It's 3 PM on a Tuesday. Your email provider has an outage. Or your account gets hacked and the attacker deletes everything. Or an employee accidentally purges a critical folder. Or you get hit with ransomware that encrypts your email client.
In any of these scenarios, the question is the same: do you have a copy of your business emails?
For most businesses, the answer is no—or at least, not a complete one. They rely entirely on their email provider to keep their data safe. And while providers like Google and Microsoft have robust infrastructure, they're not immune to data loss, and they're not responsible for user-initiated deletions.
Email backup and archiving is your insurance policy. This guide covers why it matters, how to implement it, and what you need to know about compliance and disaster recovery.
Why Email Backup Matters
Email is more than communication—it's business documentation. Your emails contain:
- Contracts and agreements: Signed proposals, terms of service, partnership agreements
- Financial records: Invoices, receipts, payment confirmations
- Customer communications: Support history, feature requests, complaints
- Legal documentation: Notices, regulatory correspondence, dispute records
- Intellectual property: Design discussions, code reviews, brainstorming threads
- HR records: Employment offers, performance reviews, termination notices
Losing any of this could mean lost revenue, legal liability, compliance violations, or operational chaos.
Email Data Loss Statistics
- 60% of companies that lose their data shut down within 6 months
- 29% of data loss is caused by accidental deletion
- 58% of SMBs are not prepared for data loss
- 93% of companies without disaster recovery who suffer data loss are out of business within a year
The Risks of No Email Backup
An attacker gains access to your email account. Before you regain control, they've deleted all your emails and emptied the trash. Without a backup, years of business communication is gone.
An employee meant to delete a single email but accidentally deleted an entire folder of customer correspondence. By the time anyone notices, the trash has auto-emptied.
Your email provider has a major incident. Some data is corrupted or lost. They restore from their backups, but those backups are 48 hours old. Two days of email is permanently lost.
Ransomware encrypts your local email client and synced data. Your provider has your current email, but you can't access it until you pay—or wipe and restore from your own backup.
A key employee leaves on bad terms. Before departing, they delete all emails in their account. Without a backup or archive, you've lost their entire communication history.
Backup vs. Archive: What's the Difference?
While often used interchangeably, backup and archive serve different purposes:
| Aspect | Backup | Archive |
|---|---|---|
| Purpose | Disaster recovery—restore lost data | Long-term retention—compliance, legal, reference |
| Retention | Short to medium term (days to months) | Long term (years to decades) |
| Access Speed | Fast—designed for quick restore | Slower—designed for search and retrieval |
| Storage | Often overwrites old backups | Permanent, immutable storage |
| Use Case | "My email was deleted, restore it" | "Find all emails from 2023 about Project X" |
Most businesses need both: backups for operational resilience and archives for compliance and legal protection.
Email Backup Methods
IMAP Download
SimpleUse an email client (like Thunderbird or Apple Mail) to download all emails via IMAP to your local computer.
Pros:
- Free (uses existing email clients)
- Complete copy of all emails
- Works with any email provider
Cons:
- Manual process (or requires scripting)
- Backup only exists on one computer
- Requires ongoing maintenance
- No off-site redundancy
Cloud Backup Services
AutomatedUse dedicated services like Backupify, Spanning, or DropSuite that automatically backup cloud email accounts.
Pros:
- Fully automated
- Off-site storage
- Point-in-time recovery
- Often includes archive features
Cons:
- Cost (typically $3-5/user/month)
- Vendor dependency
- May have storage limits
Email Forwarding to Archive
ContinuousForward all incoming emails to a dedicated archive account (like a separate Gmail account used only for backup).
Pros:
- Real-time backup
- Simple setup
- Low cost
- Works with forwarding services like Forward
Cons:
- Only captures incoming emails (not sent items unless configured)
- Archive account needs its own backup
- Search can be slow with large volumes
Export to Cloud Storage
ComprehensiveUse tools like Google Takeout or manual export to periodically export emails to cloud storage (Google Drive, Dropbox, S3).
Pros:
- Complete data export in standard formats
- Off-site storage
- Can version and retain multiple snapshots
Cons:
- Manual process (unless automated with scripts)
- Data is static—doesn't update in real-time
- Restoration can be complex
Recommended Approach
For most small to medium businesses, a combination approach works best:
- Primary: Use email forwarding to maintain a continuous copy of incoming emails
- Secondary: Use Google Takeout or equivalent monthly for complete account backup
- Tertiary: Consider a dedicated backup service if you have compliance requirements
How Forward Handles Email
When you use Forward for email forwarding, here's what happens to your emails:
Transient Processing
Forward is designed as a forwarding service, not a storage service. Emails are processed and forwarded immediately—typically within seconds. Forward does not permanently store your emails after forwarding is complete.
What This Means for Backup
Since Forward doesn't store your emails long-term, your backup strategy should focus on the destination of your forwarded emails:
- If forwarding to Gmail: Use Google Takeout regularly to backup your Gmail account
- If forwarding to Microsoft 365: Use Microsoft's built-in export tools
- If forwarding to a helpdesk: Most helpdesks have their own export/backup features
For Archive Purposes
To create an archive of forwarded emails:
- Create a dedicated archive email account (e.g., archive@yourcompany.com or a separate Gmail account)
- Forward emails to both your primary inbox AND the archive account
- Set the archive account to never delete and use large storage capacity
- Periodically export from the archive account to cold storage
Implementation Guide
Step 1: Assess Your Needs
Before implementing backup, answer these questions:
- How much email data do you have? (Check your current storage usage)
- How quickly do you need to recover from data loss? (Hours? Days?)
