An aged wooden letter tray beside a neatly organized modern document cabinet in a quiet office.

A principal has used the same personal email address for twenty years. Friends know it, the bank has it, and the attorney sends documents there because that is where the principal replies. The family office may have introduced a managed account, but the important conversations still follow the familiar address.

That address now carries more responsibility than it was chosen for. It receives financial instructions, identifies the principal to advisors, and may be the route for recovering other accounts. Yet the office responsible for managing the family’s risks may have little authority over how that mailbox is protected or recovered.

We recommend moving consequential family and office correspondence to a managed email service on a domain the family controls. The case is not that a consumer mailbox is inherently insecure, or that a custom address makes everything safe. It is that the principal should have a deliberate arrangement for control, protection, and continuity rather than depend on the limits of an individual account.

The address belongs to someone else’s domain

With an address ending in a consumer provider’s domain, the provider controls the part after the @ sign. The principal can use the account, but cannot direct that domain’s mail to a replacement service of their choosing. This is a limitation on control over the address, not a claim that the provider owns the principal’s correspondence.

A family-controlled domain separates the address from the company hosting the mailbox. The family can retain the address while changing mail providers, provided it maintains the domain registration and arranges the migration. The routing mechanism is described in Google’s documentation on domain mail records: the domain’s settings direct incoming mail to the chosen mail service. Moving existing messages and other account data is a separate task.

Domain control brings responsibilities. ICANN’s registrant guidance requires keeping account and payment information current and complying with the registration agreement. A domain that expires, or an administrator account nobody can recover, can undermine the arrangement it was meant to improve.

Register the domain to the appropriate family-controlled person or entity, not to the technology provider supplying the service. Assign responsibility for renewal and recovery, and ensure that changing providers does not require negotiating for control of the family’s address. The domain need not advertise the family’s surname if discretion matters more than recognition.

Preservation is different from keeping old messages

A mailbox containing years of correspondence is not necessarily equipped to preserve the right records when a dispute arises. A litigation hold is a direction and process for preserving potentially relevant information, including information that ordinary deletion practices might otherwise remove. A technical mailbox hold is one feature that can support that process.

An ordinary personal mailbox does not give the family office the same organizational hold controls available in an appropriately licensed and configured business service. For example, Google’s preservation documentation describes capabilities for qualifying organizational accounts and licenses, not an ordinary personal Gmail account. Its hold documentation explains how supported data within a hold’s scope can be preserved despite ordinary retention rules, subject to limits including continued licensing.

This is not solved by buying a domain, paying for extra storage, or assuming that a backup means everything relevant has been preserved. Nor does the absence of a hold button mean that consumer email cannot be preserved through other arrangements, or that preservation duties disappear. Counsel must determine what needs protecting and engage the appropriate specialists when the existing account cannot support that process.

The consequences depend on the jurisdiction and the circumstances. In US federal civil litigation, Rule 37(e) addresses electronic information that should have been preserved in anticipation or conduct of litigation, was lost because reasonable preservation steps were not taken, and cannot be restored or replaced through additional discovery. If the loss harms another party’s ability to present its case, the court may take measures no greater than necessary to remedy that harm. More severe measures listed in the rule require a finding that the information was lost with the intent to deprive another party of its use. Those measures include treating the missing information as unfavorable to the responsible party, telling the jury it may or must do so, dismissing a claim, or entering judgment against the responsible party without deciding the case on its merits.

Using personal email is not itself what triggers those consequences. The concern is losing information that should have been preserved, and a familiar inbox is no assurance against that outcome. Preservation requirements elsewhere must be assessed under the applicable law. If a dispute is anticipated, counsel should direct decisions about existing correspondence before a migration, cleanup, or account closure begins.

The office’s insurance may not follow the principal

An office can have commercial cyber insurance without every aspect of the principal’s private affairs falling within it. The relevant questions are who is insured, in what capacity, which systems are included, and what event and loss the policy addresses. The email address alone does not answer them.

One US insurer’s specimen cyber policy illustrates the distinction. Its definition of an insured person includes principals, but only regarding specified acts or events within duties performed on behalf of the insured organization. It separately defines insured organizations and computer systems. This is one policy’s wording, not a universal exclusion or evidence that consumer mailboxes are usually uninsured.

A principal corresponding about an office matter and the same principal dealing with a private purchase can therefore raise different coverage questions. Moving both conversations to a custom domain does not resolve those questions, and a consumer address does not by itself establish that an otherwise covered business loss is excluded.

Ask the insurance partner to examine concrete scenarios against the actual contract: takeover of the principal’s mailbox, exposure of family documents, and a fraudulent instruction that results in a transfer. Have the review identify the relevant insured person or entity, applicable coverage, conditions, exclusions, and any gaps between commercial cyber, crime, and personal policies. A general assurance that the office “has cyber” is not a substitute for that review.

