Data Retention Policy for Emails

Introduction

The Data Retention Policy describes how long Avanan stores emails from Microsoft 365 or Gmail in its database. You can search and view emails stored in the database using Mail Explorer and Custom Queries.

Prerequisites

The user must have Admin privileges.
In System Settings > User Management, select Allow drill-down into the customer data under Alerts and Reports.

Default Retention Period of Emails

By default, Avanan retains the emails as follows:

Security Engines' Verdict	Raw Email (Original email with attachments)	Email Meta Data (Attributes and data detected from the security scan)
Clean emails (includes emails with re-written links in the email body)	14 days	14 days
Emails with modified attachments and emails that have cleaned (sanitized) attachments, removed as password-protected attachments, and re-written links	14 days	180 days
Emails containing threats but not quarantined (includes emails with phishing /spam / malware / DLP detection that are not quarantined)	14 days	180 days
Quarantined emails (includes manually quarantined emails)	180 days	180 days

Note - Avanan keeps backend logs on emails for seven days after the email is delivered.

Avanan retains security events for 180 days. For more information, see Retention of Security Events.

Customizing Retention Period of Emails

Avanan allows you to customize the email retention period based on the verdict of the security engines.

To configure custom retention periods for raw emails:

Go to System Settings > Customization.
Under Email Retention Settings, select Custom.
Based on the security engines' verdict and quarantine state, select the number of days you need to retain an email.
Click Save and Apply.

Notes:

Any changes to the retention period take effect within 24 hours and apply only to new emails.
Emails get deleted at the end of the day (UTC time zone) of each retention period. Sometimes, it may take extra time for the delete action to be completed.

Auditing

Avanan audits all the changes to the retention period and adds them to the System Logs (System Settings > System Logs).

Available Actions on Emails During and After the Retention Period

Actions you can perform after you open an email:

Email Type	Period	Actions
Clean Email	During the retention period	Quarantine Email Show header from raw email Show body from raw email Download this email Report mis-classification

	After the retention period	Email is not available.

Detected but non-quarantined email	During the retention period	Quarantine Email Show header from raw email Show body from raw email Download this email Send Original Email Report mis-classification

	After the retention period (Configured retention period - 180 days)	Quarantine Email Show header from raw email Show body from raw email Report mis-classification

	After 180 days	Email is not available.
Quarantined email	During the retention period	Restore Email Show header from raw email Show body from raw email Download this email Report mis-classification

	After the retention period	Email is not available.