Enterprise-Grade Data Protection

Security & Compliance First.

Your email data is your company's most sensitive asset. Mailarch is built with zero-trust principles, multi-cloud air-gapped data resilience, and strict jurisdictional compliance.

Encryption at Rest & Transit

All archived attachments are encrypted with AES-256 at rest and TLS 1.3 in transit between Microsoft Graph API, Mailarch processing engines, and sovereign object storage — end-to-end.

Off-Tenant Air-Gapped Resilience

Air-gapped from your primary Microsoft 365 identity boundary in sovereign cloud storage with Retention Policy Lock enabled. Maintaining an off-tenant immutable archive protects against single-vendor ransomware or tenant compromise. SEC Rule 17a-4 & CFTC WORM compliant.

Tenant Data Isolation

Each customer's data is stored in logically isolated storage paths with per-tenant encryption keys. Cross-tenant data access is architecturally impossible — not just policy-guarded.

Microsoft Entra ID SSO

Attachment download links authenticate users via Microsoft Entra ID (Azure AD) single sign-on. No separate passwords or account creation. If a user leaves the organization and their Entra account is disabled, download access is immediately revoked.

Bring Your Own Storage (BYOS)

For Enterprise customers & strict Microsoft environments, Mailarch supports Bring Your Own Storage (BYOS). Provision an Azure Blob container in your own Azure subscription, keeping 100% of archived files inside your Azure tenant while drawing down Microsoft Azure commitments (MACC).

Audit Trail & Logging

Every attachment extraction, download, and modification is logged with message ID, timestamp, user identity, file hash, and storage URI. Full audit trail available for compliance reviews, legal discovery, or internal security audits.

Microsoft Graph API Permissions

We practice strict principle of least privilege. Here is every permission mailarch requests and why it is required.

Permission Scope	Mode	Why We Request It
User.Read.All	Read-Only & Full	Enumerates user accounts in your Microsoft 365 directory to discover active mailboxes and calculate potential storage savings.
Reports.Read.All	Read-Only & Full	Reads tenant-wide Exchange Online 7-day mailbox usage reports (storage bytes, item counts, quota limits) in 1 bulk API request.
Mail.ReadWrite	Active Offloading Only	Required only when active offloading is enabled. Reads email attachments to move them to sovereign Cloud Storage and updates message bodies with lightweight HTML stubs.
openid, profile, email	Standard Identity	Standard OpenID Connect authentication scopes to verify tenant admin identity and enable single sign-on (SSO).
offline_access	Background Sync	Allows background synchronization and offloading jobs to execute securely without requiring manual admin re-login every hour.

Compliance & Data Sovereignty

Meeting the strict requirements your legal and InfoSec teams care about.

GDPR, UK & US Data Sovereignty

Mailarch complies fully with EU General Data Protection Regulation (GDPR), UK Data Protection Act 2018, and US Privacy Frameworks (including HIPAA Security Rule and State Privacy Acts). Cross-border data transfers adhere to European Commission adequacy decisions and standard data protection clauses.

Standard Data Processing Agreements (DPA), Business Associate Agreements (BAA for healthcare), and EU Standard Contractual Clauses (SCCs) are included with all business subscriptions, with custom sub-processor schedules for Enterprise contracts.

Customer data is never transferred outside your designated compliance boundary. Storage buckets are locked to region-isolated encryption keys with automated audit logging to satisfy 100% of InfoSec governance requirements.

Strict Data Residency

Select your preferred sovereign data residency region to satisfy 95%+ of InfoSec audits out of the box:

✓ Belgium (EU) europe-west1 — EU GDPR (Recommended)

✓ London, UK europe-west2 — UK GDPR Jurisdiction

✓ Frankfurt (DE) europe-west3 — German / EU GDPR

✓ Iowa, US us-central1 — US Sovereignty (Recommended)

✓ S. Carolina, US us-east1 — US East Coast

✓ Taiwan (APAC) asia-east1 — APAC Data Residency