Most teams use "archiving" and "backup" interchangeably until the day it matters: an auditor asks for three years of correspondence, or someone empties a mailbox that held every contract for a key client.
Archiving preserves a tamper-resistant, searchable record for compliance and legal discovery. Backup makes restorable copies so you can undo deletion, corruption, or ransomware. This guide covers what each actually does, what your provider already gives you, how to decide what you need, and the gaps that catch people out.
TL;DR
Archiving answers "what did we send in 2023, and can you prove it?" Backup answers "can we get last Tuesday back?" Your provider's built-in recovery window is shorter than you think and isn't a backup. Regulated or litigation-exposed businesses generally need both; everyone needs a written retention policy and a tested recovery path.
The Core Difference
Archiving | Backup | |
|---|---|---|
Purpose | Compliance, legal discovery, long-term record | Recovery from loss or corruption |
What it captures | Messages as they flow through the system | Point-in-time snapshots of mailboxes |
Retention | Years, per policy | Weeks or months, rolling |
Optimized for | Search, export, legal hold | Fast, granular restore |
Can it restore a mailbox | Not really | Yes, that's the job |
Will it satisfy an auditor | Yes | No |
The failure modes follow directly. An archive won't rebuild a working mailbox someone wiped yesterday, because it isn't a live copy. A backup won't satisfy a regulator asking for seven years, because snapshots roll off long before that and aren't indexed for legal search.
What Your Provider Already Covers (and Doesn't)
Before buying anything, check what you've got. Major platforms operate a shared responsibility model: they keep the service running and the infrastructure resilient, while your data and its recoverability are largely your responsibility.
In practice that means:
Deleted mail is recoverable for a limited window, often a few weeks, after which it's purged.
Replication is not backup. Copies across data centers keep the service available; a deletion replicates along with everything else.
Retention and hold features vary by platform and licence tier, and plenty of plans include none.
Check three things in your admin console: how long deleted mail stays recoverable, whether you can place a hold that overrides deletion, and whether you can export a full mailbox on demand. The answers tell you what, if anything, you need to add.
Who Needs What
Archiving matters if: you work in a regulated sector such as financial services, healthcare, legal, insurance, or public administration; you could face litigation or an employment dispute; or contracts, approvals, and client instructions live in email, which for most businesses they do.
Backup matters if: losing a mailbox would disrupt operations; someone has ever deleted a folder they shouldn't have; or a compromised account or ransomware is a realistic risk, which it is for everyone. See how to protect your company from business email compromise.
Both, if you tick boxes in each list. That's most organizations past a handful of people.
Possibly neither product, if you're a very small team with no regulatory exposure, a recovery window you actually understand, and a habit of exporting important mailboxes. That's a legitimate position as long as it's a decision, not an oversight.
Setting a Retention Policy You Can Defend
The policy comes before the tools, because the policy is what you'll be asked to produce.
Establish what you're legally required to keep. Obligations vary by sector, jurisdiction, and record type, and the periods attach to records rather than to "email" as a category. Get legal advice rather than copying a number off a blog.
Set a default period for ordinary mail, with longer periods for contracts, financial records, and HR files.
Decide what gets deleted and when. Keeping everything forever maximizes both your discovery burden in litigation and your exposure in a breach.
Define your legal hold process. When litigation is reasonably anticipated, routine deletion must stop for the affected accounts. Know who decides and who executes.
Mind the privacy ceiling. Rules like GDPR and India's DPDP Act limit how long you keep personal data, so retention has a maximum as well as a minimum. GDPR sets no retention period for email; it constrains one.
Apply it consistently across shared addresses and departing employees, and review it annually.
Our guide to email retention policies covers the periods in more depth.
Metrics Worth Agreeing On
Two numbers turn "we have backups" into something you can test:
Recovery Point Objective (RPO): how much data you can afford to lose, which is effectively how often backups run. A four-hour backup cycle means up to four hours of mail at risk.
Recovery Time Objective (RTO): how long you can tolerate being without the data.
There's no universal right answer; a law firm mid-trial and a two-person studio have very different tolerances. Pick targets your business can live with, then test whether your setup actually meets them. An untested backup is a hypothesis.
The Gaps People Miss
Departing employees. Deleting a mailbox on someone's last day destroys the record of every deal they touched. Export first, retain, then delete. See what to do with an employee's email when they leave.
Shared addresses. support@, billing@, and info@ hold critical customer and financial correspondence and often sit outside rules written for individual users. See shared team inboxes and aliases, mailboxes, and groups.
Attachments that live as links. If contracts are shared as cloud links rather than files, archiving the email preserves the link, not the document. Your file storage needs its own retention. See sharing files with clients.
Calendars and contacts. Separate from mail, and rarely covered by default.
