Legal
Privacy Policy
How MailThreatZero handles personal data while scanning and relaying inbound email.
Last updated 2026-10-15.
What we process, and why
Inbound messages pass through the MailThreatZero gateway for security analysis before being relayed to the configured destination mail server. To do that, the gateway necessarily processes the content and metadata of inbound messages addressed to your domains — sender and recipient addresses, subject, message body, attachments, and the connecting server's IP address.
- Message bodies
- Yes. Full bodies of delivered messages are retained for 30 days to support review, release and per-message investigation, then removed; the tracking record remains.
- Tracking metadata
- Tracking records — sender, recipient, subject, size, sender IP, per-engine scores and the delivery decision — are retained for 90 days, and longer only while they belong to an open incident or to a message still held in quarantine.
- Quarantined messages
- Quarantined messages stay available for review until they are released or deleted; there is no automatic expiry. Released and deleted items are removed 30 days afterwards.
- Aggregated statistics
- Aggregated daily statistics are retained for 365 days.
- DMARC aggregate reports
- DMARC aggregate reports addressed to a domain's report mailbox are parsed and stored as structured data (sending IP, volume, authentication results, published policy). They describe mail sent as the domain, not mail sent to it, and contain no message bodies. Reports are kept for 120 days and then removed automatically — except where an alert raised from one is still unreviewed, in which case the report is held so the evidence behind an open finding cannot expire out from under it.
- Account data
- Administrator names, email addresses and hashed passwords for console access, retained while the account exists.
Data retention
How long each kind of data is kept, what happens when a domain leaves, and how deletion requests and holds apply. This is the single description used across the site, written from the retention jobs as they run today.
| Data | How long | After you leave | Deletion and holds |
|---|---|---|---|
| Message bodies (delivered mail) | 30 days, for investigation and release. The body is then removed; the tracking record stays. | Ages out on the same schedule, or is removed at once when the domain is deleted from the platform. | Earlier deletion on request. Copies in application backups age out with those backups. |
| Message tracking records | 90 days. Kept longer only while they belong to an open incident or to a message still held in quarantine. | Ages out, or is removed when the domain is deleted. | Earlier deletion on request. |
| Quarantined messages | Held messages stay until they are released or deleted; there is no automatic expiry. Released and deleted items are removed 30 days later. | Removed when the domain is deleted from the platform. | Deleting a held message removes it from quarantine at once; it can no longer be released or delivered. The stored copy is erased by the nightly cleanup once the quarantine retention period (30 days unless changed) has passed. |
| Reports and statistics | DMARC aggregate reports 120 days; daily statistics 365 days; domain reputation history 400 days. | Removed when the domain is deleted. | Earlier deletion on request. |
| Purchased archive | Each message is kept for the retention term in force when it was archived: the term of your archive package (1, 3 or 7 years), a per-domain term agreed with you, or 5 years where neither applies. | Not removed when a domain leaves. Each message is deleted when its own retention date passes. | A message under legal hold, or under WORM protection until its lock date, cannot be deleted early, including on request. Other messages can be deleted on request. |
| Beta application records | Unconfirmed 14 days; declined or withdrawn 90 days; waitlisted reviewed at 180 days; kept while you take part. | Deleted 30 days after your participation ends. | Deleted on request, apart from the minimal record below. |
| Agreement and reward records | Kept with no expiry: which NDA and terms version you accepted and when, and any reward earned. | Kept, because the founding-partner discount has no expiry and needs the record. | Not removed by deleting an application. |
| Backup copies | Application backups: nightly, encrypted, kept daily for 14 days and weekly for 90 days. Off-host VM-level backups follow their own schedule. | Deleted data remains in backups until those copies age out. | Backups are not edited to remove one item; deleted data leaves them as they expire. |
"After you leave" means the domain is removed from the platform. A domain that is only disabled keeps its data on the schedule above. Requests go to the contact form.
