Regimes · Switzerland
Archiving email under the GeBüV and the Swiss Code of Obligations
The Code of Obligations says what has to be kept for ten years; the Ordinance on the Keeping and Retention of Accounting Records (GeBüV) says how. MailVault is designed to support the GeBüV's technical requirements. Here is which ones those are, and which remain with you.
What the Code of Obligations requires
Under Art. 958f CO, accounting records and vouchers, together with the annual report and the auditor's report, are kept for ten years. The period starts at the end of the financial year. Records and vouchers may be kept electronically if their agreement with the underlying transactions is ensured and they can be made readable again at any time. The Federal Council sets out the details in the GeBüV.
In MailVault you set, per archive, the month your financial year ends in; the period is counted from its end.
And emails?
Since the revision of the accounting law in 2013, Art. 958f CO no longer names business correspondence explicitly. It still has to be kept where it serves as a voucher: the invoice received by email, the order confirmation, the credit note. Because that is hard to separate message by message, and because claims under Art. 127 CO generally become time-barred only after ten years, many companies keep their business correspondence for ten years as a whole.
The GeBüV, article by article
The ordinance is short. For an email archive, Articles 3 to 10 are the ones that count:
| Article | Requires | What MailVault contributes |
|---|---|---|
| Art. 3 Integrity | Keep records so that they cannot be changed without the change being detectable. | SHA-256 per message, a hash-chained audit journal, Ed25519 seals. Finished pack files are locked against writing. The deep verification recomputes every message. |
| Art. 4 Documentation | Document organisation, responsibilities, procedures and infrastructure in working instructions, and keep them as long as the records. | The location of your procedural documentation is recorded under Retention Policy ▸ Organisation and named in every check. A template with the technical part filled in ships with the app. |
| Art. 5 Care | Keep records carefully, in order and protected from harmful influences. | The location of the second copy is recorded under Retention Policy ▸ Organisation and reported in every check. Making the copy is the job of your backup. |
| Art. 6 Availability | Records can be inspected and checked within a reasonable time until the period ends, and made readable without tools on request. | Full-text search, printing on paper and to PDF, and a portable archive that runs in any browser without MailVault. |
| Art. 7 Organisation | Separate archived from current information, or mark it so it can be told apart; regulate responsibility; access within a useful time. | The archive is a separate store, apart from the mailbox. Responsibility is for your organisation to settle; the control report names who checked. |
| Art. 8 Archive | Inventory information systematically, protect it from unauthorised access, record access and entry. | A catalogue of every message with its digest. The journal records what was done to the archive, including searches and exports. Who may open the archive and who enters the room are governed by user accounts, permissions and your premises. |
| Art. 9 Media | Unalterable media, or rewritable ones if integrity is ensured technically, the time of storage can be proven in a way that cannot be falsified, for example by time-stamps, and procedures and logs are documented and kept. | Hard drives and SSDs are rewritable media, so MailVault relies on para. 1(b): hash chain and signatures for integrity, RFC 3161 time-stamps from an authority for the time, and the journal as the log kept with the archive. A copy on media that cannot be written to opens read-only in MailVault, and can be read, verified and handed over from there. |
| Art. 10 Checks | Check media regularly for integrity and readability; log any transfer to other media. | The deep verification reads and recomputes every message. Run as a control, it produces a dated report that a person signs. |
The point most often missing: time
On rewritable media, Art. 9(1)(b)(2) GeBüV requires that the time of storage can be proven in a way that cannot be falsified. A computer's own clock does not do that, because anyone with administrator rights can set it back.
MailVault therefore fetches an RFC 3161 time-stamp for every seal, from SwissSign, a Swiss time-stamping authority, by default; if it cannot be reached, from DigiCert and then FreeTSA. Each archive can name a different authority. A seal without a time-stamp, because no authority could be reached or time-stamping is switched off, is shown as outstanding in the compliance report instead of being passed over in silence.
What remains with you
Part of the GeBüV is organisational and no software can do it. MailVault keeps these points open until they are done:
- The second copy in another place (Art. 5). MailVault records the place and names it in every check; making and refreshing the copy is your backup's job.
- The procedural documentation (Art. 4). Who does what and who deputises can only be described by your organisation. The template for it ships with MailVault, with the technical part filled in.
- The periodic control (Art. 10). The check runs at the press of a button and the report is set. A person has to look and sign.
- Protection against unauthorised access (Art. 8). User accounts, disk encryption, permissions and premises.
And nothing is deleted automatically
In no setting. An expired period is permission to dispose, not an instruction to. Anyone who wants to dispose must have reviewed the list, give a responsible person and a reason, and type the confirmation by hand. Legal holds override everything. More under retention and erasure.
Questions
Do all emails have to be kept for ten years?
Art. 958f CO expressly requires it for accounting records and vouchers, which include emails that serve as vouchers. Because claims generally become time-barred after ten years, many companies keep all their business correspondence that long.
Is Microsoft 365 or the mailbox at my provider enough?
A mailbox is not an archive: messages in it can be changed, moved and deleted without a record, and archived and current mail are not separated as Art. 7 GeBüV requires.
Does the GeBüV require a time-stamping authority?
On rewritable media, Art. 9(1)(b)(2) requires that the time of storage can be proven in a way that cannot be falsified, for example by time-stamps. A computer's own clock does not meet that. MailVault therefore fetches a time-stamp for every seal by itself, from SwissSign by default.
Is MailVault GeBüV-certified?
There is no official certification of software under the GeBüV. MailVault is designed to support the technical requirements; whether a company complies also depends on its organisation and documentation.
Not legal advice. This page describes how the software works. Whether an organisation complies depends on its organisation, processes and documentation as well; for your own case, involve your auditor or legal adviser.
Try it on your own mailboxes.
Thirty days with everything open, no sign-up. Or we set up the first archive with you.