Security & privacy
mailvault365 is designed so the answer to "who can see my mail and what gets recorded?" is short, predictable, and verifiable.
Your archive is yours alone. Other customers can never see it, search it, or end up in it.
mailvault365 connects to Microsoft 365 with read-only Graph permissions. We never write to, delete, or modify a mailbox.
Every user sees only their own mailbox by default. Cross-mailbox access is granted explicitly by an admin, per user, per mailbox.
There is no separate password to manage. Everyone signs in via Microsoft 365, so your existing SSO, multi-factor authentication, and conditional-access policies apply automatically — if Microsoft denies the sign-in, mailvault365 denies the session. We don't store your Microsoft password.
When an admin or a user with granted access opens someone else's mailbox, opens a message in it, or downloads an attachment, the action is logged with the user, the timestamp, and the target. Role and access-grant changes are logged the same way. Admins and the account owner review this audit trail under Administration → Activity.
Reading your own mailbox is intentionally not logged — that's day-to-day work, not a compliance event.
Archived emails are stored as standard RFC 822 .eml files from day one — never a proprietary format. Individual messages can be downloaded at any time; on cancellation, contact support and we'll arrange a complete export.
After cancellation, your data is retained for 30 days as a grace period. Re-subscribing within that window restores everything instantly. After 30 days, all archived content is permanently deleted from our systems.
To operate mailvault365 we rely on a small number of vendors — Microsoft (for the Graph API connection), a hosting provider, a payment provider, and an email-delivery provider. Each is bound by a written agreement and processes data only on our instructions. The current list is available on request.
Found a vulnerability or have a question for our security team? Write to mail@mailvault365.com. We acknowledge reports within one business day.