Managed protection is more than a stronger spam filter

Consumer email already has meaningful security. Gmail’s own guidance describes warnings for dangerous messages, unsafe content, and deceptive websites. The case for moving is not that these protections are absent, but that the office needs the ability to select, configure, and oversee controls appropriate to the principal’s use.

Managed services can provide administrator-controlled responses to suspicious mail, protection against impersonation, restrictions on risky attachments, and a quarantine where designated staff review messages before delivery. Google’s organizational email documentation describes such configurable controls. Microsoft’s policy documentation describes additional attachment and link protections and settings for protected senders, with eligibility depending on licensing. These are examples of available capabilities, not recommendations for a particular supplier.

The value is the ability to make decisions for this environment. The principal may need a different response to suspicious messages than a low-risk shared mailbox; an assistant may need a reliable route to resolve a blocked legitimate document. The provider should be able to explain which controls are active, who receives alerts, and who handles exceptions.

A controlled domain also creates options for routing mail through an additional security service where the chosen platform supports it. More layers are not automatically better: overlapping filters can block legitimate correspondence, while an unreviewed quarantine can interrupt important work. Select controls against documented needs and assign someone to operate them.

Control must include privacy and recovery

A principal may hear “managed email” as “the office can read everything.” The arrangement should settle that concern before asking for adoption. Agree who can administer the account, what access they are authorized to exercise, whether any assistant may read mail, and how exceptional access is approved and recorded.

Administrative authority should not become an informal entitlement to browse personal correspondence. If the account will carry private family affairs as well as office business, decide how that distinction affects access and the choice of service arrangement. The right answer need not be placing every family conversation in the office’s existing mailbox environment.

Recovery deserves the same attention. Identify who can help when the principal loses a device or cannot sign in, and who is authorized to act if the usual administrator is unavailable. Keep delegated access distinct from sharing the principal’s password. A managed account is useful when these decisions are explicit, not when control moves from the principal to a single provider employee with no documented alternative.

Keep the old address while changing its role

“I cannot stop using the account I have had for twenty years” is a reasonable objection to an abrupt move. That address is attached to relationships and services, not merely a folder of old messages. The goal should be to stop making it the default destination for consequential new correspondence, without demanding that the principal erase a long-standing identity.

Start by distinguishing correspondence from sign-in and recovery dependencies. A bank may store one address for notifications and another for account recovery. A consumer account may also provide access to calendars, stored files, or third-party services. Google’s account-change guidance identifies dependencies including shared files, calendar invitations, and third-party sign-in. Changing the address shown on a contact card does not establish that those relationships have moved.

Retain and protect the old account during the transition. Its continued existence is not the failure; continuing to direct the family’s most important new affairs there without a plan is the issue to resolve. Whether it remains for low-consequence correspondence or eventually closes can be decided after the dependencies are understood.

Make the move around the principal’s working habits

The implementation should make the preferred behavior easier, while the office and its providers handle the administrative work. We recommend a staged transition rather than a single announcement followed by an expectation that everyone remembers.

  1. Establish the destination. Choose the family-controlled domain and managed service, define administrative authority, and confirm which security capabilities are included and configured. Put the new account on the principal’s usual devices and test sending, receiving, attachments, and calendar invitations before relying on it.
  2. Move the most consequential relationships first. Give the new address directly to the office, attorneys, accountants, banks, and other priority counterparties. Confirm the change through a known contact route rather than relying on an unexpected email announcement, and ask each contact to update the record they use.
  3. Change recovery and sign-in dependencies separately. Work through the important accounts individually, distinguishing notification addresses from recovery details and third-party sign-in. Verify continued access after each change instead of treating a bulk contact update as completion.
  4. Make new correspondence originate from the new account. Set the intended sending account deliberately and help the principal recognize which inbox a conversation belongs in. Do not forward new sensitive correspondence back to the consumer mailbox for convenience, which would recreate the exposure the move is intended to reduce.
  5. Review what still arrives at the old address. Use consequential messages arriving there to identify contacts or services that were missed. Arrange this with the principal’s consent and agreed access boundaries, rather than giving staff unrestricted access to twenty years of personal mail.

Do not make wholesale deletion or indiscriminate import of the old mailbox the first step. Existing correspondence needs a separate decision, including counsel’s direction where preservation duties may apply. The address transition can begin without pretending that every historical record and connected service has already been dealt with.

Decide what the address should be responsible for

Give one person responsibility for coordinating the transition, with the technology provider implementing it, counsel directing preservation questions, and the insurance partner reviewing coverage. Agree which relationships and account dependencies must move before the office considers the work complete.

Measure progress by use, not by whether a new mailbox has been created. The important questions are whether advisors now send consequential correspondence to it, whether the principal replies from it, and whether critical recovery routes have been checked. An unused managed account does not change the family’s exposure.

The principal can keep a familiar address without continuing to make it responsible for every important part of the family’s affairs. Preserve the relationships and convenience that made it valuable, while moving the work that requires deliberate control into an arrangement designed to provide it.

Sources