You receive an email from a supplier. It includes a new bank account number, a quote and your customer’s delivery address.
Something feels wrong, so you use a security tool to check it.
You want an answer to one question: “Should I trust this email?”
But there is another question worth asking: “What happens to the information I just submitted?”
That question is what data retention is about. In plain English, it means what a service keeps and how long it keeps it.
For a business, that can include information belonging to customers, employees and suppliers. Understanding what happens to it deserves a place alongside checking whether the email itself is suspicious.
What “zero data retention” needs to explain
The phrase sounds straightforward. A service checks your information, then keeps nothing.
Before relying on that description, ask what it covers.
Does it refer to the email body? Attachments? Results? Technical records? Does the same rule apply when you report an incorrect result or contact support?
A useful explanation names the information, describes what happens to it and makes the exceptions easy to find.
For example, the original message and the result of checking that message are different things. A service might discard the processing copy of an email while keeping a record that the check happened.
Likewise, information saved on your phone is different from information stored on a provider’s servers.
These distinctions help you understand the promise you are being asked to trust.
How SO handles routine email analysis
According to SO’s published privacy policy, email content travels to its servers over an encrypted connection, is analysed in memory and is discarded when the verdict returns. Routine processing does not save the content to its database.
Analysis results and essential metadata are retained. User-submitted reports have separate retention rules. The policy also acknowledges that diagnostic logs may capture content while work to remove it continues. Those exceptions mean an absolute “nothing is ever retained” claim would be inaccurate. soemailsecurity.com
For your business, the practical point is to read the complete explanation. A short marketing phrase should help you find that explanation, rather than replace it.
Your five-minute privacy check
Choose one tool your team already uses to handle business information. Open its privacy policy and work through these four questions.
1. What leaves our devices?
Look for a description of the information sent to the service. Is it a full message, selected text, links, files or some combination?
Write down the answer in ordinary language. If you cannot explain it to a colleague, you may need a clearer answer from the provider.
2. What stays after the task is finished?
Search for terms such as “storage,” “retention,” “logs” and “reports.”
Separate the original content from results and account records. “We do not store emails” may leave other questions unanswered.
3. How long is it kept?
Look for a time period or a clear deletion trigger.
Also check what happens when you disconnect an account. Disconnecting access and deleting previously retained information are separate questions worth asking.
4. What changes when we ask for help?
Read the sections about support, feedback and reporting mistakes.
Before submitting a report, check what it includes. A colleague trying to fix a problem should be able to understand what information they are sharing.
Five minutes may not answer everything. It should help you identify the questions that need a follow-up.
Make the answers useful to your team
Keep a short internal note for the tools that handle sensitive business information:
- What information the tool receives.
- What it keeps and for how long.
- What staff should check before submitting a report.
- Where to find the full policy.
Give someone responsibility for updating that note when the provider announces changes.
This makes privacy easier to discuss during everyday work. Your team should know where to look when a supplier email contains information they would not normally share outside the business.
Ask what happens after the result
A security check should help you decide what to do with a suspicious message. Understanding its privacy terms helps you decide what to share with the tool performing that check.
Both questions deserve clear answers.
Read SO’s privacy policy for the full details.
Explore SO Mail at soemailsecurity.com. Available on iOS and Google Play.