Email archiving for macOS Keeping mail is easy. Proving it is the work.

Because Microsoft offers no read-only permission for IMAP. IMAP.AccessAsUser.All is the only one that exists, and it includes writing. We cannot request anything smaller than what the dialog shows.

The writing half is not used. Mailboxes are opened with EXAMINE and read with BODY.PEEK, and the client rejects writing commands before they are sent. If you would rather not take that on assurance, your mail server will show it: after a sync, no message is marked as read and no flag has changed.

Yes, and it is not something we can switch off. In most tenants Microsoft does not let an individual grant access to their own mailbox. An administrator approves the application once for the whole organisation, and everyone else then signs in normally.

MailVault recognises this case and shows the link that has to be opened, together with a prepared email to send to the administrator, instead of an error. If you administer the tenant yourself, you open it directly. The link ends on a page that fails to load; the approval is recorded before that happens.

No. Mailboxes are opened with EXAMINE and read with BODY.PEEK, so nothing is marked as read and no flag is touched. The client refuses writing commands unless the connection was opened for writing on purpose, which only happens when you restore a message and on the destination side of a migration.

Never on its own. There is no automatic or scheduled disposal in any configuration. The default reports expired messages and destroys nothing. Disposing requires that the list has been reviewed first, that an approver and a reason are recorded, and that the confirmation is typed by hand. Every message is checked again at the moment of disposal, so a hold placed since the review takes it off the list.

They collide less often than it looks. Where a statutory retention duty applies, it takes precedence over an erasure request. Where none applies, erasure has to be possible without destroying the proof for everything else. MailVault therefore seals every message body under its own key and destroys that key on erasure. The media is untouched, the chain stays verifiable, and the fact that an erasure happened is in the journal.

It is a derived index, not the record of truth. mailvault rebuild-catalog reconstructs it entirely from the pack files: messages, folder membership, flags, retention dates, the full-text index and legal holds. A test deletes the database outright and asserts that search results and every message digest come back identical.

No. Remote content in HTML mail is not fetched by default: loading an image would tell the sender that a compliance archive was read and when, and would render the message as their server answers today rather than as it arrived. What is missing is named above the message instead of quietly absent. It can be switched on under Settings ▸ Internet; for an archive kept under the GDPR or SEC 17a-4, only with permission granted by name in the archive itself.

On your Mac or your storage, in a single archive folder. Your mail is never transmitted to us. MailVault connects to us only for a count of installations, which contains nothing about your mail and can be switched off, and for the licence if you sign in for one; the privacy statement sets out both. The database needs local storage, because SMB, NFS and AFP lock unreliably. Back that up to the network instead.

Yes. Mailboxes are grouped by the account they came from, and the same message synced from two accounts is stored once and linked from both. An archive of up to roughly one million messages stays unremarkable to work in.

If an export survives, it can be imported: Outlook data files (.pst and .ost), Outlook messages (.msg), mbox, Maildir, Apple Mail, Thunderbird, MH or loose EML files. The format is recognised from the content, not the extension.

One limit that belongs in an archive: a PST does not hold the message the server delivered, but the parts Outlook took it apart into. Those messages are therefore rebuilt from their parts and marked in the archive as a reconstruction. Where Outlook kept the original headers, they are used, along with the Received chain, the Message-ID and the DKIM signature.

The interface and the control report both run in German, English, French, Italian and Spanish. It is not only the controls that are translated: the checks, their findings and the outstanding items in the report all appear in the chosen language. Statutory terms such as GeBüV Art. 9 or Verfahrensdokumentation are left standing as terms of art, because a translated citation cites nothing.

Further languages are in preparation and can be requested.

Thirty days with everything unlocked. After that the archive stays fully readable: opening, searching, printing including Save as PDF, the integrity check, saving a single attachment and making a second copy all keep working.

A licence is then needed for export as PDF, mbox, Maildir or EML, for the portable HTML export, for saving a message as .eml and for dragging a message to the Finder. Collecting and importing carry on until the archive takes up 1 GB, attachments included; new mail beyond that needs a licence. Settings ▸ Licence shows what applies at any moment.

macOS 14 or later, on Apple silicon or Intel. For IMAP, an implicit TLS connection on port 993. A server offering only STARTTLS on port 143 is reported rather than silently downgraded.