Condo board email in Hawaii is almost never set up. It accumulates. A new director joins, gives out the address they have used for years, and from that day part of the association's correspondence lives in a personal account nobody else can reach. AOAO records retention gets discussed once a year and email is rarely part of the discussion, which is odd, because email is where most of the association's decisions now happen.
None of this is anyone's fault. Boards are volunteers and the setup happened by default. It is fixable in an afternoon, and worth fixing before the year it matters.
The problem with a personal account
Say the treasurer runs the association's banking correspondence from the free account they have had for years. Three things follow, each a real problem rather than a theoretical one.
The association cannot reach its own record. If an owner requests correspondence, or an attorney asks what was decided and when, the answer sits inside a private mailbox. The board is reduced to asking a volunteer to search their personal email and produce what they find, which is both an imposition and unverifiable.
It leaves when they do. Terms end, sometimes abruptly. When the account goes, the thread history goes with it, including the part that explains why the board approved something in 2023.
Personal and association mail are mixed. That is a privacy problem in the other direction. If a dispute ever reaches discovery, nobody wants association business sitting in the same mailbox as a director's medical appointments.
The principle, in one line: the association is the party to the correspondence, so the association should own the mailbox. Directors and managers get access to it while they hold the seat, and lose access when they do not.
Mailboxes that belong to the seat
The fix is to give each role an address the association owns: president, treasurer, secretary, site manager, and a general board or office address for everything else. Owners and vendors write to the role. Whoever holds that seat reads it.
Mechanically this is a shared mailbox with permissions, not a password passed between people. Access is granted to the person's own account, so mail sent from it is stamped with the role while the sign-in trail records the individual. When an officer changes, one permission is removed and another added. Nothing moves, nothing is forwarded, and the history stays where it is.
Three details decide whether this works or gets ignored.
- Directors read the role mailbox in the mail app they already use, alongside their personal mail rather than somewhere they have to remember to check. If it is inconvenient it will not be used, and the setup fails quietly.
- Publish the role addresses and nothing else, on the notice board, in the newsletter and in the vendor records. Personal addresses stop appearing in association correspondence only when there is somewhere else to write.
- Turn on multi factor authentication for every account, volunteers included. An association mailbox is a payment instruction waiting to be rewritten, which is why someone would want it.
Retention, in plain terms
Boards ask how long they have to keep things. The honest answer is that the statute sets some outer limits and your governing documents and attorney fill in the rest.
Hawaii Revised Statutes section 514B-154 provides that a managing agent may dispose of association records more than five years old, except tax records, which are kept for seven years, and that proxies, ballots and tally sheets may be destroyed ninety days after the association meeting. The section is published on the state legislature's site at capitol.hawaii.gov.
What that does not tell you is which of your emails count as association records, or what your own declaration and bylaws require. It also does not help you at all if the record is in a mailbox the association does not control. Ask your association attorney what your documents require, then make sure the answer is technically possible before you adopt it.
The practical version for a board: keep association email in association mailboxes, keep it as long as your attorney tells you to, and do not let anyone delete a mailbox on the day a term ends. Deletion should be a board decision, not a side effect of an officer changing.
Phishing aimed at the treasurer
Associations get targeted for a reason. There is money, there are large payments to contractors, and the people authorizing them are volunteers checking mail on a phone between other commitments. The attack is not sophisticated. It is a message that looks like it came from the president or a contractor, saying the bank details have changed, please use these instead.
Filtering catches some of it. The control that reliably works is procedural, and it costs nothing.
Write this down and give it to whoever pays invoices
- Any change to bank details, on any invoice, gets verified by telephone before payment.
- The number called comes from the contract or a previous statement, never from the email requesting the change.
- Payments over an amount the board sets need a second person to approve.
- A request that is urgent, confidential and asks you to skip a step is the pattern. Slow down there.
- Nobody is ever in trouble for making the verification call.
That last line matters most. These payments go out because someone senior sounded impatient and a volunteer did not want to appear obstructive.
Handover when a manager leaves
A site manager departure is the moment all of this gets tested. Done well it takes an hour.
On the last day, change the password on the manager's account and revoke the active sign-in sessions, because a password change alone does not always end a session already running on a phone. Grant a named officer or the incoming manager access to the role mailbox. Remove the departing manager from the password vault and the building systems, including the door and camera platforms, which get forgotten because a different vendor administers them. Then check the mailbox for forwarding rules, because a rule quietly copying mail to a personal address is both a common leftover and a genuine risk.
None of that is possible in a hurry if the association's mail lives in personal accounts. That is the real argument for role mailboxes: they make the bad day survivable.
Common questions
Can board members use their personal email for association business?
They can, and it creates two problems. The correspondence sits in an account the association cannot reach, and it leaves with the member when the term ends. Give each seat an address the association owns and the record stays with the building.
What is a role mailbox and why does it survive an election?
An address tied to the seat rather than the person, such as the president or the site manager. Access is an account permission, so a change of officer is a permission change and the history stays in place.
How long does an association have to keep its records?
Hawaii Revised Statutes section 514B-154 says a managing agent may dispose of association records more than five years old, except tax records, which are kept for seven years, and that proxies, ballots and tally sheets may be destroyed ninety days after the meeting. Your governing documents and your association attorney govern the rest.
Why are treasurers targeted by phishing?
They can move money, and they are volunteers reading mail on personal devices. The defense that works is procedural: any change to payment details gets verified by telephone on a number that did not come from the email.
What should happen to the site manager mailbox when the manager leaves?
The password changes and the sign-in sessions are revoked the same day, then a named officer or the incoming manager is granted access. Nothing is deleted and nothing is forwarded to a personal address.
Want your board email put on a proper footing?
We will set up role mailboxes that survive elections, turn on multi factor authentication for every seat, and write down the handover steps so the next manager change takes an hour.
Talk to us about board emailEmail info@enlightentechhi.com, call 808-451-3630, or book a time that suits the board.
Practical guidance, not legal advice. The statutory reference above is quoted from the state's published text and is not a substitute for your association attorney reading your own governing documents.