- What's your retention requirement? (7 years for financial records? Indefinitely for legal?)
- Do you have compliance requirements? (GDPR, HIPAA, SOX, etc.)
- What's your budget for backup solutions?
Step 2: Choose Your Backup Method
Based on your needs, select the appropriate method:
Small Business
Method: Email forwarding + monthly Google Takeout
Cost: Free
Effort: Low
Medium Business
Method: Dedicated backup service (Backupify, Spanning)
Cost: $3-5/user/month
Effort: Low (automated)
Enterprise
Method: Enterprise archive (Barracuda, Mimecast)
Cost: $10-20/user/month
Effort: Medium (setup and management)
Step 3: Implement Forwarding for Continuous Backup
Using Forward, set up forwarding to an archive destination:
- Create an archive email address (this can be a separate Gmail account, a dedicated archive service, or a distribution list)
- Configure Forward to forward emails to both your primary inbox AND the archive address
- Set up filters in the archive account to organize emails by date, sender, or domain
- Configure retention in the archive account to never auto-delete
Step 4: Schedule Regular Exports
For your primary email accounts:
- Gmail: Use Google Takeout monthly—download and store in cloud storage
- Microsoft 365: Use eDiscovery export or third-party tools
- Other providers: Check for IMAP download or export options
Step 5: Test Your Backup
A backup you haven't tested is not a backup. Regularly verify:
- Can you access the backup data?
- Is the data complete?
- Can you search and find specific emails?
- How long does restoration take?
Compliance Considerations
Different regulations have different email retention requirements:
| Regulation | Email Retention Requirement | Notes |
|---|---|---|
| SEC/FINRA | 6 years | Financial services communications |
| HIPAA | 6 years | Healthcare communications containing PHI |
| SOX | 7 years | Public company financial records |
| GDPR | As long as necessary | Must justify retention period |
| Tax Records | 7 years | IRS requirements for business records |
Compliance Best Practices
- Document your retention policy: Define how long you keep different types of emails
- Implement legal hold: When litigation is anticipated, preserve relevant emails
- Use immutable storage: For compliance archives, use storage that can't be modified or deleted
- Audit access: Track who accesses archived emails and when
- Encrypt archives: Protect archived emails at rest
Disaster Recovery Plan
A backup is only useful if you can restore from it. Create a disaster recovery plan:
Define Recovery Objectives
- RTO (Recovery Time Objective): How quickly must email be restored? (e.g., 4 hours)
- RPO (Recovery Point Objective): How much data can you afford to lose? (e.g., 24 hours)
Document Restoration Procedures
For each backup method, document:
- How to access the backup
- How to restore individual emails
- How to restore entire mailboxes
- Who is authorized to perform restoration
- Expected restoration time
Test Restoration Regularly
Schedule quarterly restoration tests:
- Restore a random sample of emails
- Verify the emails are readable and complete
- Time how long restoration takes
- Document any issues encountered
Maintain Off-Site/Offline Copies
For critical email archives:
- Keep at least one backup copy off-site (different geographic region)
- Consider offline backups (air-gapped from network) for ransomware protection
- Use 3-2-1 rule: 3 copies, 2 different media types, 1 off-site
Email Backup Implementation Checklist
- Assess email volume and retention needs
- Choose backup method(s) based on requirements
- Set up forwarding to archive destination
- Configure automatic exports (monthly minimum)
- Store exports in secure cloud storage
- Document retention policy
- Create restoration procedures
- Schedule quarterly restoration tests
- Verify compliance with industry regulations
- Set up monitoring/alerting for backup failures
Common Questions
How often should I backup my email?
It depends on your RPO. If you can't afford to lose more than a day of email, backup daily. For most businesses, a combination of continuous forwarding backup plus weekly or monthly full exports is sufficient.
Does email forwarding capture sent emails?
Not by default. Forwarding captures incoming emails. To backup sent emails, you'll need to either include them in periodic exports or configure your email client to BCC sent items to an archive address.
How long should I keep email archives?
It depends on your industry and legal requirements. At minimum, keep financial and contract-related emails for 7 years (tax requirement). Some industries require longer retention. When in doubt, consult legal counsel.
What about email attachments?
All the methods described preserve attachments. When you backup via IMAP, export via Takeout, or forward emails, attachments are included. Make sure your archive destination has enough storage capacity.
Can I search my email archives?
Search capability depends on your archive method. Gmail and most backup services include search. If you export to files, you'll need a desktop search tool or need to re-import to search.
The Bottom Line
Email backup isn't exciting, but it's essential. Your business emails are critical records that you can't afford to lose. Whether it's a malicious attack, accidental deletion, or provider outage, having a backup means the difference between an inconvenience and a catastrophe.
Start simple: set up forwarding to an archive destination and schedule regular exports. As your needs grow, add dedicated backup services and compliance archives. Test your backups regularly, and document your restoration procedures.
The time to set up backup is before you need it. Don't wait for data loss to realize its value.