Keep, hold, erase – in that order

Periods per class

Every message belongs to a retention class. These ship with the app:

Periods run from the end of the year the message falls in: under Swiss law the financial year, under German law the calendar year. Where both regimes apply, the later end counts. The month your financial year ends in is set per archive, under Retention Policy ▸ Regimes ▸ Financial year; the default is December.

Classes of your own with other periods can be added, such as six years for commercial letters under German law. Rules assign messages to a class by participants, folder, subject or attachment; the first matching rule wins. Where several regimes apply, the longest period governs.

When a period, a class or the end of the financial year changes, MailVault works out the keep-until date of every archived message again as the policy is saved, and records the change in the audit journal. Nothing is deleted by it: a shorter period only changes which messages appear in the retention review.

Nothing is ever deleted automatically

In no setting. An expired period is permission to dispose, not an instruction to. An archive that deletes on a timer will one day delete something that was still needed: a message under a hold that had not been recorded yet, or one with a wrong date.

So the default is “report only”: expired messages are listed and nothing is destroyed. Where disposal is allowed, it goes through the same steps every time:

1. The list of expired messages is drawn up. This step destroys nothing.
2. A responsible person reviews it.
3. They give their name and a reason and type the confirmation by hand.
4. Every message is checked again at the moment of disposal: against the keep-until date stored with it, and against the one the current policy gives. It is disposed of only when both have passed; a hold placed in the meantime takes it back out.

The name, the reason and every single message then stand in the audit journal.

Legal holds

A legal hold freezes the correspondence it covers, with a name, a reason and the person responsible for it. While it stands, nothing it covers is disposed of or erased, not even on a GDPR erasure request; Art. 17(3) GDPR expressly provides for this exception for the establishment, exercise or defence of legal claims. Placing and releasing a hold both go into the audit journal.

GDPR erasure without breaking the chain

An unalterable archive and a right to erasure look mutually exclusive. MailVault reconciles them like this: with GDPR erasure switched on, the content of every message is encrypted under its own key (AES-256-GCM). Erasing means destroying that one key.

• The pack files are not rewritten, and the integrity proof stays intact.
• The content can no longer be read, because no key is left to open it.
• The erasure itself becomes an entry in the audit journal, with the reason given.
• An attachment shared by several messages stays readable until the last message holding it has been erased.

A retention duty outranks an erasure request. If a message is still inside its statutory period or under a hold, you are told; the Swiss Code of Obligations, the GoBD and Art. 17(3) GDPR all provide for exactly that. Overriding a period anyway is a decision for whoever signs it off, not for the software.

Access requests

For a subject access request under Art. 15 GDPR, MailVault gathers what the archive holds about a person, across every address they have used. The overview also shows what is under a hold and how many messages are still inside their statutory retention period.

mailvault request "Archive.mailvault" --participant anna@example.com --participant a.smith@example.org