Email archiving under the GoBD
By Lucas Flores, IT Systeme Flores UG. Last updated
The GoBD are the German tax authorities' rules for keeping books and records electronically, and they apply to companies operating in Germany that keep books and records for German tax purposes. For email they mean: a message that is a commercial letter or an accounting document has to be kept complete, unaltered and traceable for six to ten years, usually six for commercial letters and eight for accounting vouchers, and the company has to be able to describe how it does that in a procedural documentation (§ 147 AO, § 257 HGB). Restow's archive is designed for GoBD-compliant use: it records mail in an append-only SHA-256 hash chain that you can verify, enforces retention and legal hold in Business and Service Provider, and exports in open formats. It carries no certificate, because the tax authorities issue none and a third party's certificate does not bind them.
What do the GoBD require for email?
Five things, and all of them are about the record, not the mailbox: it must be unalterable, complete, traceable, kept for the statutory period and described in a procedural documentation. An email that is a commercial letter or relates to a booking stays an email; a printout is not enough.
Immutability (Unveränderbarkeit)
Once a message has been captured, nobody, administrators included, may change it so that the original content can no longer be determined, and changes have to be logged. For an archive this means more than a read-only flag: the system has to show whether something was altered or removed afterwards.
Completeness (Vollständigkeit)
Every relevant message has to be captured, and in time. That is why capture at transport is the stronger path: an Exchange Online journal copy, or a copy that the mail provider forwards, is made while the message is being delivered, before a user can edit or delete the original. Capture from the mailbox, by Microsoft Graph or IMAP sync, fetches a mail shortly after delivery; a mail that is moved or deleted in between can be missed, so Restow labels it near-time and does not claim it is complete. Restow offers both and says which one a mail came through.
Traceability (Nachvollziehbarkeit)
An expert third party, typically an auditor, must be able to follow a record from capture to retrieval within a reasonable time: what was captured when, and what was done with it since. A log of reads, exports and changes is part of that.
Retention periods (Aufbewahrungsfristen)
§ 147 (3) AO and § 257 (4) HGB set ten years for books, records and annual financial statements, eight years for accounting vouchers and six years for other documents, which includes commercial letters. The period starts at the end of the calendar year in which the letter was received or sent. During it the data must be available at any time and machine-evaluable (§ 147 (2) AO), and in an audit the tax authority can ask for read access, a machine evaluation or a transfer in a machine-readable format (§ 147 (6) AO).
Which email falls into which class, when the period starts and when you may delete: Email retention periods in Germany: 6, 8 or 10 years.
Procedural documentation (Verfahrensdokumentation)
The GoBD expect a description of the process: how mail is captured, where it is stored, who has access, how retention and deletion work and which controls apply. It is the company's own document. Software can supply facts for it, but none can write it for you.
What belongs in it for email archiving, with a template to download: Procedural documentation for email archiving.
What does Restow cover?
Capture, tamper evidence, traceability, retention, legal hold, search and export. The table says in which edition and since which version each part ships, and what is still planned. The design behind it is described in the documentation on GoBD and evidence.
| Requirement | What Restow does | Edition | Status |
|---|---|---|---|
| Completeness: capture in time | Exchange Online journal receipt over SMTP and, since 0.4.4, plain copies that a mail provider forwards; both need a TLS certificate of your own. | Business and Service Provider | Available, since 0.1.0 |
| Completeness: imported mail | Mail files (EML, MSG, MBOX, MailStore export) can be archived while they are imported. Imported mail is captured after the fact; its retention starts at the import. | Every edition | Available, since 0.1.0 |
| Completeness: capture from the mailbox (near-time) | Microsoft 365 by Microsoft Graph change notifications, IMAP and Google Workspace by IMAP sync with IDLE, each with a one-time takeover of the mail already there. Not complete: a mail moved or deleted right after delivery can be missed. Restow cannot see whether the Microsoft 365 tenant keeps deleted mail (a hold); an administrator confirms it. | Business and Service Provider | Available, since 0.4.4 |
| Immutability: tamper evidence | An append-only archive with a SHA-256 hash chain. The chain check verifies every link, the nightly anchors and, if you like, a sample of message contents. | Every edition | Available, since 0.1.0; chain check and nightly anchors since 0.3.1 |
