Email archiving: what the GoBD require and why the mailbox is not enough
Business emails must be kept complete and unalterable for six or eight years. Why the archive mailbox in Microsoft 365 is not enough, how a journal rule captures every email and what Hornetsecurity and MailStore offer.
In Germany, business emails have to be kept for years, complete and unalterable. For email archiving, many companies rely on the mailbox or the archive mailbox in Microsoft 365. Neither is an archive: employees can delete emails, and whatever is deleted is missing at the next tax audit. An email archive captures every email as it is sent and received and keeps it until the retention period has ended.
Sources: Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB), as of October 2026.
Which emails you have to keep
An email has to be kept if it serves as a business letter or an accounting record: a quote, an order confirmation, a complaint, an invoice in the body of the email. Business letters must be kept for six years, accounting records for eight years since 2025. The period starts at the end of the year in which the email was received or sent. It does not end while taxes for that year can still be assessed. Banks and insurers still have to keep accounting records for ten years.
If an email merely carries an invoice as an attachment, the GoBD require only the attachment to be kept. The email itself need not be archived. In everyday work this is hard to separate cleanly. That is why I archive all business emails in full, incoming and outgoing.
What the GoBD require of email archiving
The GoBD are issued by the German Federal Ministry of Finance. The version in force dates from 2019 with amendments from 2024 and 2025. For emails this means:
Every email that has to be kept must end up in the archive, even if it is later deleted from the mailbox.
Archived emails must not be changed or deleted unnoticed. According to the GoBD, storing them in folders on a server usually does not meet this requirement.
Emails are kept as they were received. Saving them as PDF loses the headers with sender, route and timestamps.
During an audit the tax office must be able to access the data read-only or receive an evaluation. A procedural documentation describes how archiving works.
Many email archiving vendors call their archives “audit-proof”, a term that does not appear in the GoBD. There is no “GoBD certification” either: the tax authorities do not approve software. An auditor’s attestation, usually according to the IDW PS 880 standard, shows that software can meet the requirements when set up correctly. Whether the archive is compliant depends on how it is set up and run in the company.
Why the archive mailbox in Microsoft 365 is not enough for email archiving
The archive mailbox in Microsoft 365 is a second mailbox for older emails. In Business Basic and Business Standard it holds 50 GB, in Business Premium it grows up to 1.5 TB. Employees move, change and delete emails there just as in their normal mailbox. Nothing about it is complete or unalterable.
Business Premium includes tools to improve this. A retention policy in Microsoft Purview keeps deleted emails. Preservation Lock prevents administrators from switching that policy off later. Business Basic and Business Standard do not include these policies. Microsoft makes no statement on the GoBD, and searching for an audit runs through eDiscovery, which is cumbersome for auditors and employees. That is why I usually recommend a dedicated email archive.
Journal rule: how every email reaches the archive
An archive that only synchronises the mailboxes from time to time misses every email deleted in between. A journal rule in Exchange Online, by contrast, immediately sends a copy of every email to the archive. Journal rules are included in all Microsoft 365 licences, Business Basic too.
- Emailincoming or outgoing, internal too if you wish
- Exchange Onlinejournal rule applies
- DeliveryMailboxemployees can deleteCopyArchiveoutside Microsoft 365, unalterable until the period ends
Email archiving solutions compared
For context: I am a partner of Hornetsecurity and MailStore, sell their licences and take care of setup and maintenance. The details come from the vendors’ documentation, as of October 2026.
| What the archive does | Hornetsecurity | MailStore | Microsoft 365 with Business Premium | Mail Archiver |
|---|---|---|---|---|
| Captures every email as it is sent and received | ✓ | ✓ | ◐ | – |
| Internal emails | ✓ | ✓ | ✓ | ◐ |
| Unalterable until the period ends | ✓ | ✓ | ◐ | ◐ |
| Separate access for auditors | ✓ | ✓ | ◐ | – |
| Employees search themselves | ✓ | ✓ | ✓ | ✓ |
| Also without Microsoft 365 | ✓ | ✓ | – | ✓ |
| Storage location | cloud, selectable (Germany) | own server | in the tenant | own server |
✓ included · ◐ partly (Microsoft 365: only with a retention policy and Preservation Lock, access via eDiscovery; Mail Archiver: synchronises mailboxes, deletion lock optional) · – not included. Hornetsecurity: internal emails via an additional journal rule. As of October 2026, according to vendor documentation.
The archive is included from 365 Total Protection Plan 2. Incoming and outgoing emails are archived in their original form as they pass through the filter, internal ones via a journal rule. Nothing can be changed or deleted before the period ends, and auditors get time-limited access with a log. I choose where the data is stored for each customer during setup, and I always choose Germany. A good fit when email security and backup are needed anyway.
