Does a Hold Email Preserve as Well as Hold Software?

A hold email and a dated custodian list: the record a court actually reads.

A hold email preserves as well as hold software when the record standing behind it is complete: a dated notice, a named custodian list, a log of who acknowledged and when, and a mailbox lock switched on at the platform itself. Courts weigh that record. They do not ask which product drew it up.

I find the usual vendor framing curious, like a paper lantern lifted so that it lights only one wall of the room. The tools sold as proof carry soft gaps of their own. Druva's help documentation, in March 2025, made its Legal Hold report available only with a Governance license in inSync Cloud, generated it on demand rather than on any schedule, and deleted every entry for a user once that user was removed from the hold, keeping no earlier history behind. Box's own documentation warns that its hold report data can lag by up to 48 hours. A report is a picture of the present. It is not a diary.

So the real question for a solo or small firm is narrower, and a little stranger, than the sales page allows: what the preservation record must contain, and on which kind of matter a record kept by hand stops being enough, which is where the old duty itself has to be read again in a clearer light.

What does the duty to preserve actually require?

The duty to preserve attaches once litigation is reasonably anticipated, and it asks for reasonable, documented steps scoped to relevant ESI, not for any particular brand of software.

Before any tool enters the conversation, three plain steps carry most of the weight:

1. Fix the trigger date. Write down the day a suit or subpoena became reasonably foreseeable, and why it did.
2. Scope the hold. Name the custodians and the sources (mailboxes, shared drives, phones, laptops) that plausibly hold relevant ESI.
3. Stop deletion and record when. Suspend automatic deletion on those sources and note the date it stopped.

Rule 37(e) of the Federal Rules of Civil Procedure, amended in December 2015, reserves its harshest sanctions for a party that acted with the intent to deprive its opponent of the information. The amended rule generally shields a party that put a hold in place in good faith, even when something relevant slips away by accident. The duty itself begins when it can be reasonably anticipated that the company may be sued or receive a subpoena, which is often long before a complaint arrives: in a forwarded text, a tense letter, an email to human resources that reads, in the soft light of hindsight, like the first note of a storm.

Scope matters as much as timing. A practitioner in a 2024 r/ITManagers discussion described a legal hold as "generally specifically scoped" to the ESI relevant to the matter, so most of what sits on a whole hard drive is simply not in play. The same commenter placed the foundation of preservation in a proper information governance policy, not in a product. Mits IT Practice, writing in August 2026, put the timing point plainly: a retention policy without a hold mechanism is "a liability," because whether deletion was defensible "turns on timing, and timing is what a hold records." Scoping also shapes everything downstream, since what you preserve becomes what you review, and whether a bigger document set always means a longer review is a question that quietly begins at this step.

The common assumption is that a weak notice is what sinks a preservation defense. The 2024 decision in EEOC v. Formel D USA tells a stranger story. Laptop data had been backed up to the company server, so it never entered the spoliation analysis. The text messages were another matter. The company had no policy for preserving phones or laptops; devices went back to the vendor or were overwritten and handed to the next employee, and the court held that having no policy did not excuse the duty. The evidence faded the way color fades from old silk left too long in the window, from devices nobody had thought to hold.

An analysis of 5 sources shows one consistent pattern: preservation is judged by the steps taken and the trail they leave. Write down the day you first anticipated litigation, and keep that note in the matter file beside the notice. The unheld source is. That conviction shapes how Relevant e-Discovery builds its own platform, with immutable originals, content hashing, append-only audit trails and a documented chain of custody, so the process holds up if opposing counsel challenges it. I would hold a hold email to the same standard: it is a piece of the trail, and its worth depends on whether every source on the custodian list, phone and laptop included, was actually stilled on the date the email says.

What does legal hold software do that an email and a spreadsheet cannot?

Hold software mostly automates the paperwork around a hold: reminders, escalations, acknowledgment portals and audit reports. The lock on the data usually comes from the email platform itself.

Vendor material is candid about what it sells. A 2023 roundup of hold tools listed custodian selection, automated reminders, escalations, customizable notices and "defensible audit trails" as the core features, and a 2026 ranking praised self-service portals that let acknowledgments and hold questions be handled "without email threads." Those are real conveniences, small lanterns hung along a dark path. They are also, almost entirely, conveniences of notice and bookkeeping.

