Graf Email Archive
Journal-mailbox email archiving for compliance & e-discovery
Every message from your journal mailboxes, stored as the original .eml on
your own server, hash-verified and searchable in seconds — by compliance and legal
teams in the admin console, and by each employee for their own mail through a portal
where they sign in with their company Active Directory account. It runs on-premises, so mail data never leaves the company. In
production at an industrial holding group in Türkiye with around 1,000 mailboxes.
From journal mailbox to searchable archive
Your mail platform delivers a copy of every message to a journal mailbox. Graf Email Archive collects from there and keeps two things apart: the original message as evidence, and a search index built from it.
| Step | What happens |
|---|---|
| 1 · Collect | Connects to journal mailboxes over POP3 or IMAP — Microsoft 365 included, with OAuth2 (XOAUTH2) — and unwraps Exchange journal envelopes. |
| 2 · Filter | Drop rules keep automated noise, such as monitoring alerts and cron mail, out of the archive. |
| 3 · Store & verify | The original raw .eml is written to disk, content-addressed by its SHA-256 hash, and deduplicated by the same hash. |
| 4 · Remove from server | Only after the stored copy's hash has been verified is the message removed from the mail server. |
| 5 · Index & search | Elasticsearch indexes the message, including extracted attachment text, for full-text search and reports. |
Find it, prove it, hand it over
Full-Text Search
Search message bodies and extracted attachment text, filtered by sender, recipient, subject, date range and mailbox.
Reports
Top senders, top recipients, top domains and daily mail volume — an overview of who talks to whom, and how much.
Export & PST
Export results as a zip of .eml files, mbox or CSV. Import historical mail from PST files, and export to PST when needed.
Drop Rules
Keep monitoring alerts, cron output and other automated mail out of the archive, so searches return conversations rather than noise.
Audit Log
Sensitive actions are recorded in an audit log, so access to the archive is itself on the record.
Retention
Elasticsearch index lifecycle management (ILM) controls how long the search index is kept — configurable, for example around seven years. The original .eml files in the raw store are kept separately and are not deleted by ILM.
Two zones, and an API for your intranet
| Entry point | Who uses it | What they can do |
|---|---|---|
| Admin console | Compliance, legal and IT | Archive-wide search, reports and exports; local or Active Directory accounts with roles, and an SMS one-time code as second factor |
| Archive portal | Every employee | Sign in with their company Active Directory account (LDAP, on-premises), protected by a Cloudflare Turnstile check and an SMS one-time code, and search only the mail they sent or received |
| Service API | Your intranet portal | Embed archive search into the company intranet, scoped to the signed-in user |
An archive you can rely on
- The original is the record: the raw
.emlis kept on disk, content-addressed by SHA-256 — the search index is built from it, not the other way round. - Verify before delete: a message leaves the mail server only after its archived copy has been hash-verified.
- Rebuildable index: Elasticsearch can be rebuilt from the raw store at any time with a reindex.
- No duplicates: the same message is stored once, deduplicated by its SHA-256 hash.
- One bad message never blocks the mailbox: a message that cannot be archived is retried and, after a configurable number of attempts, quarantined with its raw copy kept — so it can neither stall collection nor flood the mailbox.
Built for the teams that get the hard questions
Compliance
A complete record of mail sent and received — the original .eml files in the raw store, the search index for the period you configure — with an audit log of sensitive actions. Preparing for an audit? See our ISO 27001 readiness guide.
Legal & E-Discovery
Narrow a request down with filters and attachment text across every archived mailbox, then hand over the result as .eml, mbox, CSV or PST.
IT
Runs on a standard Ubuntu server with systemd and nginx. Employees search their own mail in the portal with their company Active Directory account, and the index can always be rebuilt from the raw store.
On your server, inside your network
- On-premises: installed on the customer's own Ubuntu server, running under systemd behind nginx — mail data never leaves the company.
- Microsoft 365 and Exchange journaling: collects over POP3 or IMAP, with OAuth2 (XOAUTH2) for Microsoft 365 journal mailboxes.
- Data protection by design: keeping mail on your own infrastructure makes it easier to meet GDPR and KVKK obligations.
- In production: archiving around 1,000 mailboxes for an industrial holding group in Türkiye.
Frequently asked questions
Does our email leave the company?
No. Graf Email Archive runs on-premises, on your own Ubuntu server. The raw messages, the search index and the audit log all stay inside your network.
Does it work with Microsoft 365?
Yes. It connects to journal mailboxes over POP3 or IMAP, uses OAuth2 (XOAUTH2) for Microsoft 365, and unwraps Exchange journal envelopes.
Can employees search their own mail?
Yes. Employees sign in to the archive portal with their company Active Directory account (LDAP, on-premises), protected by a Cloudflare Turnstile check and an SMS one-time code as second factor, and each person can only search mail they sent or received. The service API applies the same per-user scoping when archive search is embedded in your intranet.
Can we bring in mail from before the archive existed?
Yes. Historical mail can be imported from PST files; archived mail can be exported as PST, a zip of .eml files, mbox or CSV.
What happens if the search index is lost, or a message cannot be processed?
The index is rebuilt from the raw .eml store with a reindex. A message that fails is retried and, after a configurable number of attempts, quarantined with its raw copy kept, so it never blocks the mailbox.
Put your mail on the record
Tell us how many mailboxes you run and where your mail lives — Microsoft 365 or Exchange — and we'll walk you through how the archive would run on your own server.
Book a demo