Email Archiving: Everything You Need To Know (FAQs)
What Is Email Archiving?
Email archiving is the system of storing your email communication so they can later be retrieved, typically for legal and auditing purposes.
Email archiving solutions allow you to store tamper-proof, immutable copies of each and every email your organization sends and receives. Most email archiving solutions capture email content directly from the email client itself, or during transport, so the entire process occurs without any added work for IT teams or end users. These emails are stored separately to your main email client so that if you change company email systems, delete every email in your inbox, or your company network is wiped, you’ll still have copies of all your original emails.
Many email archives today are cloud-based, allowing you to access your stored emails from any device, at any time. They often also include e-discovery features, which allow you to search the archive for specific emails by attributes such as recipient, sender, time, attachment type, and subject.
Once you have found the emails you are looking for, or even if you need to bulk export every email from a particular month for example, archiving solutions make it easy to restore past emails and attachments.
How Does Email Archiving Work?
Typically, third-party email archiving solutions work via the process journaling. Email journaling records all communications within the email archiving solution. The journaling system creates copies of all email messages and stores them in a secure, searchable database. This process can be customized based on your organization’s specific journaling and retention policies.
When deploying an email archiving solution to your email environment, for example Microsoft 365, you need to add a journaling rule in the admin center, which tells your email provider (e.g., Microsoft) to send emails to your chosen archiving database. Most email archiving solutions provide an in-depth guide to deployment based on specific steps required.
However, there are many different approaches to email archiving, and the specifics of how email archiving works can differ based on the approach used. Many users will be familiar with the email archiving functionality offered natively within Microsoft Outlook or Google Mail, in which archived emails are sent to a separate Archive folder. But this use case is meant for end-users to manage their emails more effectively, not for IT departments or compliance use cases.
Where Do Archived Emails Go?
When an end-user archives an email in Outlook or Google Mail, it is removed from their inbox and placed in a separate folder. From there, archived emails can be deleted or moved back to the inbox. Without an additional third-party email archiving solution, this does not ensure archived messages are kept secure and immutable.
When using an enterprise email archiving solution, a copy of every single inbound, outbound, or internal email is stored in a secure repository, where emails can be searched, placed on legal hold, and recovered. Meta-data and attachments can also be viewed.
This repository is usually cloud-based and accessible by admins, auditors, and legal compliance teams. Sometimes the cloud-archive can also be accessed by end-users, who can use the service to search through their own archive and view messages that have been lost or accidentally deleted.
Why Should You Archive Emails?
There are several reasons that organizations should archive emails, particularly those in heavily regulated industries such as legal services, healthcare, government, and finance.
Common reasons for implementing email archiving tools include:
- Regulatory Compliance: Many industries must keep copies of internal and external correspondence to demonstrate compliance with regulations governing corporate communications and data protection. Email archiving ensures that email content cannot be deleted, corrupted, or tampered with – accidentally or intentionally. This minimizes the risk of fines for breach of compliance regulations.
- e-Discovery: In the case of an investigation, either internally or externally, it’s important for auditors to be able to quickly find content associated with particular employees or groups. This can be difficult with the native functionality offered by many email systems. Email archiving provides comprehensive e-Discovery functionality, enabling teams to quickly search, filter, and export email content going back several years.
- Internal Audits: Internal auditing and investigations are critical process for HR, risk, and compliance teams. Auditors need an easy way to search email content in the case of a workplace investigation, with transparent auditing to ensure that data is being accessed in a compliant way. Email archiving provides the functionality on both counts, allowing teams to find email content, and highlighting who has accessed email data.
- Business Continuity: Human error, tech unreliability, cyberthreats, and natural disasters can all upend careful planning and lead to data loss, which can be hugely damaging to business processes and continuity. Nobody wants to suddenly find they have lost hundreds of emails and contacts. A secure, centralized archive held on a third-party system can help to ensure you always have a backup available in case of disaster.
What Features Should You Look For In An Email Archiving Solution?
Email archiving solutions should be optimized for easy deployment, hands-off management, and fast search and retrieval when required. Key features to look for in an email archiving solution include:
1. Ensure Legal Compliance
The most common use case for email archiving solutions is to ensure compliance with auditing and data regulation requirements. As such, ensuring the solution you choose enables full legal compliance should be the first and most important feature that you consider.
This should include ensuring that all emails are automatically archived, along with attachments and meta-data that outlines where the email was sent, at what time, and to whom. It should also include details on replies, email chains and forwarding.
Archived emails should also be fully immutable. Nobody should be able to edit or tamper with archived data; this is an important stipulation in many legal regulations.
Compliance also means auditing who has access to the email archive. The best archiving solutions will provide granular permissions management with auditing over when the archive has been accessed.