| Immutability: the storage itself | An administrator can turn on S3 Object Lock per repository (compliance or governance, 1 to 3650 days). It locks the packs with the message content, the manifests and the wrapped keys, and the storage itself refuses a deletion until the lock has run out; the archive's item records keep their own retention, as before. Not locked: checkpoints, staging, exports, downloads and some index and lock files. For local directories and NFS shares a deletion delay makes Restow's own code refuse to delete or overwrite a file, which protects against misuse of Restow but is not immutability by the storage; the interface says so. Both are off until an administrator turns them on, and the installation's default repository cannot be made immutable. Tested against a simulated S3 with Object Lock, not yet a real service. The GoBD accept hardware, software or organisational measures for unalterability (Rz. 110); this is one such measure, not a certification. | Every edition | Available, since 0.4.0; off until turned on |
| Traceability | Every read and restore is recorded in a hash-chained audit log in every edition. Business and Service Provider add the viewer and the export (CSV, JSON with hashes). | Every edition; viewer and export Business and up | Available, since 0.1.0; export available, since 0.3.1 |
| Retention periods | Retention policies with an enforced deletion run. A legal hold suspends deletion for the items it covers. | Business and Service Provider | Available, since 0.1.0 |
| Legal hold | Per tenant or per mailbox. A hold suspends deletion until it is released, and releasing needs a reason that is audited. | Business and Service Provider | Available; audited release since 0.3.1 |
| Search, reading and export | Search over subject, addresses and the body text of imported mail (not attachments), with paging and filters by sender, date and mailbox; reading and download as .eml; export as EML in a ZIP or as MBOX, both open formats. | Every edition | Available, since 0.1.0 |
| Auditor export and evidence report | An auditor export that carries the chain values, a signed PDF evidence report, and a visible proof per mail in the archive. Not built. | See the roadmap | Planned |
What Business and Service Provider add in total, as the product facts state it:
- Scheduled reports (daily, weekly or monthly summary by e-mail) (available, since 0.1.0)
- GoBD layer for the archive (Exchange Online journal receipt and forwarded copies, enforced retention, legal hold) (available, since 0.1.0)
- Archive capture beyond journaling (Microsoft 365 by Graph, IMAP and Google Workspace by IMAP sync, copies a mail provider forwards; Graph and IMAP are near-time, not complete) (available)
- Audit log viewer (search, filters, details, hash-chain verification) (available, since 0.1.0)
- Audit log export (CSV, JSON with hashes) (available, since 0.3.1)
- Sign-in with Microsoft and single sign-on (SSO) (planned)
- Four-eyes approval (planned)
- Signed restore proof (planned)
What remains your job?
The process around the software. Restow gives you a tamper-evident archive and the facts to describe it; the decisions, the documentation and the controls stay with your company.
- Write and maintain the procedural documentation. Restow does not write it, and the GoBD hold the company responsible for it.
- Decide with your tax advisor which mail has to be archived and for how long. Restow enforces the periods you configure; it does not know how your mail is classified.
- Choose and set up the capture ways per mail job. Exchange Online journaling and forwarding need the journal receiver and a TLS certificate of your own. Mail that no chosen way captured and that was not imported is not in the archive.
- Choose and protect the storage: know what the target enforces, keep a copy on a second location and restrict access.
- Run the chain verification regularly, keep the results, and try an export the way an auditor would ask for it.
- Handle data protection: a deletion concept after retention ends, search by person for access requests, and a legal hold only with a documented reason.
- Have your tax advisor confirm the whole set-up. Restow is a beta and not a substitute for that review.
A checklist to work through
Ten steps to go through with your tax advisor. It is plain text on this page: nothing to download and no form to fill in.
- Agree with your tax advisor which mail counts as commercial letters or accounting documents.
- Write the procedural documentation: capture, storage, access, retention, deletion, controls.
- Choose the capture ways per mail job: Exchange Online journaling or forwarding at the mail provider capture before a user can change a mail (they need the journal receiver and a TLS certificate of your own); Graph and IMAP sync capture shortly after delivery and are not complete.
- Set retention periods that match the classes you agreed on, and decide who may place and release a legal hold.
- Choose the storage target and know what it enforces: with S3 Object Lock turned on per repository the storage itself, on local and NFS only the deletion delay of Restow's own code.
- Keep a copy of the archive on a second location and restrict who can reach the storage.
- Run the chain verification on a schedule and keep the results with your documentation.
- Try an export and a search the way an auditor would ask for them (§ 147 (6) AO), before there is an audit.
