The moment an email archive matters to anyone besides you, whether a client, a regulator, an editor or a court, someone will ask how you know it has not changed since you received it. Hashes, audit logs and signatures are the standard answers, and mailin's Professional tier builds all three into the ordinary flow of working with an archive. This post explains what each of these integrity features actually does, how they fit together, and where their limits are.
Chain of custody starts with a hash at import
mailin's chain-of-custody model has four verbs: acquire, hash, preserve, verify. The hashing happens on the way in. Every email receives a SHA-256 hash when it is imported, and the source file gets a per-file SHA-256 as well. A SHA-256 hash is a fixed-length fingerprint of the exact bytes. Change a single character in a message and the fingerprint changes completely.
Those hashes are what later verification checks against. If you need to show that the message you are handing over today is byte-for-byte the message you imported months ago, you re-hash and compare, and mailin's hash verification does that comparison for you. The per-file hash also has a practical side effect: it is the identity mailin uses for resumable imports, so re-dropping the same file does not re-hash it.
What an HMAC-chained audit log is
An ordinary log is a list of lines. Anyone with write access can delete one or edit one, and the rest of the file looks the same afterwards. mailin's audit log is HMAC-chained: each entry includes a signature computed over the previous entry, so every line is bound to the one before it. Remove or alter an entry in the middle and every signature after it stops matching.
That is what tamper-evident means in practice. It does not make editing impossible; it makes editing detectable. The distinction matters when you explain the log to someone else. The claim is not that the record cannot be changed, it is that it cannot be changed without leaving a trace.
Offline Mode makes logging non-optional
An audit log you can switch off is only as good as the moment you remembered to switch it on. In mailin the tamper-evident log is enforced in Offline Mode, the forensic mode on the Professional tier, across every action. Imports, searches, coding decisions, exports: while Offline Mode is active, each one lands in the chain, and there is no per-action opt-out.
The name is literal but slightly misleading in one direction. mailin works fully offline in every mode, because it never contacts an email server and collects no telemetry. Offline Mode adds the enforcement layer on top of that baseline; it is not the thing that takes you offline.
Ed25519-signed exports and hash manifests
A hash proves a file is unchanged. A signature proves who produced it. mailin can sign exports with Ed25519 so that a recipient can verify a report or production set has not been altered since it was signed. Forensic reports also carry hash manifests with SHA-256, SHA-1 and MD5, because different recipients still ask for different algorithms.
Put together, the import hash, the audit chain and the export signature cover the three moments where an archive changes hands: when you receive it, while you work on it, and when you pass it on. Each is verifiable on its own, and each points at the other two.
The Custody Verification workflow
Doing all of this consistently is easier with a checklist, and mailin 2.0 ships one. Custody Verification is one of the ten Forensic guided workflows, all of which are modeled on NIST SP 800-86. Like every workflow, it runs step by step, auto-saves, and files a numbered document you can reopen from Documents & History. You attach the exact files and emails each step relied on, and the optional one-tap sign-off records who completed the step and when.
The related Evidence Intake & Review workflow shows the pattern. Its Preserve & Hash step asks for the acquisition method, the hash algorithm and a seal note, so the description of the hash sits in the same numbered document as the hash itself. Notes are append-only, and a mistake is corrected with a reversal document rather than an edit, for the same reason the log is chained.
What these features do not do
A hash proves that bytes are unchanged from the moment they were hashed. It says nothing about whether the original email was genuine, whether the sender was who they claimed to be, or whether the content is true. Questions about origin belong to header and authentication analysis, which reads the SPF, DKIM and DMARC results reported by the receiving mail server and has its own limits.
It is also worth being precise about what the audit chain covers: actions taken inside mailin while Offline Mode is active. What happened to the archive before it reached you is documented by your intake notes and the source file hash, not by the chain.
These features are designed to support common records-integrity and eDiscovery workflows. Admissibility of digital evidence is jurisdiction-specific and depends on factors beyond any single software tool — consult qualified legal counsel for evidentiary use. mailin makes no warranty of fitness for any specific legal or regulatory purpose.
FAQ
Which tier includes the audit log and signed exports?
Professional, at $9.99 per month, $79.99 per year or $249.99 as a one-time lifetime purchase. It includes Offline Mode with the tamper-evident audit log, chain of custody, and Ed25519-signed exports. See pricing for the full comparison.
Does the audit log ever leave my device?
No. mailin has no account and collects no data; the log is stored on-device with the rest of your archive. It leaves only if you export it yourself.
Which hash algorithms does mailin use?
SHA-256 for every email and every source file at import. Forensic report manifests list SHA-256, SHA-1 and MD5 so you can match whatever a recipient asks for.