via the REST API: create, update and delete endpoints, trigger a test delivery, and retrieve the delivery log — handy for provisioning webhook subscriptions from your own integration instead of maintaining them by hand in the UI.

Channel notifications & outgoing webhooks

Under Administration → Integrations → Accounting & channels (/admin/integrations/connect) you manage:

Channel notifications — incoming webhook URLs for Microsoft Teams and Slack: Contrixt sends selected events (budget warnings, deadlines, approvals) as a chat message in addition to in-app and email. URLs are stored encrypted and are not shown again for security reasons.

Outgoing webhooks — subscribe your own endpoints that Contrixt notifies via HTTP POST on defined events. 16 events are available; without a selection, all of them are sent:

Event key	Trigger
budget.warn	A budget cell reaches the warning threshold
budget.exceeded	A budget cell exceeds 100%
request.created	A budget request is submitted
request.decided	A budget request is approved or rejected
request.stageAdvanced	A multi-stage approval reaches its next stage
planning.approved	A planning round is approved
contract.created	A contract is created
contract.updated	A contract is changed
contract.deadline	A contract's cancellation deadline is approaching (cancellation radar)
invoice.booked	An invoice is booked as an actual
invoice.deviation	An invoice deviates from the linked contract
actual.created	A booking (actual) is recorded
import.completed	A DATEV/BMD/CSV import completes
import.undone	An import is reverted
savings.realized	A saving is marked as realized
cost.anomaly	A cost anomaly alert detects an unusual spending spike

Reliable delivery — each individual delivery attempt has a 5 second timeout; if it fails (network error, timeout, or HTTP status ≥ 400), Contrixt automatically retries it with increasing intervals (backoff) over roughly 10 hours in total. If the delivery is still unsuccessful after that, it is considered permanently failed. If three deliveries fail permanently in a row, Contrixt automatically deactivates the affected endpoint — it is flagged accordingly in the management UI and can be re-enabled there at any time once the issue is resolved. Contrixt keeps a delivery log per endpoint with the status, HTTP code, and response time of every attempt; use Test delivery to verify the configuration at any time with a test event, without waiting for a real one.

Signature verification — every delivery is signed with HMAC-SHA256 and also carries a timestamp and a delivery ID to prevent replay attacks (resending a captured request):

Header	Content
X-Contrixt-Timestamp	Unix timestamp of the delivery
X-Contrixt-Delivery-Id	Unique ID of this delivery (stable across retries)
X-Contrixt-Signature	sha256=<hex>, HMAC-SHA256 over "<timestamp>.<body>"
X-Contrixt-Signature-Legacy	The previous signature sha256=<hex> over the JSON body only — included in addition during the transition period

To verify it, recompute the signature yourself with your subscription secret, for example:

signatureBase = timestamp + "." + body
expected      = "sha256=" + hmacSha256Hex(secret, signatureBase)

valid = (expected === header["X-Contrixt-Signature"])
     && (Math.abs(nowUnix - timestamp) < 300)   // e.g. 5 minutes tolerance

X-Contrixt-Signature-Legacy (signature over the body only, without a timestamp) remains available in addition during the transition period so existing integrations keep working unchanged; for new integrations, use X-Contrixt-Signature together with the timestamp check instead. The secret is shown only immediately after creating the webhook — be sure to save it at that point.

DATEV/BMD export

Also under Accounting & channels, you first maintain the DATEV header data: consultant number and client number (both optional). If set, the DATEV export uses them as EXTF header data.

Below that, you export actual bookings for a period as an accounting file:

• DATEV: EXTF posting batch (CSV) with debit indicator, general ledger accounts and cost center as KOST1. General ledger accounts come from the General ledger account field of the respective budget category (Budget categories).
• BMD: simple CSV in BMD format.

Choose the period (from/to) and format and download directly — the file carries a UTF-8 BOM so DATEV and Excel correctly recognize special characters.

