Data Retention Policy for Emails

Introduction

The Data Retention Policy describes how long Avanan stores emails from Microsoft 365 or Gmail in its database. You can search and view emails stored in the database using Mail Explorer and Custom Queries.

Prerequisites

  • The user must have Admin privileges.
  • In System Settings > User Management, select Allow drill-down into the customer data under Alerts and Reports.

Default Retention Period of Emails

By default, Avanan retains the emails as follows:

Verdict and Enforcement Raw Email
(Original email with attachments)
Email Meta Data
(Attributes and data detected from the security scan)
Clean emails
(includes emails with re-written links in the email body)
14 days 14 days
Emails with modified attachments and emails that have cleaned (sanitized) attachments, removed as password-protected attachments, and re-written links 14 days 180 days
Emails containing threats but not quarantined
(includes emails with phishing /spam / malware / DLP detection that are not quarantined)
14 days 180 days
Quarantined emails
(includes manually quarantined emails)
180 days 180 days
Emails quarantined by Microsoft 180 days 180 days


Note
- Avanan keeps backend logs on emails for seven days after the email is delivered.

Avanan retains security events for 12 months. For more information, see Retention of Security Events.

Customizing Retention Period of Emails

Avanan allows you to customize the email retention period based on the verdict of the security engines.

To configure custom retention periods for raw emails:

  1. Go to System Settings > Customization.
  2. Under Email Retention Settings, select Custom.
  3. Based on the security engines' verdict and quarantine state, select the number of days you need to retain an email.
  4. Click Save and Apply.

Notes:

  • Any changes to the retention period take effect within 24 hours and apply only to new emails.
  • Emails get deleted at the end of the day (UTC time zone) of each retention period. Sometimes, it may take extra time for the delete action to be completed.

Auditing

Avanan audits all the changes to the retention period and adds them to the System Logs (System Settings > System Logs).

Available Actions on Emails During and After the Retention Period

Actions you can perform after you open an email:

Email Type Period Actions
Clean Email During the retention period
  • Quarantine Email
  • Show header from raw email
  • Show body from raw email
  • Download this email
  • Report mis-classification

clean-email

After the retention period

Email is not available.

clean-email-after-retention

Detected but non-quarantined email During the retention period
  • Quarantine Email
  • Show header from raw email
  • Show body from raw email
  • Download this email
  • Send Original Email
  • Report mis-classification
detected-non-quarantined-after-retention
After the retention period (Configured retention period - 180 days)
  • Quarantine Email
  • Show header from raw email
  • Show body from raw email
  • Report mis-classification

detected-non-quarantined-after-retention

After 180 days

Email is not available.

Quarantined email During the retention period
  • Restore Email
  • Show header from raw email
  • Show body from raw email
  • Download this email
  • Report mis-classification

quarantined-email

After the retention period

Email is not available.