# How do I keep sensitive data out of MailBlastr?

> What MailBlastr retains in the email log, and how to avoid putting secrets you do not want stored into subjects and bodies.

MailBlastr keeps a per-email log so you can see delivery status, debug failures, and correlate webhook events. That means the content you put into an email is **retained for a time** as part of that record. Treat anything you send as data MailBlastr stores, and keep secrets you do not want logged out of it.

## What is retained

For each email you send, the log typically retains:

- The **envelope**: `from`, `to`, `cc`/`bcc`, and `reply-to` addresses.
- The **subject** line.
- The message **body** (HTML and/or text) and any custom headers you set.
- Delivery **events**: sent, delivered, bounce, complaint, open, and click.

## How to avoid storing secrets

- **Do not put raw secrets in the subject or body.** Passwords, full API keys, card numbers, and similar values should never be the literal content of an email.
- **Send a link, not the secret.** For password resets, magic links, or one-time access, send a short-lived, single-use URL that resolves to the sensitive value on your own system instead of embedding the value itself.
- **Minimize personal data.** Only include the recipient details the message genuinely needs.
- **Keep internal identifiers out of the subject.** Subjects are the most visible part of the log; put correlation IDs in custom headers or your own metadata rather than the subject line.

> **Warning:** Anything placed in a subject or body may be retained in the email log and visible in the dashboard. If you would not want it stored, do not send it as email content.

## Turning off message-content storage

For accounts with stricter compliance needs, MailBlastr can **turn off storage of message content** — subjects and bodies are not retained in the log, while delivery metadata and events still are. This is offered to established, good-standing senders rather than brand-new accounts, since it relies on a healthy sending history.

If your account has a steady sending history and a low bounce rate and you need content storage disabled, **contact support** to have it enabled.