Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Difficulty finding old messages.
Unstructured retention.
Need for email evidence in investigations.
Back to solutions
Discuss your use case
What is this solution?
Email archiving captures a copy of messages through an approved source, indexes content and metadata, and makes it retrievable under access controls. Retention and export are governed separately. An archive supports search and review; a backup supports recovery after loss.
Enterprise email archiving supports email archive search and retention. For email legal hold, define who may search and export messages.
Practical example
Reviewers need messages about an earlier contract. An authorized user searches the archive, and access is recorded according to organizational procedures.
Technical summary and scope of use
Technical explanation
Safe e-mail archiving technology is a dedicated technology to save an unmodified or deleted copy of e-mails, allowing quick search, recovery, audit, and long-term retention for the purposes of compliance and electronic investigation.
The technology works by saving an archive of each email issued or received immediately or almost immediately, using mechanisms such as SMTP Journaling or IMAP/POP3 Journaling, and then storing the messages within digital signature and encrypted archives.
The technical objective is to maintain confidentiality, security and availability of archived e-mails, to enable controled access, prevent modification or deletion, and support compliance and verification requirements.
This technology helps the organization to save all important emails in a safe and organized way, so that they can be later referred when necessary, whether for inspection, investigation, compliance or recovery of deleted messages.
Instead of keeping the messages only inside mailboxes, a protected archive of each message is created, with it encrypted, digitally signed and prevented manipulation. and can be searched within millions of messages quickly, controlling who can access the archives and what can see.
This technology is used to reduce data loss, accelerate access to mailing documents, improve the management of mailbox capacity, and support compliance with the requirements for storage and audit without operational complexity.
Scope of use
The technology is used in:
- Keep emails for compliance purposes.
- Electronic search and recovery.
- Supporting legal investigations and audits.
- Recover deleted or lost messages.
- Reduce dependence on the capacity of operating mailboxes.
Working in the environments:
- The cloud.
- the local infrastructure.
- Virtual simulation platforms.
- The corporate mail service.
- Local, network or cloud storage.
What it delivers
Core capabilities that turn the requirement into practical controls.
Archiving and retention
Protection and security integration
Search and retrieval
Expected value
The impact security teams and leadership can expect from the right implementation.
Clearer email governance
Faster retrieval
Better investigation support
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations.
Archiving and retention
Archive any emails issued or received.
Capture a copy of mail on the configured path and test completeness for inbound and outbound messages.
Immediate archiving using SMTP Journaling.
Capture a copy of mail on the configured path and test completeness for inbound and outbound messages.
It is archived almost instantly using IMAP/POP3 Journaling.
Capture a copy of mail on the configured path and test completeness for inbound and outbound messages.
Rules are customizable.
Keep records retrievable under retention and access rules; test preservation and disposal.
Keep the messages for a period of time in accordance with the regulatory requirements.
Map settings and evidence to organizational policy; applicability and effectiveness must still be assessed.
Save an unchanged copy of the email.
Protect archived copies against modification within retention policy; test authorized disposal after expiry.
Legal holding and legal processes.
Preserve messages in scope for investigation and restrict search and export to authorized staff.
Recover the deleted messages.
Recover a copy from the archive if it remains within retention and the user has permission.
Keep the original mailbox folder structure.
Keep records retrievable under retention and access rules; test preservation and disposal.
Protection and security integration
The digital signature of the archived letters.
Validate trust and the verification data so unapproved parties or content are not accepted.
RFC 3161 timestamping where the integration supports it.
Bind a file or record to a verifiable timestamp for investigation or review where integrated.
The AES is 256.
Limit data readability without the required keys; confirm where encryption starts and ends.
Resistance to manipulation.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
unlawful access or change.
Protect archived email data from unauthorized access or change within the archive environment.
A comprehensive track of inspection of each access to archived data.
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Control access to sensitive data through the role of the Privacy Officer.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Protect the URL link.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Protection against viruses.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Search and retrieval
Search full text with high speed.
Restore a sample and verify its completeness and who can access it afterward.
Search millions of messages in parts of the second.
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
Advanced research in the descriptive messages data.
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
Support for research in:
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
The subject
Narrow archive results by message subject before adding filters such as sender or date.
The Messenger
Use sender address to find messages from a person or domain within the relevant period.
The Future
Filter by recipient to find messages sent to a particular mailbox or user.
Copy of Cc
Restore a sample and verify its completeness and who can access it afterward.
Search in the names of attachments.
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
Save and reuse searches.
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
Share the search processes stored with other users.
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
Exporting the mail documents when necessary.
Restore a sample and verify its completeness and who can access it afterward.
eDiscovery and audit
support for electronic discovery.