Link protection, and what it records
If a customer enables link protection for a domain, web links in mail for that domain are
replaced with links that pass through click.mailthreatzero.com. The link is
checked again at the moment it is clicked, because a link that was harmless when the message
arrived can be turned malicious afterwards — that is the whole point of doing it this way.
This means we learn which links are clicked, and when. What is recorded for each click is the destination hostname, a hash of the full address, the verdict, and the time. Recipient identity is not recorded unless the customer explicitly turns that on for their domain; it is off by default, because some organizations want the security signal and specifically do not want a per-person record of browsing.
Click records are kept for 30 days and then deleted. They are visible to the administrators of the customer's own account and to nobody else's.
Some things are deliberately never rewritten: unsubscribe links, digitally signed or encrypted messages, calendar invitations, and anything that is not a normal web address. Rewriting those breaks something the reader needs.
Roles
For mail processed on behalf of a customer domain, the customer determines the purpose of the processing and we process it to provide the filtering service under that customer's instructions. Data-processing terms are available on request and form part of the customer agreement.
Disclosure to others
We do not sell personal data and do not use message content for advertising or for training any model of our own. Content reaches third parties only in these cases:
- AI analysis, if you enable it. Optional AI analysis uses the provider and credentials selected by the customer, and can be disabled per domain. Data processed by optional integrations is subject to the configuration and terms of the selected provider.
- DNS blocklist operators receive the query inherent in a reputation lookup — the connecting IP address, not message content.
- Attachment reputation, if you enable it, runs on the customer's own VirusTotal account under that provider's terms.
- Your destination mail server, which is where the message is going.
- Legal obligation, if we are lawfully required to disclose.
Our subprocessors are published: who they are, what they process, whether they are required, and which optional integrations are accounts you hold rather than ours.
This website
Separate from mail processing, and stated here because the page that does it is this one:
visits to this website are measured with Matomo, self-hosted by us at
analytics.agit8or.net. That is our own server, not an analytics provider — no third party
receives your visit, and the data is not shared, sold or enriched. It records the ordinary
things a web server sees: which pages were viewed, when, the referring page, and browser and
approximate-location detail derived from your IP address. It also records a short list of
named events: which call-to-action buttons were pressed, whether the self-guided demo was
opened and which scenario you picked, that you started a form, which field a form flagged as
missing, and that our server accepted a contact message (with the topic you chose), a beta
application, or an email confirmation — never what you typed into a form, and never a
reference number or link token. The page address it records is cleaned first: only short
campaign labels (utm_source, utm_medium, utm_campaign,
utm_content, utm_term) and the form outcome are kept, and anything
else in the address is removed before it is sent. It never touches filtered mail.
The customer console at mt0.mailthreatzero.com is measured separately in the
same self-hosted Matomo: which console page was opened, recorded by its path alone. The
query string, where console links carry their one-time tokens, is never sent, and no
events are recorded there.
To switch measurement off in your browser, open any page of this site with
?mtz_test=1 added to the address; ?mtz_test=0 switches it back on.
Automated browsers and copies of this site on other hosts are not measured at all.
Security of processing
SMTP connections to and from the gateway use TLS (STARTTLS) with every server that supports it, which is the standard configuration for a public MX. Administrative access to the console and API is HTTPS only. Administrative access requires an account with a role — platform, tenant or domain administrator. Passwords are hashed, sessions are signed tokens, TOTP two-factor authentication is available on any administrative account, and repeated failed sign-ins lock the account. Sign-ins, quarantine releases from the console and from recipient links, allow-list additions, classifier training decisions and storage-allocation changes are recorded with the user, address and time. Further detail on data handling, retention and access is on the security page.
Your requests
Use the contact form for access, correction or deletion requests, or questions about this policy. Where the request concerns mail processed for a customer domain, we will normally direct it through that customer, who determines how that data is used. Tell us which jurisdiction's rules apply to your request and we will respond on that basis.