9 Email archiving vs email backup is a distinction that matters far more to mail providers than most people realize. Telcos, internet service providers and hosting companies store mail for millions of consumers and thousands of business customers. They need to recover from mistakes and attacks, offer services to regulated business customers and meet privacy obligations, all on the same platform. Backup and archiving solve different problems, and treating one as the other leads either to unnecessary cost or to gaps that only surface during an incident or an audit. This article explains the difference between email archiving and email backup from a provider’s point of view, what each requires from storage and how providers commonly design for both. For the broader platform design, see our hub on email storage architecture. The short answer Email backup exists to restore mail after loss: accidental deletion, corruption, a platform failure or a ransomware attack. It is about recovery, usually of recent data, and copies are kept for a limited period. Email archiving exists to preserve mail for long periods in a searchable, tamper-evident form, usually to meet legal, regulatory or business requirements. It is about retention and retrieval of specific messages, often years later. A backup that is kept for seven years is not an archive, because it is hard to search and usually restores whole mailboxes rather than specific messages. An archive is not a backup, because it is not designed to restore a platform quickly after a failure. What email backup protects against For a mail provider, backup covers several scenarios: User mistakes, such as deleting a folder and asking support to get it back. Account compromise, where an attacker deletes mail or changes settings. Software bugs or failed upgrades that corrupt mailbox indexes or data. Platform incidents, such as storage failures beyond what the platform’s own redundancy can absorb. Ransomware or malicious insiders targeting the mail infrastructure itself. Redundancy within the storage platform, such as erasure coding or replication, is not backup. It protects against hardware failure, but a deletion or corruption is faithfully replicated everywhere. Providers still need point-in-time copies or retained versions that sit outside the reach of normal deletion. Approaches to email backup at scale Traditional file-level backup of billions of small mail files is slow and expensive. Providers commonly use a mix of: Deleted mail retention, keeping expunged messages for a recovery window so support can restore them without touching backups. Snapshots or versioning on the storage platform, giving point-in-time recovery for the whole mail store. Replication to a second site with delayed or versioned copies so a deletion is not immediately mirrored. Immutable copies that cannot be deleted for a set period, protecting against attackers with administrative access. On object storage-based mail platforms, versioning and object lock can provide much of this directly in the storage layer. S3 versioning costs explains the capacity trade-off. What email archiving is for Archiving matters most for a provider’s business and enterprise customers, many of whom have legal or regulatory obligations to keep email: Regulated industries. Broker-dealers in the United States, for example, must preserve certain business communications under SEC Rule 17a-4 for defined periods, in a non-rewriteable, non-erasable format or, since amendments adopted in 2022, with a complete audit trail. Other financial, healthcare and public sector regulations set their own requirements. Litigation and eDiscovery. Companies must be able to find and produce relevant messages and preserve them under legal hold. Public records. Government bodies often have records retention schedules that cover email. Business continuity of knowledge, keeping correspondence after employees leave. For these customers, archiving is a service the provider can sell, often as an add-on to hosted business email. Consumer mailboxes generally do not need archiving, and keeping consumer mail longer than necessary can conflict with data protection principles. What an archive must do An email archive typically provides: Capture of every message sent and received, ideally at the time of delivery so users cannot delete mail before it is archived. Long-term retention by policy, sometimes for many years. Immutability or tamper evidence, so archived messages cannot be altered or deleted before retention expires. Search and retrieval across large message volumes, with metadata such as sender, recipients, dates and keywords. Legal hold to suspend deletion for specific users or matters. Audit trails showing who searched and exported what. Defensible deletion at the end of retention. Side by side Purpose. Backup restores data after loss. Archiving preserves records for compliance and discovery. Time horizon. Backup typically covers days to months. Archiving often covers years. Granularity. Backup restores mailboxes or folders. Archiving retrieves individual messages by search. Users. Backup is used by operations and support teams. Archiving is used by customers’ compliance, legal and records teams. Immutability. Increasingly needed for backup to resist ransomware. Usually mandatory for regulated archives. Who it applies to. Backup applies to every mailbox on the platform. Archiving usually applies to business customers who need it. Storage design implications For backup Backup storage needs to absorb the change rate of the whole platform, restore large volumes quickly and resist deletion by attackers. Key requirements include high ingest, fast bulk restore, immutability and placement in a separate failure and security domain from the primary mail store. Restore speed matters: restoring a large business customer’s mail after an incident is a visible, time-pressured event. mass restore planning covers what to plan for. For archiving Archive storage needs to hold very large volumes of small messages for long periods at low cost, with immutability and reliable integrity over time. The archive application handles indexing and search, while storage provides durability, retention locks and capacity that grows steadily. Object storage is a natural fit for both the messages and the archive’s own data. Shared platform, separate policies Many providers use one scalable object storage platform for the primary mail store, backup copies and archives, with separate accounts, buckets and policies for each. That keeps operations simple while enforcing different retention and immutability rules per use. Strict separation of administrative access between the primary mail platform and the backup and archive copies is essential, so a compromise of one does not reach the others. Privacy and data protection Providers must balance retention against privacy obligations. Under GDPR and similar laws, personal data should not be kept longer than needed for its purpose. That has practical consequences: Consumer mail backups should have limited retention. Closed accounts should be deleted from primary storage and, within a defined period, from backups. Archives should be retained only for customers who need them, under clear agreements about retention periods and who controls the data. Deletion should be verifiable. The scality.com blog covers data deletion verification. Checklist: email archiving vs email backup for providers Define backup scope, retention and recovery objectives for all mailboxes. Keep deleted mail for a short support recovery window. Use versioning, replication with delay or immutable copies to protect against deletion and ransomware. Separate backup storage administratively from the primary mail store. Offer archiving as a distinct service for business customers that need it. Capture archived mail at delivery and lock it for the retention period. Provide search, legal hold, audit trails and defensible deletion. Align retention with data protection law, especially for consumer mail. Test restores of large mailboxes and whole customers regularly. Putting it together Email archiving vs email backup comes down to purpose. Backup lets a provider recover its platform and its customers’ mail after loss. Archiving lets business customers keep searchable, tamper-evident records for years. Providers need backup for every mailbox and archiving for the customers whose regulators or lawyers demand it. Designing both on a scalable, immutable storage platform, with separate policies and administration, keeps costs down while meeting both recovery and compliance requirements. Frequently asked questions Is email backup the same as email archiving? No. Backup is for restoring data after loss, usually for limited periods. Archiving preserves messages for years in searchable, tamper-evident form for compliance and discovery. Do telcos need to archive consumer email? Generally not. Consumer mail needs backup and recovery, while archiving is mostly a service for business customers with regulatory or legal obligations. Is storage replication enough to protect email? No. Replication protects against hardware failure but copies deletions and corruption. Providers still need versioned, delayed or immutable copies. Does email archiving require WORM storage? Many regulations require non-rewriteable storage or equivalent controls. SEC Rule 17a-4, for example, allows WORM storage or, since 2022 amendments, an audit-trail alternative. How long should email backups be kept? Long enough to cover realistic recovery needs, often weeks to months, and no longer than privacy obligations allow for personal data. Further reading Email storage architecture Scaling mailbox storage Migrating mail from NAS to object storage Data archiving best practices