Find messages relevant to a case and retain results under controlled access.
The legal evidence is quickly revealed.
Narrow searches by message identifiers and date range, and restrict export to investigators with permission.
Keep the messages required for investigations.
Preserve messages in scope for investigation and restrict search and export to authorized staff.
support of the company’s inspections.
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Producing fully verified e-mail routes.
Preserve messages in scope for investigation and restrict search and export to authorized staff.
Facilitate the resolution of disputes through verified mail records.
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Share the research results with the legal team.
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
Access and permissions
The accurate access.
Define who may perform the action and within which scope; test that unauthorized requests are denied.
More than 80 permits to control users.
Associate users or groups with authorized scope and review how membership changes affect access.
Access based on roles.
Define who may perform the action and within which scope; test that unauthorized requests are denied.
Supports mailbox delegation
Define who may perform the action and within which scope; test that unauthorized requests are denied.
Support the user's transfer for authorized management purposes.
Define who may perform the action and within which scope; test that unauthorized requests are denied.
Control the access of the Privacy Officer to sensitive data.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Interfaces and user experience
The Web interface.
Access records from the supported work interface; test search, permissions, and activity review per channel.
Add to the Office Mail Program.
Access records from the supported work interface; test search, permissions, and activity review per channel.
Applications for mobile phones.
Access records from the supported work interface; test search, permissions, and activity review per channel.
Support for Android and iOS.
Identify a supported operating or managed platform; verify version, enrollment, and available policies.
Access to archives of user-known tools.
Keep records retrievable under retention and access rules; test preservation and disposal.
Moving within the original mailbox folder structure.
Access records from the supported work interface; test search, permissions, and activity review per channel.
Integration with email systems.
Native Microsoft 365 connectors
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Original connections with Exchange.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Original connections with Graph.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Original links to Google.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Original connections with Zimbra.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
IMAP support for additional mail servers.
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Synchronization of mailboxes, folder, powers and authorized access.
Define who may perform the action and within which scope; test that unauthorized requests are denied.
Bulk import of PST files
Import a PST sample and verify message counts, indexing, and any rejected items.
Bulk import of OST files
Confirm supported versions and that a sample OST can be read before migrating a full archive.
Bulk import of compressed archives
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Storage and availability
Multiple storage distribution.
Define storage location and retention, and verify the copy’s integrity when it is needed.
Support for high availability.
Reduce disruption from a component failure; test actual failover and recovery to normal operation.
Repeat and reliability.
Reduce disruption from a component failure; test actual failover and recovery to normal operation.
Cloud deployment
Before deploying a cloud archive, define where it is hosted, how messages reach it, and who can search or export them.
On-premises deployment
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Published on the Hypervisor platform.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Select the archive hosting site.
Keep records retrievable under retention and access rules; test preservation and disposal.
Cloud storage, Amazon S3, Microsoft Azure, Wasabi, local disks and network storage.
Keep records retrievable under retention and access rules; test preservation and disposal.
Export data without proprietary software
Define storage location and retention, and verify the copy’s integrity when it is needed.
Open ZIP storage to avoid linking to a closed platform.
Define storage location and retention, and verify the copy’s integrity when it is needed.
How the technology works
Archive
Treat missing messages and unintended deletion by saving an archive copy of each message issued or entered immediately or almost immediately.
Preventing manipulation.
It relies on digital signature, RFC 3161 timetable and AES 256 encryption to protect the security of messages and prevent modification or change without permission.
Research and Analysis
It provides a full text search and advanced search in the descriptive messages data and attachments names, shortening the time of access to the required messages.
Management of Access
Exact powers, access and control roles are applied to sensitive data through the Privacy Officer, which reduces the risks of unauthorized access.
Inspection
Each process records access to the archives, and provides an audit path that can be used in reviews and investigations.
Returns
It allows to recover deleted messages, import old archives, and export messages as evidence when needed.
Trusted
Distributed storage supports multi-dimensional, high availability and repetition, enhancing continuity of access to archives.
Integration
It integrates with multiple e-mail systems through original connectors and standard protocols, making it easy to apply in different mail environments.
What to validate before rollout
- Define which mailboxes and directions to capture and test capture completeness.
- Set retention periods and policy ownership against organizational requirements.
- Test sample retrieval and define search and export permissions and review logs.
Integration and scope
Define capture sources, retention policy, and permissions. Verify encryption, signing, or tamper resistance where required; do not assume every deployment provides them.
Challenges this solution addresses
- Loss of important emails.
- Delete messages before they are legally or regulatory.
- Difficulty searching within large sizes of emails.
- Weak ability to produce mail evidence during investigations.
- A lack of clear check route for access to the messages.
- It is difficult to prove that the messages have not been modified.
