Chapter 12 Compliance, Storage & Ops Admin: #pArchive

Persistent Message Trace & Immutable GoBD WORM Compliance Archive

When a customer asks 'Where is our invoice?', you need an instant factual answer. Message Trace (#pMessageTrace) records exact timestamps, remote IPs, TLS ciphers, spam scores, and remote SMTP responses across Inbound, Outbound, Deferred, Bounced, and Rejected mail, alongside the immutable GoBD WORM journal.

Operational Tip & Architecture Note

Audit & privacy best practice: never hand full ServerAdmin credentials to external tax auditors. Assign the dedicated read-only ComplianceAuditor role, which grants GoBD journal search, ZUGFeRD inspection, and procedural documentation export without write access.

Read-Only Auditor Role & Hash-Chain Verification

Every journal entry chains the predecessor's SHA-256 digest and the MIME blob SHA-256 cryptographically.

Reference / Configuration

# Schreibgeschütztes Prüferkonto per CLI anlegen:
sharpmail-cli create Account \
  --set email=steuerpruefer@firma.de \
  --set role=ComplianceAuditor \
  --set displayName="Steuerprüfung (Nur Lesen)"

# Verfahrensdokumentation im Cockpit exportieren:
/admin/#pArchive -> "GoBD-Verfahrensdokumentation herunterladen"

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Nachrichtenverfolgung (#pMessageTrace)`	Searchable history of inbound and outbound SMTP/API transactions with direction/status filters and 1-click CSV export.	`Aktiv (Echtzeit-SignalR)`	Filter by sender, recipient, or Message-ID to prove remote MX acceptance (250 2.0.0 OK) in seconds.
`Domain GoBD-Aufbewahrung (RetentionDays)`	Configures immutable WORM retention duration per domain backed by cryptographic SHA-256 hash chaining.	`3650 Tage (10 Jahre GoBD)`	Keep at 3650 days (10 years under German AO/HGB tax retention rules) for commercial domains and run periodic 1-click hash-chain verification.
`ZUGFeRD / XRechnung & Scan-OCR`	Indexes structured EN 16931 ZUGFeRD/Factur-X invoice XML metadata alongside PDF text and scan OCR in < 8 ms p95 search queries.	`Automatisch aktiv`	Allows accounting and auditors to locate e-invoices instantaneously by invoice ID, VAT ID, or vendor name.
`S3 Object Lock & Verfahrensdokumentation`	Optionally replicates deduplicated Zstd blobs to S3 Object Lock (COMPLIANCE mode) and exports pre-filled GoBD procedural documentation.	`Lokaler Blob-Store (+ S3 optional)`	Export an updated GoBD procedural documentation snapshot from #pArchive after major topology changes and file it with your audit records.