2. Data Security
Another important part of ensuring legal compliance is ensuring the archived data itself has tight security controls. Archived emails should be fully encrypted to ensure malicious threat actors are not able to compromise any sensitive information that may be held in email records.
We recommend looking for a system that protects archived emails when in transit and at rest. Proofpoint recommends that any data centers used to house cloud archived emails should be SSAE-16 SOC 2 Type II certified.
In addition, there should also be strong security controls to govern who has access to the archive. As previously mentioned, look for a solution with granular permissions management for accessing the archive, with comprehensive auditing. We also recommend that any access to the archive is reinforced with comprehensive multi-factor authentication.
Finally, we also recommend looking for a solution that has multiple layers of backup in different file formats. When storing backups of any type of data, you should follow the rule of “3 2 1”: store at least three copies of your data in two different locations, and at least one copy should be in a different format or medium to the others.
This means if one archive is corrupted or lost, you can easily recover data by switching to another backup method. Each one of these should again be secured with high levels of data security.
Arguably the most important feature on this list is the ability for auditors, admins or even end-users to be able to easily search the email archive to find data when needed. It’s great to have a legally compliant platform with excellent data security, but if the platform is impossible to use to actually find and export data when needed, the platform has failed.
So, a key feature to look out for is a well-designed user interface that should be simple to navigate and quick to return search results. A system that takes hours to search through an archive is not scalable for organizations that need to retain data over a period of years.
But as well as being simple to use, a good archiving platform will have comprehensive e-discovery functionality to return the results you actually want to see. You should be able to search on granular pre-defined filters, such as sender, recipient, date, and subject line. You should also be able to easily export particular emails and chains when needed, without having to go through a costly or time-consuming process.
This in and of itself is important also to the compliance use case. If auditors are unable to use an archiving system to find any emails related to a litigation case, for example, then it’s possible you could breach compliance regulations.
In addition, the e-discovery archive should also be available even when your email network is down. This is important in ensuring business continuity, giving users access to their inbox at all times.
4. Cloud-Based Archiving
There are many ways that email archiving can be deployed across an organization, but for most businesses we recommend looking for a cloud-based email archiving solution.
Most organizations today use cloud-based email platforms such as Microsoft 365 and Google Workspace; cloud-based email archiving solutions can integrate natively with these platforms, speeding up the deployment process and saving businesses valuable time.
In addition, cloud-based archiving can also be more cost effective and reliable, with fewer outages and downtime than legacy on-premises alternatives. Storage costs can also be lower with cloud-based solutions, and cloud-storage is often more scalable.
However, some organizations may be already using an on-premises email archiving solution but looking to move to the cloud. In this case, we recommend looking for a cloud-based provider with low costs for important legacy data, or using a hybrid email archiving approach, choosing a provider that offers both an on-premises and cloud-based solution.
Some organizations may also need file archiving alongside email archiving; in this instance, we recommend looking for an email archiving solution that also offers file and data archiving.
5. Flexibility And Legal Hold
Legal hold is an important factor to consider when choosing an email archiving provider. This is the process of storing emails in anticipation of them being used in a litigation event or audit. It’s important that whichever email archiving solution you choose offers legal hold, covering the period of time you need.
Flexibility more broadly is an important aspect of email archiving. It’s important to choose a flexible service that stores emails for as long as you need them––we recommend a minimum of ten years––but many businesses will need to archive important emails for far longer.
However, over such a period of time, storage costs can become expensive, especially for organizations heavily reliant on email. For this reason, it’s a good idea to look for a service that only stores certain important emails long term, rather than spam messages like newsletters. Less important, external emails may only need to be archived for short periods of time, perhaps 12 months.
The best recommendation we can give for this particular point is to consider all the storage costs associated, along with your organizations’ particular use cases and compliance requirements, and look for a service flexible enough to meet your needs.
The final thing to look for in any archiving solution is the cost of importing and exporting data, and the archiving format. For many organizations email archiving represents a long-term commitment––this is not a solution you are likely to swap out on a regular basis.
For this reason, it’s a good idea to ensure that costs associated for migrating data into the archive, exporting data from the archive, and long-term storage costs are within your organization’s budget.
It’s also a good idea to check that the archiving provider you choose offers an open archiving format, so if for whatever reason you do need to export data into a different system, it’s not locked to a proprietary archiving system or data type.
Exporting data to a competitor’s archiving system can also have hidden costs, so it’s a good idea to thoroughly check the small print on any archiving solution you are considering.
When looking to implement an email archiving solution, organizations must build out a comprehensive strategy, outlining specific requirements such as retention policies and key data compliance regulations to follow. Combining this with the above features will help teams to ensure a successful email archiving deployment.
