A source hands you a mailbox export. Before you can report on it you need to know whether it is real, what is in it, who talks to whom, and which lines you can quote. Every cloud tool that offers to help also creates a copy of the material somewhere you do not control, and a record of your interest in it. This post walks through how mailin lets you do the whole job on your own Mac, offline, using its Journalist and Researcher workflows.
Why analyzing leaked emails offline is the point
mailin has no account, no cloud and no telemetry. It contains no code for connecting to a mail server, and the developer collects nothing: the App Store privacy label reads "The developer does not collect any data from this app." The only things that can use the network are App Store purchase verification and an optional Cloud AI mode that is off by default, uses your own API key, and sends only excerpts you explicitly choose. Leave it off and the material never leaves the machine.
For a sensitive archive you can also turn on encrypted storage (AES-256) and a biometric lock with Touch ID or Face ID. When the story is published and the material should no longer exist on your laptop, data can be cleared from Settings and is permanently deleted from the device. The privacy post covers all of this in detail.
Getting the mailbox in
Leaks arrive in whatever format the source had: an .mbox from Gmail Takeout or Thunderbird, a .pst from Outlook, an .nsf from Lotus Notes, or a folder of .eml files. mailin has native parsers for all of them. One limit up front: ZIP files are not auto-extracted in version 2.0, so unzip first and import the mailbox files inside.
At import, every email is hashed with SHA-256 and the file itself gets a per-file hash. Those hashes are your receipt: if anyone later asks whether what you analyzed is what you received, you have something to compare against. Large archives stream in batches of 200 messages, so a mailbox does not need to fit in memory, and an interrupted import resumes from its last checkpoint.
The workflow, start to finish
mailin 2.0 includes ten guided workflows for the Journalist and Researcher role, modeled on an ICIJ-style sequence of verify, search, cross-reference, annotate, fact-check and publish. Each one runs as a step-by-step job with a roadmap rail showing where you are, auto-saves as you go, and lives afterward as a numbered document you can reopen. The core path through a leak is:
- Tip & Lead Intake: record what arrived, from where, and what you are trying to establish.
- Provenance Check: is this material what it claims to be?
- Story Build: assemble the timeline.
- Entity & Network Map: who is connected to whom.
- Cross-Reference Datasets: test the mailbox against what you already have.
- Quote & Attribution: pin every quote to its email.
- Fact-Check & Verify: the pass before anything goes out.
- Source Protection & Publish: what to redact and what to keep.
A separate Records Request (FOIA) workflow covers the public-records side of the same story, and Data Story Pack is there for assembling the material behind a data-driven piece.
Provenance: reading headers honestly
The Provenance Check leans on the same header analysis IT teams use for phishing. The Received chain shows the route each message took. The Authentication-Results header shows whether SPF, DKIM and DMARC passed, as reported by the server that received the message. mailin reads those reported results; it does not run its own DNS lookups.
Be careful with what this proves. A failed check is not proof of forgery, since forwarding and mailing lists break signatures routinely, and a pass is not proof of authenticity, since a message can be genuine and still be a plant. Treat authentication as one line of evidence among several and write down what it does and does not establish.
Story Build and the entity map
Story Build uses mailin's threading, which stitches conversations together from Message-ID, In-Reply-To and References headers, and its Thread Story feature, which reconstructs a conversation as a cited, chronological timeline. Exports include Markdown, Word and plain text, so the timeline and its citations can travel into a draft in whatever your newsroom uses.
Entity & Network Map draws on named-entity recognition from Apple's NaturalLanguage framework, which runs on every supported device, and on the contact network and relationship graphs in the analytics section. On macOS 26 or iOS 26 with a supported device, Apple Intelligence adds summaries and plain-language questions with answers that cite the exact emails behind them. Every AI output is tagged with the engine that produced it.
A necessary caveat: AI features can produce inaccurate or incomplete results. Entity extraction misreads names, and summaries drop context. Verify every important output against the underlying emails before it goes near a draft.
Quotes, fact-checking and publishing
Quote & Attribution and Fact-Check & Verify are about discipline more than tooling: evidence tagging, annotations and append-only notes let you attach a reason to every claim, and per-email history shows what was done with each message. Search supports boolean operators, wildcards, regex and proximity, so a payment term within five words of a name is a one-line query rather than an afternoon.
Source Protection & Publish is where redaction happens. mailin's on-device PII detection finds email addresses, phone numbers, IP addresses and similar identifiers, and redacted exports remove or mark them. Redaction and Ed25519-signed exports are Professional-tier features, so check the tier comparison before you plan around them. These features are designed to support common records-integrity and eDiscovery workflows. Admissibility of digital evidence is jurisdiction-specific and depends on factors beyond any single software tool — consult qualified legal counsel for evidentiary use.
FAQ
Can I use this on a laptop that is never online?
Yes. mailin works fully offline, and the on-device AI engines need no API key or connection. Only the optional Cloud AI mode, which is off by default, would use the network.
Does the entity graph need Apple Intelligence?
No. Named-entity recognition comes from Apple's NaturalLanguage framework and works on every supported device. Apple Intelligence adds summaries and question answering on macOS 26 and iOS 26 or later.
Can I try it on a real archive before paying?
The free tier handles up to 500 emails with all formats, search, headers and analytics, and includes three AI assistant queries. Larger archives need the Personal tier or above.