Why back up your email? 7 situations where your mailbox is not enough

Most small businesses do not back up their mailboxes. The assumption is that the provider takes care of it. In practice, your provider makes sure your email stays available. It does not promise that a message deleted three months ago can be brought back.

That gap does not matter until you lose something. These are the situations where it comes up most often.

1. Something gets deleted by mistake

Someone clears out an old folder and empties the trash. Or a filtering rule sends messages straight to the bin. Deleted items usually stay on the server for around 30 days, sometimes less depending on the provider. After that, they are gone.

Most of the time, nobody notices straight away. The loss shows up weeks or months later, when someone goes looking for the message. A backup keeps deleted messages for as long as you decide: three months, a year, or longer.

2. An email app syncs a deletion to the server

IMAP works both ways: whatever you do on your phone or in Outlook also happens on the server. A mail profile that gets reset, a sync tool set up wrong, or a folder deleted from a phone, and the change reaches the server within seconds.

Your provider’s redundancy does not help here, because it copies the deletion along with everything else. We go into this in Why your mail provider is not a backup.

3. An employee leaves

A departing employee’s mailbox often holds things the business still needs: quotes, negotiations, commitments made by email. If they leave on bad terms, they may delete some of it. If they leave on good terms, the account is usually closed a few weeks later when the licence is cancelled.

Either way, without a backup, that history is lost. We cover this in more detail in A difficult departure, and the mailbox that empties. The practical advice: back up the mailbox before the departure is announced, and keep that backup after the account is closed.

4. An account gets hacked

A stolen password lets an attacker send fake invoices from a genuine address. They then delete the sent messages and any replies, and sometimes add a rule that forwards everything to an outside address. Ransomware on a computer connected to the mailbox can also delete or encrypt folders.

Afterwards, you need to work out what was sent, to whom, and when. You can only do that from a copy the attacker could not reach.

5. You change email provider

Email migrations nearly always miss something: a folder with an odd name, a message over the size limit, an attachment in an old format. With dozens of mailboxes, nobody checks everything, and the old account is often cancelled a few weeks later.

A backup taken before the move means you can still get back anything that did not make it across.

6. A dispute comes up months later

Disputes rarely happen right away. They come up at invoicing, at year end, when a customer stops paying, or when a lawyer asks for a particular exchange. That is often several months after the fact, sometimes more than a year, long after the trash has been emptied.

Some emails also have to be kept by law. In France, accounting records must be kept for ten years (article L123-22 of the Code de commerce), and that includes invoices received by email. For the difference between a backup and a legal archive, see Backup or archiving.

7. Your provider has a problem

This is the least common case: a long outage, an account suspended by mistake or over an unpaid bill, a provider shutting down its service, or a physical incident. In March 2021, a fire destroyed one of OVHcloud’s datacentres in Strasbourg.

A copy stored with a different provider means you can still get to your email when your own provider cannot help.

What an email backup needs to do

Some habits feel like a backup but do not work as one:

• a local copy in Outlook or Thunderbird: it syncs with the server, deletions included;
• a rule forwarding emails to another mailbox: it only copies new messages, and nothing that has already been deleted;
• a PST export once a year: it is months out of date by the time you need it.

What about shared drives?

The same problem applies to shared storage such as kDrive, Google Drive or OneDrive, and it is slightly worse: files are synced to every computer, so a file deleted or encrypted on one machine is deleted or encrypted everywhere. Drive backup is coming to istorel soon.