Email logs drop sign-in links

A log that keeps the full message is also a list of working sign-in links. Anyone who can open that log, a teammate on the dashboard or whoever can read the database, can open one of those links and sign in as the recipient.

What the stored copy keeps

• Query parameters that look like a token, a code, or a long random value are removed from the stored HTML and plain text.
• A long opaque token in the path is replaced, so a reset link in the log cannot be used.
• Campaign parameters such as utm_source stay, and so does the rest of the message.
• The message the recipient receives still has the original link.

Seven days, then the metadata

The body stays for 7 days after the message is sent. That is the window for reading what went out when someone asks why a message looked wrong. After 7 days the body is deleted. Recipient, subject, status, and bounce reason stay, which is what you need to answer why it did not arrive.

A message that is still scheduled keeps its body until it sends, because that stored copy is the one that goes out. Sign-in links are removed as soon as it sends or fails. The 7 days start from that send.

API logs

The Logs page stores the request and the response for each API call. Those copies get the same treatment: sign-in links are removed before they are written, and the request and response text is deleted after 7 days. Method, path, status, and time stay.

Incoming mail is a mailbox, so the subject and the body stay available to the account that owns the address. This retention rule is for the sending log.

Read mail sent to an address you create Block a complaint and pause a high bounce rate