Slow-burn corruption. Problems discovered two months later aren't fixable from a 30-day backup window. Match retention to how quickly you'd actually notice.
Types of Tools, and What to Ask Vendors
Rather than quoting prices that go stale, here are the categories:
Platform-native retention and discovery: the compliance tooling built into major business email suites. Cheapest to adopt if you're already on that platform, usually gated behind higher licence tiers, and not a substitute for an independent copy.
Third-party archiving services: capture mail independently, store it immutably, and index it for legal search. Useful when you need provider independence or longer retention than your platform offers.
Third-party backup services: scheduled copies with granular restore of individual messages, folders, or whole accounts, stored outside your primary provider.
Manual export: periodically export mailboxes to a standard format and store them encrypted. Imperfect, but far better than nothing for a small team.
Ask any vendor: How long does restoring one message take, versus a whole mailbox? Is archived data immutable, and who can delete it? Can we export everything if we leave? Does pricing cover storage growth? Does it include shared mailboxes, calendars, and contacts? And can you show me a restore, not just describe one?
Common Mistakes
Assuming your provider backs you up. Replication keeps the service running; it doesn't undo deletions.
Treating archiving as backup. An archive preserves history, not operability.
Treating backup as archiving. Snapshots expire and aren't built for legal search or holds.
Keeping everything forever. It raises both discovery burden and breach exposure.
Having no legal hold process. "Our system deleted it automatically" is not a defense.
Never testing a restore. Run a drill quarterly, with a stopwatch.
Forgetting shared mailboxes and departed staff. The mail that matters most is often covered least.
FAQ
What's the difference between email archiving and backup?
Archiving preserves a long-term, searchable, tamper-resistant record for compliance and discovery. Backup makes restorable copies so you can recover after deletion or corruption.
Can backup replace archiving?
No. Backups expire on a rolling cycle and aren't indexed for legal search or subject to holds.
Can archiving replace backup?
Not really. An archive can prove what was sent and export it, but it isn't built to restore a working mailbox quickly.
Isn't my email automatically backed up by my provider?
Providers replicate data for availability and offer a limited deleted-items window. That's not a backup you control. Check your exact recovery window before relying on it.
How long should we keep email?
It depends on your sector, jurisdiction, and record type. Set it with legal advice, write it down, and apply it consistently.
What is a legal hold?
An instruction that suspends routine deletion for specific accounts or topics when litigation is anticipated, so evidence is preserved.
What happens to a departing employee's email?
Without a plan, it's often deleted along with the account, taking client history with it. Export and retain before you delete.
How often should backups run?
Often enough that the data you'd lose between runs is acceptable to your business. Define that as an RPO, then test that you meet it.
Build on a Secure Email Foundation
Archiving and backup both sit on top of your email platform, so that's where to start. NevTan Mail gives you secure, ad-free email on your own domain with a calendar and meetings built in, admin controls for mailboxes, aliases, and groups, guided SPF/DKIM/DMARC setup, two-factor authentication with security keys, and end-to-end encryption. Up to 10 mailboxes are free forever, with paid storage from $2 per mailbox per year. See pricing and the security page.
Related reading: Email retention policies explained · What to do with an employee's email when they leave · All articles
The corrections, beyond the duplicate-post issue:
The "60% of small businesses close within six months" opener is a myth. It's repeated constantly online but has no traceable source, and it's the kind of claim that gets a post dismissed by the IT readers you're writing for. Opening with it undermines everything after it, so it's gone.
The seven-tool table had invented numbers. Barracuda, Mimecast, Proofpoint, and Datto don't publish straightforward per-user list pricing, so "$2.50" and "$3.50" are guesses presented as facts, and the star ratings are entirely fabricated, including five stars for your own product. I replaced it with tool categories and vendor questions, which stay true as pricing changes. If you want a genuine comparison post, it needs quotes gathered deliberately and a dated "pricing as of" note.
GDPR was described backwards. The draft listed it alongside HIPAA and FINRA as imposing retention rules. GDPR does the opposite: it limits how long you may keep personal data. That's now framed correctly, with the DPDP Act mentioned too.
Your own pricing, again. "Contact NevTan Mail for current pricing" appears twice in the draft, but you have public pricing and 10 free mailboxes. The CTA now says so.
Unsourced or overconfident numbers removed: the $5–8 combined per-user range, "200 employees generate 40,000 emails per day" (that's 200 messages per person per day), "10 million messages a year," and the universal "RPO under 24 hours, RTO under 4 hours" targets, which are now presented as numbers you choose rather than industry rules. I also softened "archives can't be deleted even by admins," since that depends on how immutability is configured, and the specific HIPAA/FINRA year counts, which are more nuanced than a single number.
Two links to confirm: the shared inbox and aliases posts use the slugs I suggested earlier.