- Write down the deletion concept after retention ends, and check it against data protection law.
- Have your tax advisor review the whole set-up, and repeat the review when the setup changes.
Frequently asked
What is GoBD archiving?
GoBD archiving means keeping business email the way the GoBD, the German tax authorities' rules for electronic books and records, require: complete, unaltered, traceable, for the statutory period of six to ten years, and described in a procedural documentation (§ 147 AO, § 257 HGB). GoBD is short for the Federal Ministry of Finance's principles for the proper keeping and retention of books, records and documents in electronic form and for data access. A backup does not replace it, because an archive has to show whether a message was changed or removed afterwards. Restow's archive is designed for GoBD-compliant use; it carries no certificate, and your tax advisor confirms what applies to your company.
Is Restow suitable for GoBD-compliant use?
Restow's archive is designed for GoBD-compliant use: it records mail in an append-only hash chain that can be verified, enforces retention and legal hold in Business and Service Provider, and exports in open formats. Whether your whole process is compliant depends on your procedural documentation, your configuration and your own controls, and only you and your tax advisor can confirm that. No software can certify it for you.
Is Restow GoBD-certified?
No. There is no official GoBD certificate. The GoBD themselves state that the tax authorities issue no positive attestations, neither in an audit nor as a binding ruling, and that a third party's certificate does not bind them either. Responsibility stays with the taxpayer. That is why Restow says what it does and names the measures, instead of claiming a label.
How long do I have to keep business emails in Germany?
As a rule six years for commercial letters and other documents, eight years for accounting vouchers (Buchungsbelege) and ten years for books, records and annual financial statements (§ 147 (3) AO, § 257 (4) HGB). The period starts at the end of the calendar year in which the letter was received or sent, and it does not run out while the document matters for a tax whose assessment period is still open. Which of your emails fall into which class is a question for your tax advisor.
Is a backup the same as an archive?
No. A backup lets you restore a mailbox after data was lost or damaged. An archive keeps a verifiable copy of each message for the retention period, whatever later happens to the mailbox. Restow has both and keeps them apart: the backup restores, the archive proves. The documentation explains the difference.
Does Restow archive all my Microsoft 365 mail automatically?
Only for the mailboxes of a mail job that archives, and by the capture way you choose. In Business and Service Provider, a job can capture Microsoft 365 mailboxes by Microsoft Graph change notifications (near-time, shortly after delivery) or by Exchange Online journaling (in transport, with a TLS certificate of your own), and IMAP and Google Workspace accounts by IMAP sync (near-time) or by copies that the mail provider forwards (in transport). A new job that archives starts with Graph and IMAP sync; jobs that archived before keep journaling only until an administrator switches another way on. Near-time capture is not complete: a mail moved or deleted right after delivery can be missed. Mail that no chosen way captured and that was not imported is not in the archive. The ways since 0.4.4 were tested against simulated services, not against a real Microsoft 365 or Google Workspace tenant.
Is the archive stored immutably?
The archive is append-only with a SHA-256 hash chain, so a change is detectable, not impossible. Since 0.4.0 an administrator can also turn on immutability per repository: with S3 Object Lock (compliance or governance, 1 to 3650 days) the storage itself refuses to delete the locked packs, manifests and keys until the lock has run out, and the archive's item records keep their own retention. It is off until you turn it on, the installation's default repository cannot be made immutable, a directory or NFS share gets only a deletion delay that is not immutability, and it has so far been tested against a simulated S3 service only. It is one technical measure, not a GoBD certification.
Which edition do I need?
The archive itself, with hash chain, chain verification, search and export, is in every edition, Community included. Business (€476 once, net; list price €595) adds archive capture from the mailboxes (Graph, IMAP sync), journal receipt and forwarded copies, enforced retention, legal hold and the audit log viewer and export. For capturing mail from the mailboxes or before a user can change it, you need Business or Service Provider.
Sources and further reading
- § 147 AO and § 257 HGB , read on 14 October 2026.
- GoBD (BMF letter of 28 November 2019), amended by the letter of 11 March 2024 and the letter of 14 July 2025.
- GoBD and evidence and backup versus archive in the Restow documentation.
- GoBD and email archiving, explained, Why German law is a good yardstick for data protection and backup quality, Restow compared with MailStore.
Pricing and editions · Mail import and export · Learn: backup vs. archive · Learn: email retention periods · Learn: procedural documentation · Learn: GDPR and backups · Backup glossary