> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-data-security.md).

# Email Data Security

Data Protection identifies and redacts sensitive content (PII, financial data, legal documents, etc.) archived in user mailboxes. Users can still access messages on-demand in their mailbox after an authentication step.

### About Data Protection <a href="#h-about-data-protection" id="h-about-data-protection"></a>

Data Protection automatically identifies and redacts sensitive messages in mailboxes and allows them to be accessed on-demand, when needed by users after they verify their identity via an authentication step. Time to redact and the type of content protected is flexible and can be specified based on your company’s security policies. Message retrieval is immediate after a user completes a simple verification step (e.g., Okta Verify Request).

All message retrievals are logged and can be reviewed on the Access Requests page in the admin console. A dashboard for Data Protection is also available to show statistics in your environment including number of protected messages, retrieval count and success rate.

Other solutions, like DLP filters, block emails in transit but ignore the thousands of sensitive messages in your users’ mailbox archives. If an attacker (or malicious insider) gains access to an inbox, this at rest sensitive content is at risk of being exfiltrated—forcing an impractical trade-off between the security risk of retention and the productivity hit of deletion.

With Data Protection, you can add a layer of protection to sensitive content while still keeping it accessible when needed. This protection can be enabled wall-to-wall or for a subset of accounts or groups.

### Deployment <a href="#h-deployment" id="h-deployment"></a>

See the [Deployment Guide](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation.md).

### FAQ <a href="#h-faq" id="h-faq"></a>

#### Where does sensitive content go after being redacted? <a href="#h-where-does-sensitive-content-go-after-being-redacted" id="h-where-does-sensitive-content-go-after-being-redacted"></a>

Messages are stored in a storage bucket inside your private, single-tenant Material cloud instance. When a user retrieves a message or if Data Protection is disabled for a user, messages are returned to the mailbox in their original form (including attachments, message metadata, etc.).

#### Can Data Protection be disabled after-the-fact? <a href="#h-can-data-protection-be-disabled-after-the-fact" id="h-can-data-protection-be-disabled-after-the-fact"></a>

Yes, admins can disable Data Protection at any time, which triggers all redacted messages to be restored.

#### What messages are considered sensitive? <a href="#h-what-messages-are-considered-sensitive" id="h-what-messages-are-considered-sensitive"></a>

Material has built-in [Sensitive Content Categories](/learn-more/risk-areas/email-data-security/sensitive-categories.md) that are automatically identified and protected. Admins can enable or disable built-in categories and define their own categories.

#### Can users still search for redacted messages in their email? <a href="#h-can-users-still-search-for-redacted-messages-in-their-email" id="h-can-users-still-search-for-redacted-messages-in-their-email"></a>

Users can search for messages by subject, recipients, date and other message metadata that is preserved post-redaction.

### Additional Resources <a href="#h-additional-resources" id="h-additional-resources"></a>

* [Deployment Guide](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation.md)
* [Sensitive Content Categories](/learn-more/risk-areas/email-data-security/sensitive-categories.md)
* [Grace Periods](/learn-more/risk-areas/email-data-security/grace-periods.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/email-data-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.