Cloud Email Archive Hosted in Germany
A business email archive has to run for 6 to 10 years: 6 years for business letters (Handelsbriefe), 8 years for invoices and other accounting vouchers, 10 years for books and organisational documents under § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code). If you run it yourself, you plan servers, storage, backups and updates for that whole period. A cloud archive takes that off your hands. The question is who you trust with the data.
Legal basis
- § 257 HGB and § 147 AO set the retention periods: 6 years for business letters, 8 years for accounting vouchers including invoices, 10 years for books, annual financial statements and organisational documents. The period starts at the end of the calendar year.
- Since 1 January 2025 (BEG IV) the period for accounting vouchers is 8 instead of 10 years. It applies to all documents whose old 10-year period had not ended by 31 December 2024 (Art. 97 § 19a EGAO). Banks, insurers and investment firms follow one year later.
- BFH order XI R 15/23 (30 April 2025): emails can be business letters.
- § 146 (2) AO requires electronic books and records to be kept in Germany in principle. § 146 (2a) AO also allows another EU member state.
- GDPR applies to the personal data in your mail. You need a data processing agreement under Art. 28 GDPR, and the provider must show suitable technical and organisational measures.
GoBD does not require an archive on your own premises, so a cloud archive is allowed.
The problem
The legal question is settled. The practical one is trust. Your archive holds quotes, contracts, invoices and personal data for a decade, and you cannot inspect the provider's servers yourself. So you need to ask the right questions: where the data sits, whether customers are separated, who can delete mail, whether every action is logged, and how you get your data out again.
What to check with a provider
| Question | EasyMailArchive |
|---|---|
| Where is the data? | WITT AG data centre in Germany |
| Are customers separated? | Separate database per customer |
| How is it encrypted? | AES-256 with a separate key per customer, TLS in transit |
| Can anyone delete emails? | No delete function for single emails, deletion only when retention ends |
| Is everything logged? | Every action, CSV export |
| Is there a data processing agreement? | Yes, see AVV |
| Can I get out again? | Export as original EML |
| Who is the provider? | Becker-Software, Martin Becker, Germany |
Setup without your own server
- Create an account, 30 days free, no credit card.
- Add a BCC or journal rule on your mail server that sends to
[email protected], or import mailboxes at your hoster via IMAP. Guides for Microsoft 365, Exchange, Google Workspace and IMAP. For journaling, see setting up journaling and IMAP integrations. - Set retention rules per organisation, domain or mailbox, up to 10 years on Starter and Business. Retention in whole years runs to 31 December of the year.
- Set up single sign-on via OIDC (Microsoft Entra ID, Google, Okta), or turn on TOTP two-factor authentication.
Existing mail can be imported via IMAP, Microsoft 365 or Google Workspace, with deduplication.
For IT service providers
If you look after several customers, manage their archives through the partner portal and set up new customers via API. More on the partners page.
Related reading
- Email archiving cost
- Audit-proof email archiving
- GoBD email archiving
- Who must archive email in Germany
See pricing or try it free for 30 days.
This article summarises the law in general terms and is not legal or tax advice.