GoBD-Compliant Email Archiving under HGB and AO

The GoBD require that business-relevant emails be retained completely, immutably, traceably, and in machine-readable form. In addition, process documentation describing the entire archiving process must be maintained. Archive meets these principles through immutable storage directly in the mail flow.

No. An official GoBD certification does not exist, so no software can legitimately be called GoBD-certified. The only sound statement is that a solution supports GoBD-compliant archiving. Archive supports these requirements and provides the corresponding process documentation. A testimonial under IDW PS 880 is in preparation.

Commercial and business letters must be retained for six years under § 257 HGB and § 147 AO. For accounting records including invoices, a period of eight years applies following the Fourth Bureaucracy Relief Act, effective 1 January 2025. Annual financial statements and opening balance sheets must be retained for ten years. In each case the period begins at the end of the calendar year in which the document was created.

Process documentation describes in a traceable way how emails are captured, stored, secured, and deleted after the retention period ends. It is part of the GoBD and is presented during a tax audit. For Archive, prepared process documentation is available that can be adapted to the respective organization.

Messages encrypted with S/MIME or PGP are decrypted as they pass through the gateway and then archived in plaintext. This keeps the content permanently searchable and machine-readable, even if the original key is no longer available later.

Once the period ends, the affected emails are removed by the automated deletion policy. The deletion follows the requirements of the GDPR and is logged. Until the period ends, every message stays stored immutably and protected against premature deletion.