MailStore Server runs on a Windows server on your premises or in a data centre. Through MailStore Gateway, which comes at no extra cost, a journal rule in Microsoft 365 sends every incoming and outgoing email to the archive. Version 26.4 has an attestation according to IDW PS 880. Employees search directly in Outlook or in the browser.
With Business Premium and properly configured retention policies, emails are kept in the tenant. For audits and for employees searching it is cumbersome, and Microsoft makes no statement on the GoBD. It does not work with Business Basic and Business Standard.
Free, open source and lean. Well suited for saving mailboxes before cancelling a service. It synchronises mailboxes instead of capturing every email via journal, and does not itself claim to meet the GoBD.
Which solution I use
With Hornetsecurity 365 Total Protection, archive, email filter and backup come from one product. More on this in the article Hornetsecurity or Business Premium for email security.
For Microsoft 365 I always set up MailStore with MailStore Gateway and a journal rule. Only then is every email guaranteed to reach the archive.
How I proceed
- Assessment: Which route do your emails take today, what is already kept, and which licences are in place?
- Selection: I recommend a solution that fits your environment and prepare a non-binding quote.
- Setup: I set up the archive, journal rule and retention periods, import existing emails from the mailboxes and show your employees how to search.
- Testing and documentation: I use test emails to check that incoming, outgoing and internal emails arrive completely, and record the setup for your procedural documentation.
- Maintenance: If you wish, I take care of updates, monitoring of the journal rule and regular spot checks on an ongoing basis.
Frequently asked questions
Is it enough to save emails as PDF?
No. Incoming emails must be kept in the format in which they were received. Saving them as PDF loses the headers, and the GoBD explicitly count this against the company. Storing them in folders is not unalterable either.
Is there a GoBD certification for email archives?
No. The tax authorities do not issue certificates. Auditors’ attestations, for example according to IDW PS 880, help when choosing a product but are not binding on the tax office. What matters is how the archive is set up and run.
Does an email archive have to be on premises?
No. Hornetsecurity archives in the cloud, for my customers always in Germany. MailStore runs on your own server, which can also be located in a data centre. What matters is that the archive sits outside the mailbox and employees cannot change it.
What about emails sent before the archive was set up?
The journal rule only captures emails from the moment it is set up. Whatever is still in the mailboxes I import into the archive once. Emails already deleted there cannot be fully recovered afterwards. The sooner the archive is in place, the better.
What does email archiving cost?
It depends on the number of people sending emails and whether you also need security and backup. The archive location matters too: cloud or your own server. In a free consultation I clarify your needs and then prepare a non-binding quote.
Sources
- Retention periods: Section 147 German Fiscal Code (AO), Section 257 German Commercial Code (HGB) (as of October 2026)
- GoBD: Federal Ministry of Finance – GoBD in the AO handbook 2026, Second amendment of 14 July 2025 (PDF), in particular paras. 108–110 (unalterability), 121 (emails), 129–131 (format), 151–155 (procedural documentation), 179–181 (certificates) (as of October 2026, in German)
- Archive mailbox: Microsoft Learn – Exchange Online limits (as of October 2026)
- Retention policies and Preservation Lock: Microsoft Learn – Microsoft Purview service description, Microsoft Learn – Preservation Lock (as of October 2026)
- Journal rules: Microsoft Learn – Configure journaling in Exchange Online (as of October 2026)
- Hornetsecurity: Hornetsecurity – 365 Total Protection, Hornetsecurity – Email Archiving, Hornetsecurity – Journaling for internal emails (as of October 2026)
- MailStore: MailStore Server, MailStore Gateway, MailStore Help – Archiving emails from Microsoft 365, IDW PS 880 attestation for version 26.4 (PDF, in German) (as of October 2026)
- Mail Archiver: mail-archiver.org, GitHub – s1t5/mail-archiver (as of October 2026)
Consistent email signatures for Microsoft 365 with CodeTwo
Set it once, centrally, and it appears under every email from every device: what consistent signatures with CodeTwo achieve, how it works and what it costs, with a price calculator.
Read article→
Privileged Identity Management: admin rights only when needed
Permanent admin rights are the biggest risk in many Microsoft 365 tenants. How PIM grants roles only when needed and for a limited time, which licence it requires and what Business Premium achieves without PIM.
Read article→
Does Microsoft back up my data? Protecting Microsoft 365
Microsoft 365 only keeps deleted data for a few weeks. What is lost after that, what Microsoft 365 Backup is suited for and which third-party solutions also cover Teams chats, Planner and Entra ID.
Read article→