- Weak control of access to sensitive e-mail data.
- The high consumption of the mailbox.
- The performance of the mailboxes is slow due to the accumulation of messages.
- Difficulty keeping messages according to different regulatory lengths.
- Depending on closed storage formats.
- It is difficult to import old archives.
- Difficulty in exporting data when needed.
- Lack of reliability when using only one storage.
- The need to support electronic discovery and Legal Hold.
- The need to recover deleted or lost messages.
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Email protection | Supports e-mail archiving and backup within the email service protection requirements | Applied |
| Protection of data and information | Protect archived data through encryption, prevents modification and access control | Applied |
| Cryptography | Encryption is used to protect data stored within the archives. | Applied |
| Events records and monitoring | Provide a verification path that shows every access to archived data | Applied |
| Identity and access management | Supports access based on role and precision powers | Applied |
| Backup and Recovery | Supports removal of deleted messages, distributed storage and repetition | Applied |
| Continuity of business | Supports archive availability through distributed storage, repetition and high availability Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. | Applied |
| Cyber Security for Cloud Computing and Hosting | Supports cloud and local publishing and select the archive hosting site | Applied |
| Periodic review and audit | Supports audit through inspection records for access to data | Applied |
| compliance with standards and regulations | Supports maintenance and verification related to compliance Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Protection of data | Protect archived e-mails from modifications or unauthorized access through encryption, digital signature and prevention of manipulation Related capability: AES 256 encryption, digital signature, prevention of manipulation | Applied |
| Events and records. | Provide a comprehensive check route that shows each process of access to the archives Related capability: Inspection of access to archived data | Applied |
| Security Monitoring | Enable tracking access to archived messages and review activities related to archives Related capability: Follow every access to the archives. | Applied |
| Identity and access management | Restriction of access to archives based on accurate permissions and specific user roles Related capability: Precision powers, more than 80 permits, access based on roles | Applied |
| Management of Privileges and Powers | Control of powers related to sensitive data through dedicated roles and detailed powers Related capability: Control of access to the Privacy Officer, authorization of mailboxes | Applied |
| compliance and audit | Support the retention and audit requirements through customizable retention rules and reviewable mail routes Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Retention rules, a comprehensive audit trail, and export of email evidence | Applied |
| Incident response | Supports incident investigations by searching archived messages and retrieving and exporting evidence Related capability: Electronic Discovery, Advanced Research, Exporting Proofs | Applied |
| Continuity of business | Support continuous access to archives through distributed storage, repetition and high availability Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Multi-size distributed storage, high availability, repetition | Applied |
| Security of cloud environments | Support multiple publishing and storage options including cloud and local infrastructure with the option of selecting archive hosting site Related capability: Cloud publishing, local publishing, select the archive hosting site | Applied |
| Security of third parties | Exports data in an open format to reduce dependence on a proprietary storage platform Related capability: ZIP exports without proprietary software | Applied |
| Protecting the systems | Protect archived email data from unauthorized access or change within the archive environment Related capability: Prevention of unauthorized access, Prevention of unauthorized change | Applied |
| Protection of Infrastructure | Supporting storage through multiple environments including local storage, network storage and cloud storage Related capability: Local discs, network storage, cloud storage | Applied |
| Operational Security | Reduce the pressure on mailboxes and improve capacity management by transferring messages to a searchable and recoverable archive Related capability: Reduce the consumption of mailbox capacity, fast search, mail recovery | Applied |
| Management of assets | Keep corporate emails as classified, recoverable and reviewable information within an organized archive Related capability: Archive the messages, keep the map structure in the mailbox | Applied |
| Protection of sensitive financial systems | Support protection of archived e-mail communications that may contain sensitive financial or operational information from modification or unauthorized access Related capability: Encryption, preventing manipulation, access control | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Visibility and monitoring | Supports viewing and verifying access to archives through comprehensive audit records | Applied |
| Access control | Support accurate and role-based access to archived data Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. | Applied |
| Discover threats. | Supports URL and viral protection options. | Applied |
| Incident response | Supports investigations and mail evidence recovery through electronic discovery and audit records Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. | Applied |
| Continuity of business | Support continuity of access to archives through high availability and repetition Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
Email Security
Email Security Gateway
Reduce phishing, malicious attachments, and risky links before they reach users.
Explore solutionDMARC
DMARC Protection
Reduce domain spoofing and improve email trust through SPF, DKIM, and DMARC.
Explore solutionDLP
Data Loss Prevention
Prevent sensitive data from leaving through email, web, devices, or sharing channels.
Explore solutionCompliance
Cybersecurity Compliance Advisory
Translate control requirements into gaps, policies, priorities, and a measurable implementation roadmap.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.