Microsoft 365 sync
Your mailboxes flow into the archive through Microsoft Graph. You decide on the connection and which mailboxes are archived.
Product
MailFabrika
Email archiving, compliance and business intelligence on your own infrastructure
Runs on your own server · data stays with you
What it does
It streams your mailboxes through Microsoft Graph into an encrypted archive, verifies every record against a manifest, and proves nothing was tampered with through a hash-chained audit log. Search is full-text, personal data is masked, and descending to a single message requires a stated reason. Retention schedules, erasure requests and legal hold live inside the product. It installs on your own server with Docker and you manage TLS: no mail content, metrics or personal data reach us — our side is limited to licence verification and version checks.
What is in it
Encrypted archive and manifest
The archive is stored encrypted and every record is verified against a manifest. Restore-from-backup is rehearsed by the product's own drill tool.
Tamper detection
The audit log is hash-chained and anchored externally. If a record is altered afterwards the chain says so; no change goes unnoticed.
Reasoned search
Full-text search returns results with personal data masked. Descending to a single message and removing the mask are separate permissions: a reason is recorded and written to the audit chain.
Retention, erasure, legal hold
Retention schedules and the handling of expired records live inside the product. Erasure requests are worked step by step; records under litigation or review are held and never deleted.
Offline evidence package
A signed package is produced from the audit log. The recipient opens it with the viewer embedded in the package, installing nothing.
Business intelligence from the mailbox
Response times and unanswered correspondence, team load and after-hours work, customers going quiet and relationships tied to one person, a personal-data inventory and unusual outbound sends.
Data sovereignty
It installs on your own server with Docker and binds to loopback only; TLS termination is your own reverse proxy's job. Only licence verification and version checks reach us.
Who does what
Administrator (admin)
Runs the installation, manages users and roles, the archived mailboxes and the Graph connection behind them. Turns modules on, sets retention rules and legal holds. Can read the archive unmasked, see the audit log and produce evidence packages.
Auditor (auditor)
Places and lifts legal holds, can read the archive unmasked, sees insights and the audit log, and produces evidence packages. Installation, user management and retention rules are closed to this role.
Analyst (analyst)
Searches the archive and sees insights — personal data stays masked. Cannot remove the mask, and cannot reach the audit log or the administration screens.