Legal exports (subpoenas and lawful requests)
When a court order, subpoena or other lawful request asks for an account's records, the platform operator makes one export file for it. Only the operator can: team admins and API keys of teams cannot.
Making an export
In the admin panel, open the user's tenant, choose Legal export next to the user, and fill in:
- Case or request reference (required), such as the subpoena's number.
- From and To: the period the request covers (all time when left empty). Messages count by when they were received, sign-ins by their time.
- Include: the parts to hand over. Everything except the messages themselves is ticked; tick The messages themselves only when the request covers content. Many requests cover records (who wrote to whom, when, from where) and not content.
- Note: anything worth recording, kept in the audit log.
From the command line:
sudo corpsuite mailbox legal-export amy@acme.com caseReference="Subpoena 2026-117" \
from=2026-01-01 to=2026-10-01 include:='["account","logins","messages"]' > export.zipWhat is in the file
| File | Holds |
|---|---|
README.txt | the case, who made the export and when, the period and parts |
account.json | the account (address, name, role, status, signup address, last sign-in, verification) and its company, and what the abuse checks found at signup |
sign-ins.csv | every sign-in attempt kept: time, service, address, browser or app, result. The platform keeps these for the days set under Sign-in security |
webmail-sessions.csv | open webmail sessions with their address and browser |
aliases.json | the account's aliases and the names of its app passwords (never the passwords) |
messages.csv | every message received in the period: folders, sender, recipients, subject, Message-ID, size, flags |
mbox/*.mbox | the messages themselves, one file per folder, when included |
filters.json, imports.json, spam-reports.json | its filters, imports from other servers, and the spam reports it made |
manifest.json | every file's SHA-256 |
Times are UTC. Mail sent by the account is in its Sent folder. The export covers the mailbox; when the team archives mail, what the user deleted is still in its compliance archive, which the platform can search and place a hold on.
The audit log
Every export is recorded under Legal exports in the admin panel (corpsuite legal-exports): when, which account, the case reference and note, the period and parts, who made it (an administrator's address, the platform API key, or the command line on the server), its size, and the SHA-256 of the whole file. The download also carries the hash in its X-Export-SHA256 header. Give the hash with the file, so anyone can check later that it was not changed. The log is kept even when the account is deleted.
Good to know
- Check that the request is valid and covers this account and period before exporting, and hand over only what it asks for.
- The file holds personal data; store and send it as securely as the request requires, and delete your copy when it is no longer needed.
- Nothing tells the user about the export. If the law requires or allows telling them, do so yourself.