GoBD and email archiving, explained
By Lucas Flores, IT Systeme Flores UG. Last updated
This article is the short introduction. The full guide, with every requirement, a checklist and the sources, is on the page Email archiving under the GoBD.
GoBD requires business email that is commercial correspondence, or relates to a booking, to be kept complete, unaltered and traceable for years, not merely retained; that is what the Restow archive, available since 0.1.0, is built to support, with a hash chain that makes any change detectable. The rest of this page answers exactly what that means and what the archive does today.
Business email that counts as commercial correspondence, or relates to a booking, is an accounting-relevant record under German law. GoBD, the finance ministry's administrative guidance on proper record-keeping, sets specific, checkable requirements for how that record has to be kept, not just how long.
What the law actually requires
- Retention: 6 years for commercial correspondence (§ 257 HGB, § 147 AO), 8 years for accounting records, 10 years for books and annual financial statements.
- GoBD's core requirement: records must be complete, correct, timely, orderly, unalterable, traceable and machine-evaluable, with procedural documentation and a change log, and kept in their original format, an email staying an email, not a printout.
- "Timely" specifically is why capture in transport, by journaling or by a copy the mail provider forwards, is the stronger mechanism: it takes a copy before a user can change or delete the original, while a capture from the mailbox only sees what is still there when it fetches the mail. Restow offers both and labels which is which.
- Alongside GDPR: a deletion concept once retention ends, the ability to search by person for a data-subject access request, and a legal hold used only for a documented reason.
How long German records must be kept
§ 257 HGB, § 147 AO. The period starts at the end of the calendar year in which the record was made (§ 147 (4) AO).
Longer while a record still matters for a tax assessment that is not final (§ 147 (3) AO). Not legal advice.
How the hash chain makes a change visible
Each archived item's hash includes the hash before it. Change one item, and every later link stops matching.
What the Restow archive does (since 0.1.0)
In every edition: an append-only archive with a SHA-256 hash chain and chain verification, searchable by subject, addresses and, for imported mail, body text (attachment content is not searched). In every edition the archive is fed by mail import with the option to archive at the same time; imported mail is captured after the fact, and its retention starts at the import date. Business and Service Provider add Exchange Online journal receipt over SMTP and, for IMAP providers and Google Workspace, copies the provider forwards: the capture ways that match the argument above, because the copy is made in transport (the receiver needs a TLS certificate of your own). Since 0.4.4 they also add capture from the mailboxes, by Microsoft Graph change notifications for Microsoft 365 and by IMAP sync with IDLE for IMAP and Google Workspace, each with a one-time takeover of the mail already there and one archived item per mail however many ways captured it. That capture is near-time: it fetches a mail shortly after delivery, a mail moved or deleted in between can be missed, and Restow does not claim it is complete. It was tested against simulated services, not against a real Microsoft 365 or Google Workspace tenant. The mail job editor labels every way "At transport" or "Near-time". On top come retention with an enforced deletion run and legal hold that suspends deletion. Restow talks to Microsoft only through Microsoft Graph, and Microsoft began switching off EWS for Exchange Online on 1 October 2026 (for good on 1 April 2027). Planned: self-service search for end users in their own archive, and a signed PDF evidence report. See the roadmap and the design documentation.
The hash chain makes a change detectable (tamper-evident); it does not make one impossible. Since 0.4.0 immutability can be switched on per repository (storage target); it is off until an administrator does so. On S3 with Object Lock (compliance or governance mode, 1 to 3650 days) the packs, manifests and keys of the chunk store are locked; the archive writes its message content through that same store, and its item records keep their own retention, as before. On a directory or an NFS share Restow only delays deletion, which is not immutability, the installation's default repository cannot be made immutable, and the lock was so far tested against a simulated S3 service only. See immutable backups.
What we do not claim
Not "GoBD-certified": no such certificate exists to hold, since GoBD itself is explicit that tax authorities issue no positive attestations. Restow says the archive is designed for GoBD-compliant use and names the specific measures behind that statement, never "certified" or "compliant" as a bare, unqualified claim, and never a substitute for review by your own tax advisor or data protection officer. The archive is in every edition; capture from the mailboxes, journal receipt, enforced retention deletion and legal hold are in Business and Service Provider.
Outside Germany? See Why German law is a good yardstick for data protection and backup quality for how these rules compare with the US, the UK, Switzerland and Austria. For a company operating in Germany, the requirements, what Restow covers and a checklist are on one page: email archiving under the GoBD.
Frequently asked
What does GoBD require for email archiving?
Business emails that are commercial correspondence, or relate to a booking, are accounting-relevant records under German law: 6-year retention for commercial correspondence (§ 257 HGB, § 147 AO), 8 years for accounting records. GoBD (the finance ministry's administrative guidance) further requires those records be complete, correct, timely, unalterable, traceable, machine-evaluable, kept in their original format, with procedural documentation and a log of any change.
Is Restow's archive GoBD-certified?
No such certificate exists to claim in the first place. GoBD itself states that tax authorities issue no positive attestations, in an audit or otherwise, and that a third party's certificate does not bind the tax authority either; responsibility stays with the taxpayer. Restow states its archive is designed for GoBD-compliant use and names the specific measures, never "certified" or "compliant" as an unqualified claim.
Is the archive layer designed for GoBD-compliant use available now?
Yes, with limits, since 0.1.0. Every edition archives with a hash chain and a search over subject, addresses and, for imported mail, body text; Business and Service Provider add journal receipt and forwarded copies (in transport), capture from the mailboxes by Microsoft Graph and IMAP sync since 0.4.4 (near-time, not complete, tested against simulated services only), enforced retention and legal hold. End-user self-service search and a signed evidence report are planned.
Read more in Learn: the backup glossary (archive, hash chain, legal hold, retention) →
Read more in Learn: backup vs. archive, and why one does not replace the other →