GoBD and email archiving, explained
GoBD requires business email that is commercial correspondence, or relates to a booking, to be kept complete, unaltered and traceable for years, not merely retained; that is what the Restow archive, available since 0.1.0, is built for. The rest of this page answers exactly what that means and what the archive does today.
Business email that counts as commercial correspondence, or relates to a booking, is an accounting-relevant record under German law. GoBD, the finance ministry's administrative guidance on proper record-keeping, sets specific, checkable requirements for how that record has to be kept, not just how long.
What the law actually requires
- Retention: 6 years for commercial correspondence (§ 257 HGB, § 147 AO), 8 years for accounting records, 10 years for books and annual financial statements.
- GoBD's core requirement: records must be complete, correct, timely, orderly, unalterable, traceable and machine-evaluable, with procedural documentation and a change log, and kept in their original format, an email staying an email, not a printout.
- "Timely" specifically is why journaling, not a periodic mailbox sync, is the right capture mechanism: a sync only sees what's still there when it runs, while journaling captures a copy before a user can change or delete the original.
- Alongside GDPR: a deletion concept once retention ends, the ability to search by person for a data-subject access request, and a legal hold used only for a documented reason.
How long German records must be kept
§ 257 HGB, § 147 AO. The period starts at the end of the calendar year in which the record was made (§ 147 (4) AO).
Longer while a record still matters for a tax assessment that is not final (§ 147 (3) AO). Not legal advice.
How the hash chain makes a change visible
Each archived item's hash includes the hash before it. Change one item, and every later link stops matching.
What the Restow archive does (since 0.1.0)
In every edition: Microsoft Graph and IMAP sync into an append-only store with a SHA-256 hash chain, chain verification and full-text search. Business and Service Provider add Exchange Online journal receipt over SMTP as the primary capture path, retention policies with an enforced deletion run, and legal hold that suspends deletion. Still in development: self-service search for end users in their own archive, and a signed evidence report. See the roadmap and the design documentation.
What we do not claim
Not "GoBD-certified": no such certificate exists to hold, since GoBD itself is explicit that tax authorities issue no positive attestations. Restow says the archive is designed to support compliant email archiving, built for German GoBD requirements, and name the specific measures behind that statement, never "certified" or "compliant" as a bare, unqualified claim, and never a substitute for review by your own tax advisor or data protection officer. The archive is in every edition; its GoBD layer is in Business and Service Provider.
Outside Germany? See GoBD compared internationally for how these rules compare with the US, the UK, Switzerland and Austria.
Frequently asked
What does GoBD require for email archiving?
Business emails that are commercial correspondence, or relate to a booking, are accounting-relevant records under German law: 6-year retention for commercial correspondence (§ 257 HGB, § 147 AO), 8 years for accounting records. GoBD (the finance ministry's administrative guidance) further requires those records be complete, correct, timely, unalterable, traceable, machine-evaluable, kept in their original format, with procedural documentation and a log of any change.
Is Restow's archive GoBD-certified?
No such certificate exists to claim in the first place. GoBD itself states that tax authorities issue no positive attestations, in an audit or otherwise, and that a third party's certificate does not bind the tax authority either; responsibility stays with the taxpayer. Restow states its archive is designed to support compliant email archiving, built for German GoBD requirements, and names the specific measures, never "certified" or "compliant" as an unqualified claim.
Is the archive layer built for German GoBD requirements available now?
Yes, since 0.1.0. Every edition archives with a hash chain and full-text search; Business and Service Provider add journaling, enforced retention and legal hold. End-user self-service search and a signed evidence report are still in development.