> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-data-security/grace-periods.md).

# Grace Periods

Grace Periods are used with Data Protection to determine how much time passes before sensitive messages are redacted and protected behind a verification prompt, both initially and after an unlock.

### About Grace Periods <a href="#h-about-grace-periods" id="h-about-grace-periods"></a>

Grace Periods include two settings: the **Locking Grace Period** and **Retrieval Grace Period**.

The Locking Grace Period determines the length of time that will pass before sensitive messages are first redacted. This grace period may be the same length of time for all messages or customized to have different wait times for Inbox, Unread and Sent messages.

The Retrieval Grace Period determines how long a locked message remains unlocked after it is unlocked due to a user verified retrieval.

You can customize these settings at the global, tenant or group level.

### Best Practices <a href="#h-best-practices" id="h-best-practices"></a>

While you are deploying Data Protection to reduce the risk of sensitive data loss, some users may see an additional verification step as an inconvenience.

Taking this into account, we recommend starting with a Locking Grace Period of six months across all messages and a Retrieval Grace Period of one day.

In our experience, companies have found higher user adoption and less resistance when starting with stricter grace periods and reducing based on feedback versus companies who increase strictness over time. We recommend reviewing your grace period policy periodically to ensure it correctly reflects your organization’s risk tolerance.

### Considerations <a href="#h-considerations" id="h-considerations"></a>

The ideal grace periods for your company may differ. Below is a list of questions we recommend our customers consider when making a decision:

* Do you have a homogenous and convenient user verification mechanism deployed across the organization? If yes, this will make it easier to deploy Data Protection with stricter grace periods.
* Do some business groups have unique retrieval needs related to sensitive content such as processing email on set schedules (e.g. sales quarterly review, accounts payable, etc.)? If yes, you may want to configure separate, more relaxed grace periods for these teams. This is recommended over reducing security protection for all users.

### Configuration <a href="#h-configuration" id="h-configuration"></a>

Grace Periods settings can be set by navigating to Settings > Data Protection > Grace Periods.

Grace Period settings can also be configured at the group level as needed for different business units. These adjusted settings will override the global and tenant settings for all members of the group(s).

#### Retrieval Grace Period <a href="#h-retrieval-grace-period" id="h-retrieval-grace-period"></a>

To set the Retrieval Grace Period, select a time interval from the drop down options. The minimum Retrieval Grace Period allowed is 1 hour.

#### Locking Grace Period <a href="#h-locking-grace-period" id="h-locking-grace-period"></a>

The Locking Grace Period may be the same length of time for all messages or different depending on whether the message is in the Inbox, Unread, or recently Sent.

To set a single wait period for all messages, select **Enabled** and select a time interval from the drop down options.

If you wish to set different wait periods for Inbox messages, Unread messages and Sent messages, select **Advanced**. Messages will lock after they are older than the time specified in the All Messages grace period. This time can be extended for Inbox, Unread or Sent messages.

**Note:** The extension of grace periods will only apply if the respective grace period is set to be longer than what is set for All Messages. For a detailed explanation, review **Advanced Grace Periods Examples** below.

If the Locking Grace Period is **Disabled**, new sensitive messages will be redacted immediately in a user's mailbox.

### Advanced Grace Periods Examples <a href="#h-advanced-grace-periods-examples" id="h-advanced-grace-periods-examples"></a>

#### Example: All Messages Grace Period = 5 months <a href="#h-example-all-messages-grace-period-5-months" id="h-example-all-messages-grace-period-5-months"></a>

| Grace Period       | Setting  | Result                                       | Explanation                                                                                                                                 |
| ------------------ | -------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Inbox Messages     | 6 months | Inbox messages will lock after 6 months.     | The **Inbox** grace period applies because the Inbox grace period (6 months) is greater than the All Messages grace period (5 months).      |
| Unread messages    | 3 months | Unread messages lock after 5 months.         | The **All Messages** grace period applies because the Unread grace period (3 months) is less than the All Messages grace period (5 months). |
| Sent messages      | 9 months | Sent messages will lock after 9 months.      | The **Sent** grace period applies because the Sent grace period 9 months) is greater than the All Messages grace period (5 months).         |
| All other messages | 5 months | All other messages will lock after 5 months. | The **All Messages** grace period (5 months) applies.                                                                                       |

#### Example: All Messages Grace Period = 1 year <a href="#h-example-all-messages-grace-period-1-year" id="h-example-all-messages-grace-period-1-year"></a>

| Grace Period       | Setting  | Result                                     | Explanation                                                                                                                               |
| ------------------ | -------- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Inbox messages     | 6 months | Inbox messages lock after 1 year.          | The **All Messages** grace period applies because the Inbox grace period (6 months) is less than the All Messages grace period (1 year).  |
| Unread messages    | 3 months | Unread messages lock after 1 year.         | The **All Messages** grace period applies because the Unread grace period (3 months) is less than the All Messages grace period (1 year). |
| Sent messages      | 9 months | Sent messages will lock after 1 year.      | The **All Messages** grace period applies because the Sent grace period (9 months) is less than the All Messages grace period (1 year).   |
| All other messages | 1 year   | All other messages will lock after 1 year. | The **All Messages** grace period (1 year) applies.                                                                                       |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/email-data-security/grace-periods.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.