Conversely, a DATEV EXTF posting batch or BMD export — for example from your tax advisor — can also be imported again: the import wizard under Bookings → Import automatically maps the general ledger account and cost center.

Mail approval links

Notification emails about pending budget requests contain a one-click link (Approve / Reject) directly in the email for approvers — no login required. The link is a signed token valid for 7 days with no server-side state; multi-stage and four-eyes checks apply just as they do when deciding in the application. A link that has already been used or has expired shows a plain notice page instead of an error.

Email delivery

The Email sending (own SMTP) card configures delivery via your own domain — see Email delivery (SMTP).

Encryption

The Data encryption card controls the tenant key (platform or your own) — see Encryption (BYOK).

Data processing agreement (DPA)

The Data processing (DPA) card provides you with a ready-filled data processing agreement pursuant to Art. 28 GDPR — for your data protection documentation. The agreement already contains the provider details, the sub-processors used and the technical and organizational measures.

1. First enter your company's legal name and legally binding address and save. Without an entry, the tenant name is used and the address is shown as a fillable line.
2. Then download the agreement via Download PDF (German) or Download (English). The German version is the authoritative one.

The DPA can be added to your contract records electronically or as a signed document.

AI features

The AI features card unlocks the optional AI Assistant: a data assistant for questions about budgets, contracts, licenses and savings, plus more accurate automatic extraction from uploaded invoices and contracts. Both are based on Anthropic's Claude API.

The feature is disabled by default (opt-in). Check Enable AI features for this tenant and click Save to turn it on — and use the same checkbox to turn it off again at any time. Only aggregated metrics or the text of the respective document are sent to the Claude API — your data is never used to train the models.

Data export

The Data export card provides a complete export of all this tenant's data — including uploaded documents — as a ZIP file. The export supports data portability under Art. 20 GDPR and also doubles as a backup copy. Download export (ZIP) starts the download.

Sample data

While sample data is loaded, the page offers Remove sample data — deletion happens strictly via the markers (BSP-…, "Beispiel: …") and leaves real data untouched.

Other administration areas

Area	Page
Users, roles, invitations	Users & roles
Integrations (licenses, cloud, VMs)	Administration → Integrations — tile overview with per-connection status
Accounting & channels (Teams/Slack, webhooks, DATEV/BMD)	Administration → Integrations → Accounting & channels
SSO / SCIM	SSO & SCIM
Audit log	Security & audit log
Subscription & billing	Subscription & billing

Region & currency

The Region & currency card sets the tenant's display currency and time zone.

• The display currency is a pure display setting — amounts already recorded are not converted.
• The time zone controls when deadlines (e.g. fiscal year boundaries) and scheduled runs (e.g. automatic notifications) are triggered.

Country & VAT rates

All amounts stored in Contrixt are net values. So you never have to convert gross invoice amounts by hand, choose your country and standard rate here:

1. Open Administration → Settings → Country & VAT rates.
2. Choose the country — its VAT rates then become available as a gross option in every amount field.
3. Set the standard rate and save.

To make sure it works: open e.g. Bookings → New booking — next to the amount field you will see the Net / Gross (x % VAT) selector. For gross entry, Contrixt converts to net automatically and stores the net value.

Country & VAT rates — special cases for the US & Canada

For the United States and Canada, the tax logic differs from the European VAT model:

• United States: There is no VAT model. Instead, you enter a free-form sales tax rate (0–15%), since the combined state and local rate varies by location. This single rate then appears as a gross option in the amount fields.
• Canada: You can choose from the common GST/HST rates — 5% GST, 13% HST (Ontario), 15% HST (Atlantic provinces), and 14.975% (Québec, combined).

For all other countries, the regular VAT logic described above continues to apply.

Paper size for PDF exports (automatic)

PDF reports and the DPA are generated automatically in the matching paper size: Letter for tenants with country USA or Canada, otherwise A4. No manual setting is required — the format automatically follows the country configured under Country & VAT rates.