GoBD Email Archiving

GoBD are the German tax authority's rules for electronic books and records. They apply to every business that must keep books or records under German tax or commercial law. Emails fall under them as soon as they are business-relevant: quotes, order confirmations, invoices, complaints, contract changes.

Legal basis

§ 257 HGB requires merchants to keep received business letters and copies of sent ones.
§ 147 AO extends this to all tax-relevant documents, including for businesses that are not merchants.
GoBD (Federal Ministry of Finance letter of 28 November 2019, amended since) defines how electronic records are kept: in their original format, unalterable, complete and machine-readable.

Retention periods

Since the Fourth Bureaucracy Relief Act (BEG IV):

Document	Period	Legal basis
Business letters	6 years	§ 257 (4) HGB, § 147 (3) AO
Accounting vouchers, e.g. invoices	8 years	§ 257 (4) HGB, § 147 (3) AO, § 14b UStG
Books, annual financial statements, organisational documents	10 years	§ 257 (4) HGB, § 147 (3) AO

The period starts at the end of the calendar year. An invoice received by email in March 2026 must be kept until the end of 2034. As long as a document matters for a tax assessment that is still open, the period does not end. Banks, insurers and investment firms have special rules.

What GoBD requires from an email archive

Completeness. Every relevant email is captured, inbound and outbound, before anyone can delete it.
Immutability. Archived emails cannot be changed or deleted unnoticed.
Original form. The email is kept as it was received or sent, with attachments.
Readability. You can find every email for the whole period and show it to the auditor.
Traceability. Access and settings changes are logged.
Procedural documentation. You describe in writing how your company archives email.

How to set it up with EasyMailArchive

Create an account. Sign up and try it for 30 days, no credit card.
Connect your mail flow. You get a relay address like [email protected]. A BCC rule in Microsoft 365, Exchange, Google Workspace or Postfix sends a copy of every email there. Mailboxes without BCC rules can be fetched over IMAP. See the setup guide.
Set retention. Rules define how long mail is kept per organisation, domain or mailbox. There is no delete function for single emails. Mail is only deleted automatically when its retention period ends.
Import existing mail. Bring older emails in over IMAP or through the Microsoft 365 and Google Workspace connections.
Write your procedural documentation. Describe capture, retention, access and deletion.

Every email is encrypted with AES-256 and a separate key per customer, stored in a data centre in Germany. Each customer has its own database. For the auditor you export emails as original EML or as PDF with SHA-256 checksums. The log of all actions exports as CSV.

See pricing or try it free for 30 days.

This article summarises the law in general terms and is not legal or tax advice.

Frequently Asked Questions

Does GoBD require archiving every email?

Retention applies to emails that are business letters, accounting vouchers or other tax-relevant documents. Since that is hard to separate reliably day to day, most companies archive all business email and exclude private mail and spam with rules.

How long must emails be kept under GoBD?

Business letters 6 years, accounting vouchers such as invoices 8 years, books, annual financial statements and organisational documents 10 years. The period starts at the end of the calendar year in which the document was created or received.

Is leaving emails in the mailbox enough?

No. Users and administrators can delete or move emails in a mailbox without any log. GoBD requires documents to be kept complete, unalterable and readable at all times.

Is EasyMailArchive GoBD certified?

There is no official GoBD certification for software. Compliance comes from software, processes and your procedural documentation together. EasyMailArchive covers the technical side: complete capture, immutability, logging and export.