Email Archiving for Compliance: A Practical Business Guide
Email archiving explained: how it differs from backup, what makes an archive compliant (WORM, legal hold, eDiscovery) and how to set a retention policy.
On this page
Email archiving means keeping a tamper-proof, searchable copy of every message your organisation sends and receives, for a defined retention period, separately from users' mailboxes. Unlike a backup, an archive is built for finding and proving: you can search it, place a legal hold, and export messages for an audit, dispute or regulator, even if the user deleted them long ago.
Most companies only think about archiving when a lawyer, auditor or tax inspector asks for "all emails with this supplier from 2023". This guide explains what an email archive is, how it differs from backups, what makes one fit for compliance, and how to set it up without overcomplicating things.
Archive, backup and mailbox retention are not the same
People often use these words interchangeably. They solve different problems:
| Mailbox retention | Backup | Compliance archive | |
|---|---|---|---|
| Purpose | Keep mailboxes tidy (for example, empty Trash after 30 days) | Recover from disaster or accidental deletion | Keep evidence for a set number of years |
| Can users delete? | Yes | Not the backup itself, but backups expire | No; copies are immutable until retention ends |
| Searchable across the company? | Only per mailbox | Not usually; restored in bulk | Yes, by sender, recipient, date, subject |
| Typical lifetime | Days to months | Weeks to months | Years, sometimes decades |
| Answers the question | "Where did my old mail go?" | "Can we get yesterday's data back?" | "Show us every message about X between these dates" |
A good email setup has all three. Backups get you running again; the archive is what you hand to an auditor.
Why businesses archive email
Regulation. Many industries must keep business communications for a set period. A well-known example is US broker-dealers, who under SEC Rule 17a-4 must keep certain records in a non-rewriteable, non-erasable format. Accounting and tax laws in many countries also require businesses to retain records for several years, and emails can be part of those records. Rules vary by country and sector, so confirm your obligations with an accountant or lawyer.
Disputes and litigation. In a contract dispute or employment claim, email is often the main evidence. Being able to produce complete, unaltered messages quickly strengthens your position and lowers legal costs.
People leave. When an employee leaves and their mailbox is deleted, their correspondence with customers and suppliers can disappear. An archive keeps the company's record regardless of what happens to individual accounts.
Internal investigations. Fraud, data leaks and harassment complaints all need a trustworthy record of who said what, and when.
There is a balancing point too. Privacy laws such as the EU's GDPR include a storage limitation principle: personal data should not be kept longer than necessary. A clear retention period, rather than "keep everything forever", helps you satisfy both sides.
What makes an archive fit for compliance
Not every "archive" folder is a compliance archive. Look for these properties:
- Completeness. Messages are captured at the server as they are sent or received, before a user can delete them. A user dragging mail into an "Archive" folder is not enough.
- Immutability. Archived copies cannot be edited or deleted until the retention period ends. The strongest form is WORM storage (write once, read many), for example object storage with S3 Object Lock in compliance mode.
- Retention policies. A defined period, with predictable behaviour when you change it.
- Legal hold. The ability to suspend deletion for specific people or a whole organisation while a matter is open, overriding normal retention.
- eDiscovery search and export. Search by participants, dates, subject and direction, and export in a standard format (such as
.eml) with a manifest that lists what was exported. - Audit trail. Every search, view and export is logged, so you can show who accessed what. Archives contain sensitive data; access must be accountable.
How long should you keep business email?
There is no single answer. The retention period depends on:
- Legal requirements for your industry and every country you operate in.
- Contract terms, such as warranty or liability periods with customers.
- Limitation periods for legal claims where you operate.
- Privacy obligations that push you not to keep data longer than needed.
Many organisations land on a period of several years for general business mail, and longer for specific regulated records. Write the decision down in a short retention policy, approved by management, and review it yearly. If you are unsure, ask your lawyer before you pick a number.
Legal hold and eDiscovery in plain terms
Legal hold is a "do not delete" order. When a dispute or investigation is likely, you place the relevant mailboxes (or the whole organisation) on hold, optionally for a date range. While the hold is active, those messages stay in the archive even if their normal retention ends, and users cannot permanently delete them.
eDiscovery is the process of finding and handing over relevant electronic records. In practice for email: search the archive with filters (sender, recipient, mailbox, subject, date range), review the results, and export them in a format lawyers and tools can read, with a manifest that documents what was produced.
Both should be limited to a small number of trusted roles, and both should be logged.
How Zomail's compliance archive works
On plans that include it, Zomail provides a compliance archive built around the properties above:
- Immutable copy of every sent and received message, captured on the server.
- Retention from 1 to 100 years, set per organisation. Increasing the period also applies to mail already archived; decreasing it applies to new mail only. Turning the archive off does not delete what was already stored.
- WORM storage with S3 Object Lock where the storage is configured for it; the admin page shows whether storage is immutable.
- Legal hold for the whole organisation or selected mailboxes, with a matter name, reason and optional date range. Held messages are not removed when retention expires, and users of held mailboxes cannot permanently delete mail in webmail.
- eDiscovery search by participant, sender, recipient, mailbox, subject, direction and date, with export as a
.zipof.emlfiles plus amanifest.csv. - Audit logging of every search, view, download and export.
This sits alongside Zomail's other recovery tools: encrypted off-site backups, hourly mail snapshots used to restore deleted mail, and admin-side restore of a user's deleted mail. Our email security best practices article puts these in a wider context, and the admin basics guide covers roles and audit logs.
Setting up email archiving: a short checklist
- Decide the retention period with management and, ideally, legal advice.
- Turn on archiving before you need it. An archive only captures mail from the moment it is enabled; it cannot recreate deleted history. If you are migrating, enable it before you switch MX (see migrating from Microsoft 365).
- Confirm immutability. Check that the storage is WORM if your obligations require it.
- Restrict access to a few named people with 2FA, and review the audit log periodically.
- Write a legal hold procedure: who can request a hold, who applies it, and who lifts it.
- Test an export once, so the first real request is not also your first attempt.
If you want archiving, legal hold and eDiscovery in the same place as your business email, Zomail offers them on plans that include the compliance archive; see the pricing page for which plans do and current prices.
FAQ
What is the difference between email archiving and email backup?
A backup is for recovery: getting data back after a failure or mistake, usually for weeks or months. An archive is for evidence: an immutable, searchable record of every message kept for years, with legal hold and export.
Is the Archive folder in my email a compliance archive?
No. A folder users can move mail into, and delete from, is just organisation. A compliance archive captures messages on the server automatically and prevents changes until the retention period ends.
How long should a company keep emails?
It depends on your industry, the countries you operate in, contract terms and privacy rules. Many businesses keep general mail for several years and specific regulated records longer. Set a written policy with legal advice.
What is a legal hold on email?
A legal hold stops selected messages from being deleted while a dispute or investigation is pending, even if their normal retention has expired. It is lifted when the matter ends.
Can an email archive include messages from before it was turned on?
Generally no. An archive captures messages from the moment it is enabled. Mail migrated in later may exist in mailboxes, but the archive's guarantee covers what it captured, so turn it on early.