Sign In
Guide · Email Archiving

Choosing emailarchiving softwarethe right way.

Every business email is subject to retention obligations. This guide shows what matters when choosing an archiving solution – from legal certainty to operating model to migration – and how Conbool Archive meets these criteria.

Request a demoRequest advice

Email archiving software: selection, vendors and criteria

A practical guide to selecting an audit-proof email archiving solution – with the criteria that matter in practice.

Why archiving is mandatory.

6–10 yrs
statutory retention under German commercial and tax law
§ 257
HGB and § 147 AO as the legal basis
GoBD
immutability and traceability
GDPR
obligation to delete after expiry

The three core questions

Before you compare vendors, settle these three points – they decide the most.

Legal certainty

Does the solution store immutably following the WORM principle and prove integrity end to end? Does it set retention periods automatically and delete them traceably after expiry?

Operating model

Cloud, on-premises or both? What matters is who the contracting party and data processor is and in which data centers the data resides – for GDPR, NIS-2 and critical infrastructure.

Searchability

Is the entire archive searchable in full text – including S/MIME and PGP mail decrypted by the gateway? Without searchability, every eDiscovery becomes slow.

What good archiving software must do

The functions that truly matter in the selection.

Complete capture

Inbound and outbound as well as internal messages, directly in the mail flow or via journaling. Completeness through sequence checking and delivery retry.

Periods and deletion concept

Retention classes (6, 8, 10 years) rule-based per mailbox, direction and group, plus automated, logged deletion after expiry.

Immutability (WORM)

Software-side WORM, in the compliance tier with object lock at the object store, secured by an externally anchored hash chain.

Full-text search

Search over subject, content, attachments and mailbox – including gateway-decrypted, previously encrypted messages.

eDiscovery and legal hold

Cases, holds and dual control for controlled releases, with a hash-chained audit log and SIEM export.

Migration and export

Adopt legacy data from PST, MBOX and EML server-side, export as EML or MBOX, integrity proof via SHA-256.

What to watch for in the selection

Four criteria that separate good from average archiving.

EU data sovereignty

A German contracting party, EU data centers and a data location named in the DPA. Conbool Archive meets this and offers on-premises from the same codebase.

Cleartext search of encrypted mail

Many archives store S/MIME only as ciphertext. Conbool additionally archives gateway-decrypted mail in cleartext – searchable for eDiscovery.

Capturing internal mail

A gateway tap does not see purely internal messages. Via journaling, Conbool also captures mailbox-to-mailbox mail completely.

Consolidation

Archiving, inbound protection, encryption and signatures in one suite instead of several vendors – one portal, one audit log, one licensing logic.

Three steps to the right solution

1

1. Clarify requirements

Mailbox count, legal norms (commercial/tax law, GDPR, industry-specific), operating model and the volume of encrypted mail determine the fit.

2

2. Evaluate vendors

Compare legal certainty, data location, searchability, capture methods and migration path. Test search on real data.

3

3. Migrate without a gap

Export and adopt legacy data, switch capture in parallel, decommission the old solution only after verified completeness.

FAQ

Is email archiving legally mandatory?
For business emails, yes. Commercial and business letters as well as accounting documents are subject to retention obligations under German commercial and tax law. The GoBD additionally require immutability and traceability. A plain mailbox store is not enough.
How long must emails be retained?
Depending on content, 6, 8 or 10 years: commercial and business letters 6 years, accounting documents 8 years since 2025, books and annual financial statements 10 years. The period starts at the end of the calendar year in which the message originated.
Cloud or on-premises – which is better?
Both are possible. What matters is data location, contracting party and operating effort. Conbool Archive runs as an EU cloud or fully on-premises from the same codebase, so you don't have to commit early.
Can archiving make encrypted emails searchable?
Only if the message is available decrypted before archiving. Conbool decrypts S/MIME and PGP in the gateway and additionally archives the cleartext searchably; the encrypted original stays in the mailbox.
What does email archiving software cost?
Licensing per mailbox is common, sometimes with an annual update option. The total price depends on mailbox count, operating model and modules. Conbool Archive is part of the suite and is priced per mailbox with add-on modules.
How do I migrate from an existing archive?
Export the legacy data as EML or PST and ingest it server-side. Capture of new mail is switched in parallel, and the old solution is decommissioned only after verified completeness.

Archiving that meets the criteria.

Conbool Archive: audit-proof, EU hosting, cleartext search of encrypted mail and an integrated suite. See it in 30 minutes in your setup.

Request a demoRequest advice
Conbool ArchiveGoBD-compliant archivingArchiving for Microsoft 365MailStore alternative