# Permissions, export and privacy

Mail Log stores potentially sensitive communication data. This page sums up who may do what, what is exported and which data is stored at all.

## Permissions

You assign the permissions as with every Joomla component under *Options → Permissions* per user group. Mail Log deliberately separates viewing from reading the content:

<table class="table" id="bkmrk-permissionallows-vie"> <thead> <tr><th scope="col">Permission</th><th scope="col">Allows</th></tr> </thead> <tbody> <tr><td>**View Mail Log**</td><td>Open the dashboard and the list — the metadata, but not necessarily the message texts.</td></tr> <tr><td>**View mail content**</td><td>Read the full bodies (HTML, text, MIME). Granted separately because bodies can contain sensitive data.</td></tr> <tr><td>**Download attachments and .eml**</td><td>Download attached files and the raw message.</td></tr> <tr><td>**Resend mails**</td><td>Deliver logged mails again.</td></tr> <tr><td>**Delete entries**</td><td>Remove log entries.</td></tr> <tr><td>**Manage demo data**</td><td>Create and delete test entries.</td></tr> </tbody></table>

<div class="callout info" id="bkmrk-every-action-checks-">Every action checks its permission server-side — it is not just the interface hiding buttons. So an action cannot be forced through a direct call either. An editor with "view Mail Log" but without "view mail content" sees the list but no texts.

</div>Recommendation: grant *view mail content* and *download attachments and .eml*sparingly — ideally only to the people who actually investigate delivery problems.

## Export

The button *Export CSV* in the list outputs the currently filtered selection as a CSV file. The export contains ID, time, status, sender, recipient, subject, source, context and the error message — but **not** the message text. Whoever needs bodies opens the entry or downloads the .eml file (with the corresponding permissions).

<div class="callout info" id="bkmrk-free-text-fields-are">Free-text fields are prepared in the CSV so that spreadsheet programs do not interpret them as a formula by accident. The export can therefore be opened safely in Excel or LibreOffice.

</div>## Which data is stored

Per mail, Mail Log stores sender and recipients, subject, time and status, the context as well as — where available — the IP address and the user ID of whoever triggered it. How much of the text is kept is up to you through the storage mode; out of the box that is a short excerpt only, and sensitive mails are stored with metadata only.

## Privacy notes for operation

- **Limit retention.** Set an entry retention (default 180 days) and set up the cleanup task, so that old data does not lie around indefinitely.
- **Store frugally.** For most purposes the default "metadata + excerpt" is enough. Full or raw storage only if you really need it.
- **Encrypt if you keep full bodies.** Encrypted storage keeps the key outside the database.
- **Keep permissions narrow.** Separate reading the content from merely viewing the list.
- **Access and erasure requests.** For data subject requests, filter the list by the address and export or delete selectively.

All data stays on your server — Mail Log contacts no external services.

<small>Applies to version 1.0.5.</small>

[Deutsche Fassung](https://docs.graup-it.de/link/89)