Short answer: archive, backup and retention are three things
Retains selected messages for defined periods.
Restores operations after a failure or data loss.
Determines what is kept, for how long, and when it is deleted.
Many companies have a backup, but not an archive, and this is often only noticeable when a mail from an old project is searched for, a reviewer requests documents or an employee leaves the company, so clean archiving does not start with the software, but with the question: Which messages have to be preserved for what reason and for how long?
1. Why email archiving is important
In many companies, email is the most important place for contracts, offers, invoices, customer agreements and project knowledge. If a mailbox is deleted, an employee leaves or the mail provider changes, this knowledge can quickly disappear. An archive creates traceability – technically and organizationally.
- ✓ Traceability: Who promised what when?
- ✓ Storage: Tax or industry-specific relevant correspondence is maintained.
- ✓ Securing evidence: Contiguous processes instead of individual forwarded mails.
- ✓ Offboarding: Mailboxes of departing employees are not lost.
- ✓ Change of provider: Data can be exported from the archive and migrated.
At the same time, an archive is not a license to store everything indefinitely. Data protection requires a clear purpose, limited access and a deletion concept.
2. Legal framework in Austria – without blanket promises
Whether and for how long you have to keep emails depends on the type of documents, the industry and the legal form. In Austria, tax-relevant documents must generally be kept for seven years; longer deadlines may apply for certain documents. An email can be tax relevant, but it doesn't have to be. Private messages, newsletters or appointments without a business connection generally do not belong in an audit-proof archive.
From a data protection perspective, you need a legal basis, defined purposes, data minimization, access restrictions and a deletion routine. With an external archive service provider, an order processing contract is also included. An archive is “GDPR compliant” not just through purchasing software, but through the correct configuration and organization.
3. What belongs in an email archive?
The sensible scope is defined for each company. Typical are:
Offers, orders, invoices, cancellations, agreements.
PDFs, tables, contracts and technical documents that belong to an email.
Sender, recipient, date, subject, message ID and envelope data.
Role mailboxes such as office@, sales@ or project@.
Mailboxes of departing employees, temporary and dedicated.
Only if they document business transactions, e.g. B. Order or approval emails.
Calendars, contacts and chat messages can be included, but are a separate database. Before the project, clarify which sources really need to be covered - otherwise the scope will grow uncontrollably.
4. Technical variants: Journaling, retention and IMAP archive
There is no “one” type of archiving. The right option depends on where your mailboxes are and what evidence you need.
| Variant | Function | Typical use |
|---|---|---|
| Journaling | Copies emails to an archive during transport. | Audit-proof recording of all incoming and outgoing messages. |
| Retention | Retains mailbox contents according to rules. | Microsoft 365, Google Workspace or Exchange with retention policies. |
| IMAP archive | Synchronizes mailboxes into a separate archive system. | Provider-independent long-term archiving and migration. |
| Gateway Archives | Archived centrally on the mail gateway. | Multiple domains and locations with their own mail infrastructure. |
Journaling is the most complete option, but is not available with every provider. Retention rules are convenient, but they must be configured so that they cannot be changed and checked regularly. An IMAP archive is more flexible, but only records what is actually in the mailbox. For many companies, a combination makes sense.
5. Requirements for a resilient email archive
Messages may not be changed or deleted unnoticed after they have been filed.
Accesses, exports and deletions are logged.
Search via subject, content, attachments and metadata – with useful filters.
Defined mailboxes or processes remain blocked even after the deadline expires.
Data can be exported completely and comprehensibly.
TLS in transit, encryption at rest and controlled keys.
Separate roles and clients; only authorized people see sensitive content.
After the deadline has expired, it will be deleted in a controlled and documented manner.
A common mistake: the archive is only viewed as a “repository”. Good systems also answer the questions: Who is allowed to search? How are hits exported? What happens if you change provider? And how is it proven that deletion has actually taken place?
6. Migration and adoption
An archive migration begins with an inventory: What mailboxes, domains, mail servers and legacy systems are there? What data volumes and formats are available? What deadlines and deletion rules should apply? This is followed by a test with a small group before all mailboxes are converted.
- 1. Set scope and retention rules.
- 2. Select archive system and operating model.
- 3. Export existing data and check samples.
- 4. Enable journaling or synchronization.
- 5. Test search, rights and legal hold.
- 6. Document the deletion concept and responsibilities.
- 7. Switch off the old system in a controlled manner after a successful test.
When changing providers, MX and DNS entries should only be changed after successful tests. SPF, DKIM and DMARC must map to the new infrastructure, otherwise emails will end up in spam or be rejected.
7. How much does email archiving cost?
There is no reliable flat rate because the effort varies greatly. The most important cost factors:
- • Number of mailboxes and domains
- • Data volume and retention period
- • Journaling availability and desired sources
- • Migration from legacy systems and cleaning of duplicates
- • Full text search, attachment indexing and legal hold
- • Cloud or on-premises operations, backup and monitoring
- • Training, documentation and ongoing support
For a small company with a few mailboxes, getting started is significantly cheaper than for a law firm or a company with several locations and an audit-proof search. After a short scoping, you will receive a fixed price for the agreed scope - without any hidden positions.
8. Planning checklist
The checkboxes are a reminder, not a saved status.
Questions about email archiving
No. A backup is used to restore data after a failure and is rotated regularly. An archive is used for orderly storage over defined periods - with search, access rights, audit trail and deletion concept. A deleted email disappears from the backup at some point and remains in the archive until the deadline expires.
This depends on the type of company, industry and type of documents. In Austria, tax-relevant documents must generally be kept for seven years; longer deadlines may apply for certain documents. It is not possible to say in general terms whether an email falls under this category. This is not legal or tax advice - clarify the specific deadlines with your tax advisor or lawyer.
With journaling, the mail system creates an additional copy of the message when it is sent or received and delivers it to an archive system. This also records emails that users later delete from their mailbox. Whether and how journaling is available depends on the mail provider and the tariff selected.
It can be a technical basis, but is not automatic proof of legality. The decisive factors are the right license, the specific configuration, unchangeable storage, legal hold, export options and a documented deletion concept. Also check whether the data can be taken with you in its entirety if you change provider.
No. A blanket retention of all private or irrelevant messages is neither necessary nor privacy-friendly. Define which mailboxes, roles and business transactions are relevant and only archive the necessary scope. Data minimization and a deletion concept are part of a clean solution.
The effort depends on the number of mailboxes, the amount of data, the retention period, search requirements, migration and the operating model. A small solution is significantly cheaper than an audit-proof archive with legal hold and multiple sources. After a short scoping, you will receive a fixed price for the agreed scope.
Yes, if the old system allows full export. What is important is the transfer of messages and metadata, the avoidance of duplicates, the mapping of retention periods and a test with samples. In the case of closed or non-exportable systems, migration can be complex or legally sensitive.
Yes, but not automatically by purchasing software. What is required is a legal basis, clear purposes, access restrictions, encryption, a deletion concept and - for external service providers - an order processing agreement. Archives may not be used arbitrarily for other purposes.