GoBD and email archiving, explained
GoBD requires business email that is commercial correspondence, or relates to a booking, to be kept complete, unaltered and traceable for years, not merely retained; that is what Osiris's in-development archive layer is built for. The rest of this page answers exactly what that means and what's built so far.
Business email that counts as commercial correspondence, or relates to a booking, is an accounting-relevant record under German law. GoBD, the finance ministry's administrative guidance on proper record-keeping, sets specific, checkable requirements for how that record has to be kept, not just how long.
What the law actually requires
- Retention: 6 years for commercial correspondence (§ 257 HGB, § 147 AO), 8 years for accounting records, 10 years for books and annual financial statements.
- GoBD's core requirement: records must be complete, correct, timely, orderly, unalterable, traceable and machine-evaluable, with procedural documentation and a change log, and kept in their original format, an email staying an email, not a printout.
- "Timely" specifically is why journaling, not a periodic mailbox sync, is the right capture mechanism: a sync only sees what's still there when it runs, while journaling captures a copy before a user can change or delete the original.
- Alongside GDPR: a deletion concept once retention ends, the ability to search by person for a data-subject access request, and a legal hold used only for a documented reason.
What Osiris's archive layer is designed to do, once it ships
Exchange Online journal receipt over SMTP as the primary capture path (with Graph and IMAP sync as supplements, explicitly marked as captured after the fact where journaling wasn't possible), a running hash chain anchored daily so alteration is detectable, S3-compatible object storage with hardware object-lock as the planned default target for immutability at the storage layer, per-tenant retention policies with legal hold, full-text search, EML export with a checksummed manifest, and a signed evidence report per tenant. None of this is available yet. It is in development, not shipped; see theroadmap for exact status, andthe detailed design documentation for the full technical target.
What we do not claim, and will not claim once it ships
Not "GoBD-certified": no such certificate exists to hold, since GoBD itself is explicit that tax authorities issue no positive attestations. Osiris will say the archive is designed to support compliant email archiving, built for German GoBD requirements, and name the specific measures behind that statement, never "certified" or "compliant" as a bare, unqualified claim, and never a substitute for review by your own tax advisor or data protection officer. This matches what the archive is included in: theBusiness and Service Provider editions, once it ships.
Frequently asked
What does GoBD require for email archiving?
Business emails that are commercial correspondence, or relate to a booking, are accounting-relevant records under German law: 6-year retention for commercial correspondence (§ 257 HGB, § 147 AO), 8 years for accounting records. GoBD (the finance ministry's administrative guidance) further requires those records be complete, correct, timely, unalterable, traceable, machine-evaluable, kept in their original format, with procedural documentation and a log of any change.
Is Osiris's archive GoBD-certified?
No such certificate exists to claim in the first place. GoBD itself states that tax authorities issue no positive attestations, in an audit or otherwise, and that a third party's certificate does not bind the tax authority either; responsibility stays with the taxpayer. Osiris states its archive is designed to support compliant email archiving, built for German GoBD requirements, and names the specific measures, never "certified" or "compliant" as an unqualified claim.
Is the archive layer built for German GoBD requirements available now?
No, it is in development, not shipped. Current status and what's built so far versus still planned is tracked on the roadmap.