Regimes · Germany
Archiving email under Germany's GoBD
The Commercial Code (HGB) and the Fiscal Code (AO) say what has to be kept and for how long; the Federal Ministry of Finance's GoBD say how it has to be done electronically. Since 2025, accounting vouchers are kept for eight years instead of ten.
How long
§ 257 HGB and § 147 AO require the orderly keeping of commercial books, financial statements, commercial and business letters received, copies of those sent, and accounting vouchers. The periods:
| Records | Period |
|---|---|
| Commercial books, records, inventories, financial statements, management reports, opening balance sheet | 10 years |
| Accounting vouchers, including invoices | 8 years |
| Commercial and business letters received, and copies of those sent | 6 years |
| Other records relevant to taxation | 6 years |
The reduction for accounting vouchers from ten to eight years has applied since 1 January 2025 (Fourth Bureaucracy Relief Act) to every voucher whose old period had not yet run out by then. Different rules apply to credit institutions, insurers and securities institutions.
When an email is a business letter
An email is a commercial or business letter if it prepares, concludes, carries out or reverses a transaction: a quotation, an order, an order confirmation, a complaint. If it contains an invoice, it is also an accounting voucher. Advertising, newsletters and simple scheduling messages, for example, carry no retention duty.
What the GoBD require technically
The GoBD set out the principles of proper bookkeeping for electronic records. For an email archive these are the ones that matter most:
| Principle | What MailVault contributes |
|---|---|
| Unalterability | Content-addressed storage: each message is identified by its SHA-256, finished pack files are locked against writing, and the audit journal is hash-chained and sealed. |
| Traceability and verifiability | A complete trail from intake to hand-over: collection, import, search, export, erasure, hold and every policy change with its reason. |
| Completeness | Ongoing scheduled collection, even without a window open; the compliance view reports when none is set up. |
| Order and findability | Full-text search in messages and attachments, with fields and date limits. |
| Machine-readable evaluation | Export of the original messages with index.csv and index.json, the message index as CSV or SQL, read-only SQL queries. |
| Procedural documentation | The location of your documentation is recorded under Retention Policy ▸ Organisation and named in every check. A template with the technical part filled in ships with the app. |
Data access during a tax audit
Under § 147(6) AO the tax authority can, during an audit, inspect the stored data and require it to be provided in machine-readable form. MailVault hands over a selection or the whole archive for this: the original messages, an index with date, participants, subject, retention class and digest for each, the compliance report, the seals, and instructions for recomputing all of it without MailVault.
E-invoices that arrive by email
Since 2025, businesses in Germany have to be able to receive e-invoices. When an XRechnung or ZUGFeRD invoice arrives attached to an email, the structured original is the voucher and has to be kept in that format. MailVault stores the message as the server delivers it, with every attachment in its original format, and checks on reading that it is unchanged byte for byte.
How MailVault handles the periods
The retention classes that ship with the app count ten years from the end of the calendar year, the longest period that can apply here. For commercial letters at six years or vouchers at eight, you can add classes of your own and assign them with rules. Where the GeBüV applies to the same archive, the later of the financial and the calendar year end counts. Nothing is deleted automatically when a period ends; disposal happens only once a person has reviewed the list and confirmed it with their name and a reason.
Questions
How long must emails be kept under the GoBD?
Business letters for six years, emails that serve as vouchers, such as invoices, for eight years since 2025, each from the end of the calendar year. Books and financial statements for ten years.
Is a mailbox in Outlook or Microsoft 365 GoBD-compliant?
A mailbox alone does not meet the requirements: messages in it can be changed and deleted without a traceable record.
Do I need procedural documentation?
Yes, the GoBD require it. A template for email archiving with MailVault, with the technical part filled in, ships with the app, under Retention Policy ▸ Organisation ▸ Save Template…. It is in German.
What about e-invoices in attachments?
They are kept as part of the message in their original format, as XML or as a PDF with embedded XML, and stay unchanged byte for byte.
Not legal advice. This page describes how the software works. Whether an organisation complies depends on its organisation, processes and documentation as well; for your own case, involve your auditor or legal adviser.
Try it on your own mailboxes.
Thirty days with everything open, no sign-up. Or we set up the first archive with you.