Email decision record: guide
The Email decision record keeps a sealed record of each decision about an outgoing email: what was proposed, who approved or refused it, and what was sent or held. It checks each email against your rules, sends the emails your rules allow, holds the ones that need a person, and does not send the ones your rules refuse. A person always decides whether a held email is released or refused.
Getting started
- Turn it on. The village owner or a moderator can switch the Email decision record on or off from the switch page.
- Connect a mail account. Microsoft and Google accounts are connected with us on request. Contact support to set one up.
- Set up an agent. Each agent is tied to one mail account. An account with no agent sends nothing. Each agent can have up to two active keys, so a key can be replaced without stopping the agent. Keys expire after 3, 6 or 12 months, and the default is 12.
- Set your rules. Only the owner can adopt a rule set. Adopting one needs at least one approver, and you confirm it with a step-up check. You can preview what the rules would do before you adopt them.
- Add approvers. Only the owner can give someone the approver role. Taking the role away does not reassign that person's pending approvals.
Holding and releasing emails
Held emails wait in the Held queue, which the owner and moderators can see. There is a reminder action for each one. An approver releases or refuses a held email from the link in the hold notice, which opens the approver page for that email. A held email is never sent until an approver releases it.
Incoming mail and sorting
If capture is set up on your account, each message that arrives is recorded as a signed receipt that names the message and its attachments by fingerprint. The signed receipt holds fingerprints, not the words; the message itself is kept encrypted in a separate vault, one key per message, and can be erased. The thread view then shows what you sent, what was decided about it and what came back, as one conversation.
A person who writes to you for the first time appears in Incoming, not yet sorted, where the owner sees a reference for them, when they were first and last seen, how many messages they sent and what the receiving mail system checked, but no address or subject. The owner marks each one as known, approved or blocked. Each choice is signed into the record as its own receipt. Blocking someone, and lifting a block, needs a fresh sign-in. Outgoing mail to a blocked person is refused, including address variants with a plus tag and messages that were already waiting for approval. The record notes each refusal as not handed over, with the reason that the recipient is not permitted.
Reading the record
- Decisions log: every decision, filtered by date, agent, outcome, approver or handover. It is a filter, not a free-text search.
- Receipt: the sealed receipt for one decision. The owner can delete the message content, after a typed confirmation.
- Day records: a record for each day, with a short guide to checking it.
Keeping, exporting and deleting
- How long copies are kept: the owner chooses from 30 days to 7 years for each mail account. The default is 12 months. Emails that were never sent are kept for 90 days, whatever the setting.
- Expiry: where expiry notices are switched on, the owner is emailed a count of expiring copies 30 days before they expire.
- Deleting one person's data: the Retention tab can delete a person's data, found by their address.
- Export: the owner can prepare a dossier on request, after a step-up check. The download link lasts 24 hours and works once. The dossier is a zip file with the records in an open format, a README, and a copy of the verifier, so it can be checked on its own.
- Deleting a message: deleting a message destroys its content key, so the content can no longer be opened. You cannot delete a message while a legal hold on it is open. The receipt stays in place, with its fingerprints.
Disconnecting and leaving
- Disconnecting a mail account stops the service using it and deletes the stored access. It does not remove the permission you gave your provider, and it does not close held emails. To remove that permission, use your provider's own permissions page.
- Leaving is for the owner only. Asking to leave stops all sends straight away and closes every held email as expired. You enter a code sent to your own address. You then export your records. A seven-day cancel window follows before anything is erased, and you can cancel during that window.
- After leaving: the export link lasts 30 days, and you can download it again while it is valid. Receipts and day records are removed 90 days after deletion. An erasure certificate is issued.
Questions
Can a held email be sent without a person?
No. A held email is sent only after an approver releases it.
Who can see my records?
The owner and moderators can see the records. Approvers see the content of the emails they are asked to decide on.
Is the record proof?
It is a record that a person can check. It is not a guarantee, and it is not legal advice.
Where are records kept?
In New Zealand or the European Union. Your order states which applies to you.
Current scope
- Qualified timestamps (from a qualified trust service provider): available on request. Ordinary receipts already carry a time stamp from an outside authority. Your Order Schedule states whether you have the qualified one.
- Removing a mail account's permission at the provider: use the provider's own permissions page.
- Connecting Microsoft or Google accounts: set up with us on request.
- The Outlook and Gmail add-ins: not yet offered.
Help and contact
- Service status: the status page says whether anything is affecting the service, and how to report a problem to support@mysovereignty.digital.
- Security: the security page describes the keys, the receipts, the mailbox permissions and where records are held, and how to report a vulnerability.