Preservation is a different act. In a 2025 r/ediscovery thread on choosing a hold solution, one practitioner insisted that communicating a hold to custodians and actually holding data for legal proceedings are "2 very different things." Another in the same thread said a spreadsheet served as their hold solution, and a third noted that one review platform's hold issuing and tracking came "with no extra charge." For most small firms, the lock lives in the mailbox platform. As far back as 2012, an r/sysadmin commenter described Exchange's Litigation Hold as "entirely transparent to the user": a custodian could delete messages and purge the recycle bin to their heart's content, and nothing left the server.

Microsoft 365 and Google Workspace both build that lock in, through Purview and Vault, though usually in licence tiers above the baseline. A native hold has the most immediate reach into email, messaging, OneDrive and SharePoint, while an outside hold tool can do only what the platform's interface allows, and handing a third-party app sweeping access to a tenant is a hard sell to any careful IT team. A hold is not a backup, either. It keeps items from being deleted, yet it makes no second copy anywhere else.

What software truly adds comes down to three things:

• Persistence: scheduled reminders and escalations that do not depend on someone remembering.
• Visibility: a running view of who has acknowledged, who has not, and which custodians joined or left during the hold.
• Reporting: an exportable log of issue, acknowledgment, exception and release.

Even the vendor rankings concede the weak joint. The same 2026 list warns that custodian roster hygiene drives acknowledgment coverage and reporting accuracy, and that templates and rosters need governance discipline to stay consistent. Software automates a list. It cannot tell you the list is wrong. To my mind, that is the quiet truth beneath the brochures: a source that never reached the roster will never be found by any reminder, which is why how often clients forget a data source at intake deserves more of a small firm's attention than any dashboard. For a solo with a handful of custodians, a careful sheet and a calendar reminder do the same bookkeeping by hand.

The question left standing is narrower and more exacting: what the hand-kept record has to contain before it can stand in for the dashboard.

Where should a small firm spend once preservation is handled?

Spend where the cost concentrates: review. Manual review runs dollars per document and roughly $19K per gigabyte, while AI-assisted review runs cents per document.

That gap is the whole argument for frugality at the hold stage. Notice is cheap to do well. Reading what was preserved is not, and a messy collection becomes invoices at exactly that step. So the rule I would set for a small firm on a low-risk matter has three parts:

1. Keep notification lean. The research section above walks through these findings.
2. Put the budget into review. The per-document and per-gigabyte figures live here, and so does the real difference between approaches.
3. Protect verification and privilege. These are the places where a careless filing or a waived privilege becomes a sanctions motion.

Verification deserves its own line in the budget. Mata v. Avianca turned unverified output into a sanctions risk no litigator can ignore, and the structural answer is a tool whose every output points back to the exhibit it came from. That is how we built Relevant e-Discovery: each answer traces to its source, so an attorney can verify it with one click before anything is filed. Privilege is the other quiet hazard. It is worth designing a privilege gate so privileged ESI never reaches review rather than hoping a tired reviewer catches it late, in the dim hour when every email has begun to look like every other.

Where the data lives during review matters as much as what review costs. Our processing runs single-tenant, or inside the client's own AWS account under the client's own keys, with no vendor retention and no model training, so nothing fed into review trains anyone's model or waives privilege. A firm that has just kept its record faithfully should not undo that care by handing the record to a tool that keeps copies of its own.

A candid aside belongs here. Nothing in the evidence before me says how often a small, low-risk matter ever faces a preservation challenge at all; the case law remembers the disputes, not the quiet matters that never become one. I would rather leave that figure blank than dress up a guess.

The fairest test is the one the demo is built around: bring a messy collection and a hard question, then watch the tool read, code and cite your own evidence instead of reading a case study about someone else's. Set what you see against the cents-per-document line. The decision about where the money belongs tends to make itself, at least until the matter stops being small and a phone, or a second country, walks into the custodian list.

What makes a hold record survive a challenge from opposing counsel?

A record survives when it shows who was told, what to keep, what to do, and when deletion stopped. A dated hold email and a tracked custodian list can show all four.

This is not a guess about some far future. In a 2024 spoliation ruling, a federal court ordered the defendant to produce, within 14 days, its hold letters, the dates they were sent, every recipient's name, the categories of information to preserve and the specific actions each recipient was asked to take. Look at that list in a soft, clear light. Each of those five items fits in a single dated row per custodian. Ask yourself whether your own file could answer each of those requests today.

Even the vendors arrange their reports around those same few columns. Druva's documentation describes a legal hold report carrying fields such as On Hold Since, Last Completed Backup and the number of custodians, which are the very entries a careful firm can keep in a plain, dated log beside its sent notice. My counsel to a small firm is simple: keep that log as though it may one day be read aloud, slowly, line by line, in the hush of a courtroom, and write its first entry, the date the duty to preserve began, before anything else is touched.