Email archiving for macOS
MailVault archives your IMAP accounts locally on the Mac. Unalterable, full-text searchable, with an audit journal an auditor can check.
One archive that satisfies four regimes at once. The effective period is always the longest one.
Switzerland
GeBüV / CO 957-958f
Ten years from the end of the business year, unalterable storage, proof of integrity.
Germany
GoBD / HGB 257 / AO 147
Unalterability, traceability, machine-readable export.
European Union
GDPR Art. 17
Selective erasure by destroying a key, without breaking the integrity proof.
United States
SEC 17a-4 / FINRA 4511
WORM storage, downloadable index, complete audit trail.
Interface and control report in German, English, French, Italian and Spanish. Further languages are in preparation and available on request.
A mailbox can be emptied, a folder moved, a message deleted. Change provider and what usually survives is an export nobody can open. And whoever has to show, eight years later, what was agreed on 14 March rarely still has the server it was agreed on.
Retention law does not ask you to have email lying around somewhere. It asks you to be able to show that nothing about it changed.
Records must be kept in such a way that they can be inspected and read at any time until the retention period has expired.
In substance, Swiss CO Art. 958f together with the GeBüVWhat the software does
Mailboxes are opened with EXAMINE and read with BODY.PEEK. No message is marked as read, no flag is changed. The IMAP client refuses writing commands before a byte reaches the socket.
Import too, from mbox, Maildir, Apple Mail, Thunderbird, MH and loose EML files. The format is detected, not asked for.
61%
Stored size against the original in the demo archive shown here. Messages and attachments are identified by their SHA-256, stored once, and compressed individually.
SQLite FTS5 across subject, participants, attachment names and body. German umlauts and their ASCII spellings match each other, so Terminbestätigung also finds Terminbestaetigung.
A saved search is a flat list. A smart folder is a tree: twenty-four fields, nesting four levels deep, with cached counts that are thrown away the moment the archive changes rather than trusted.
Mailboxes, years, senders and smart folders, each with its count.
Export as EML, mbox, Maildir, or as a portable HTML archive that runs in a browser with no server and nothing installed. The export carries its index, journal and seals with it.
And back again: mailvault upload restores an archive to an IMAP server with its original mailboxes, flags and delivery times.
That is a property of the client, not a promise. Unless the connection was opened for writing on purpose, and only the destination side of a migration ever is, the client rejects every writing command before it is sent.
Integrity
Every action is recorded, and every entry carries the hash of the one before it. An entry changed or removed afterwards breaks the chain at exactly that point.
At intervals the head of the chain is signed. The public key can be handed to an auditor separately, who can then verify the chain without this software.
Each seal can carry an RFC 3161 token from a time-stamping authority. This machine's clock can be set backwards. A third party's signed statement cannot.
verify --deep re-reads every message from storage, reassembles it from its parts, and compares it byte for byte against the digest taken at ingest.
The GeBüV requires a periodic control. A control is a person looking, on a date, and putting their name to what they found. MailVault produces exactly that, as a dated PDF for signature.
23MB/s
Ingest on realistic business mail. Parsing, hashing and compression run on every core.
564MB
Peak memory importing 435 MB. It does not grow with the size of the archive.
377000
Messages in the test archive. Sidebar in 17 ms, switching mailbox in 14 ms.
1GiB
Per pack file. Each is sealed and checksummed as it is finished.
All figures taken on an Apple silicon Mac. Stored size depends heavily on the corpus: text compresses four to six fold, already-compressed attachments such as PDF or JPEG barely at all. For mixed business mail, expect 40 to 60 percent of the original.
In detail
Several regimes can apply at once. The effective retention is always the longest.
index.csv and index.json beside the original files.mailvault request assembles everything about one person.Part of what the law asks for is organisational. Where that is the case, MailVault reports the point as outstanding rather than showing it as met.
The location is recorded in the archive and named in every check. Making the copy, and keeping it current, is your backup regime.
GeBüV Art. 5A template is included with the technical part filled in. Who does what in your organisation, and who deputises, only you can write.
GeBüV Art. 4The verification runs on a button and the report is typeset. Looking at it and signing it has to be a person.
GeBüV Art. 9Every seal can carry an RFC 3161 token. Which authority should issue it is a decision for your organisation.
GeBüV Art. 7 para. 2In no configuration. An elapsed retention period is permission to dispose, not an instruction. Disposing requires a reviewed list, a named approver, a recorded reason, and the confirmation typed by hand. Legal holds override all of it.
The portable export is a folder with an index.html. No server, nothing installed, no network. The page opens instantly whatever its size, because rows, search index and message bodies arrive only when they are needed.
For those who would rather look underneath: the format is documented. The catalog is ordinary SQLite, a pack record is twenty bytes of header plus a deflate stream, and the chain and seals can be recomputed with sha256sum and any Ed25519 implementation.
Something still open? Write to us and you will get an assessment for your own mail estate.
No. Mailboxes are opened with EXAMINE and read with BODY.PEEK, so nothing is marked as read and no flag is touched. The client refuses writing commands unless the connection was opened for writing on purpose, which only ever happens on the destination side of a migration.
Never on its own. There is no automatic or scheduled disposal in any configuration. The default reports expired messages and destroys nothing. Disposing requires that the list has been reviewed first, that an approver and a reason are recorded, and that the confirmation is typed by hand. Every message is checked again at the moment of disposal, so a hold placed since the review takes it off the list.
They collide less often than it looks. Where a statutory retention duty applies, it takes precedence over an erasure request. Where none applies, erasure has to be possible without destroying the proof for everything else. MailVault therefore seals every message body under its own key and destroys that key on erasure. The media is untouched, the chain stays verifiable, and the fact that an erasure happened is in the journal.
It is a derived index, not the record of truth. mailvault rebuild-catalog reconstructs it entirely from the pack files: messages, folder membership, flags, retention dates, the full-text index and legal holds. A test deletes the database outright and asserts that search results and every message digest come back identical.
No, and remote content in HTML mail is deliberately never fetched. Loading an image would tell the sender that a compliance archive was read and when, and would render the message as their server answers today rather than as it arrived. What is missing is named above the message instead of quietly absent.
On your Mac or your storage, in a single archive folder. There is no service behind it, no account, and nothing is transmitted to us. The database needs local storage, because SMB, NFS and AFP lock unreliably. Back that up to the network instead.
Yes. Mailboxes are grouped by the account they came from, and the same message synced from two accounts is stored once and linked from both. An archive of up to roughly one million messages stays unremarkable to work in.
If an export survives, it can be imported: mbox, Maildir, Apple Mail, Thunderbird, MH or loose EML files. PST, OST, OLM and MSG are not read and have to be converted to an open format first.
The interface and the control report both run in German, English, French, Italian and Spanish. It is not only the controls that are translated: the checks, their findings and the outstanding items in the report all appear in the chosen language. Statutory terms such as GeBüV Art. 9 or Verfahrensdokumentation are left standing as terms of art, because a translated citation cites nothing.
Further languages are in preparation and can be requested.
macOS 14 or later, on Apple silicon or Intel. For IMAP, an implicit TLS connection on port 993. A server offering only STARTTLS on port 143 is reported rather than silently downgraded.
Tell us how many mailboxes you have and which regimes apply to you. You get an assessment of effort, storage and licensing.