Preserve evidence independently
Capture messages at the journal boundary so records survive mailbox deletion, account changes, and ordinary user cleanup.
Vianordis--:--:-- UTCVianordis / ED. 02 / 2026
§ 07 — App support
Aevis
Turn every business email into searchable, protected evidence.
Aevis captures journaled mail outside the live mailbox, encrypts messages and attachments with tenant-derived keys, and gives legal, compliance, and security teams one controlled workflow for discovery, preservation, and evidence export.
01 — Problem
A live mailbox is a communication tool, not a defensible evidence system.
Business decisions, customer commitments, employee actions, and regulated records live in email. When those records remain spread across active accounts, deleted mailboxes, local exports, and backup systems, discovery becomes slow and preservation becomes difficult to prove.
- Mailbox access changes when employees leave, accounts are disabled, or users delete messages.
- Keyword-only searches miss context and force legal or compliance teams into broad manual review.
- Retention rules and legal holds are difficult to coordinate without deleting records that must remain preserved.
- Raw messages, attachments, metadata, and review decisions are split across unrelated tools.
- Organizations struggle to show who accessed evidence, changed a policy, applied a hold, or created an export.
02 — Solution
Aevis separates the evidence record from the operational mailbox.
Aevis receives journal or BCC copies through SMTP, parses MIME content, deduplicates messages by hash, encrypts raw email and attachments in tenant-scoped object storage, and indexes searchable metadata. Legal and compliance workflows then operate on the preserved archive rather than production mailboxes.
- Capture runs continuously through standard SMTP journaling and a reliable queued processing pipeline.
- Investigators combine full-text filters with embedding-based semantic search and AI-assisted message analysis.
- Role-protected case, hold, retention, audit, and export APIs keep evidence workflows inside one tenant boundary.
03 — Benefits
Move from mailbox recovery to controlled evidence operations.
Aevis gives each stakeholder the records and controls they need without turning live mailbox administration into the discovery process.
Find relevant mail faster
Combine full-text search, semantic similarity, metadata filters, facets, and saved searches to narrow large archives.
Make legal holds enforceable
Scope holds by case, custodian, and date, then exclude held messages from retention deletion until the hold is released.
Protect tenant evidence
Encrypt raw messages and attachments with AES-256-GCM using tenant-derived keys before placing them in S3-compatible storage.
Reduce repetitive review
Use classification, sentiment, PII detection, entity extraction, and summaries to give reviewers more context before opening every message.
Keep actions accountable
Record archive requests in tenant audit logs and optionally forward security and compliance events into an existing SIEM workflow.
04 — How it works
From journal copy to preserved evidence in three steps.
- 01
Capture the record
A mail server sends journal or always-BCC copies to the Aevis SMTP service, which resolves the tenant, parses MIME content, and detects duplicates by content hash.
- 02
Protect and enrich
Aevis encrypts messages and attachments into S3-compatible storage, writes metadata to PostgreSQL, indexes OpenSearch, and queues available AI analysis.
- 03
Discover and preserve
Authorized users search the archive, inspect original evidence, organize cases and custodians, apply legal holds, and export approved review sets.
05 — Features
What teams can actually do in Aevis.
Journal and BCC ingestion
Receive standard SMTP journal traffic, parse email headers and MIME bodies, extract attachments, resolve tenant routing, and deduplicate repeated delivery.
Advanced archive search
Search by text or semantic similarity and filter by participants, subject, dates, direction, attachments, classification, sentiment, labels, and legal hold.
Evidence viewer
Open archived content with original headers, raw EML download, attachments, labels, thread context, retention status, and legal-hold indicators.
AI-assisted analysis
Classify messages, score sentiment, detect PII, extract entities, summarize individual emails, and analyze conversation threads through gscAIHub.
eDiscovery casework
Create cases, manage custodians, scope and release legal holds, assemble review sets, and export raw EML evidence as a ZIP package.
Retention and audit controls
Manage role-protected retention policies, query tenant audit history, inspect archive statistics, and emit configured SIEM events.
06 — Architecture
Architecture and evidence model.
Aevis separates capture, processing, storage, discovery, and governance so each part can scale and each evidence operation remains tenant-aware.
- A dedicated Go SMTP service receives journal traffic over TLS and hands accepted messages to the archive service.
- Redis-backed workers use at-least-once queues for message processing, OpenSearch indexing, and AI analysis with retry and crash recovery.
- S3-compatible object storage holds AES-256-GCM encrypted raw messages, attachments, and generated evidence packages under tenant-specific paths.
- PostgreSQL stores message metadata, attachments, imports, cases, custodians, legal holds, review sets, exports, retention policies, and audit events.
- OpenSearch provides tenant-specific full-text, filtered, faceted, and vector search while gscAIHub supplies embeddings and message analysis.
- A Go Fiber API exposes email, search, eDiscovery, retention, audit, AI, statistics, and import routes behind Keycloak JWT validation and role checks.
- Optional MCP and SIEM services connect governed archive operations to authenticated agents and security operations tooling.
07 — Use cases
Where Aevis fits.
Litigation and eDiscovery
Identify custodians, search the preserved archive, apply scoped holds, organize review sets, and produce raw email evidence.
Regulatory review
Demonstrate retention handling, inspect access history, and retrieve the original message and attachment record for a defined period.
Internal investigations
Combine participant, date, classification, PII, sentiment, and semantic filters to locate relevant communications across mailboxes.
Security incident response
Search suspected messages, inspect original headers and attachments, and forward configured archive events to SIEM tooling.
Employee transitions
Retain institutional email evidence independently of active user accounts when employees change roles or leave the organization.
Information governance
Define retention policies, protect exceptions with legal holds, and separate viewer, audit, legal, compliance, and administrator authority.
08 — Integrations
Built around standard mail, identity, storage, search, and security interfaces.
Aevis connects to the infrastructure enterprises already operate without depending on one mailbox vendor's proprietary archive.
SMTP journaling
Connects communication records so messages can be used in the governed workflow.
Postfix
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Keycloak
Keeps access tied to organization accounts, roles, and sign-in policy.
PostgreSQL
Stores structured service records in a controlled tenant-aware backend.
S3 / MinIO / Ceph RGW
Provides the governed place where service data and files are stored.
OpenSearch
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Redis
Shows how this service fits into the wider Vianordis environment instead of standing alone.
gscAIHub
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Wazuh / Splunk / Elastic
Creates reviewable records so important activity can be investigated later.
Prometheus
Shows how this service fits into the wider Vianordis environment instead of standing alone.
MCP
Shows how this service fits into the wider Vianordis environment instead of standing alone.
REST API
Lets approved systems connect without ad hoc exports or manual copy-paste.
09 — Trust
Security, isolation, and auditability.
Aevis is designed to support controlled email-retention and discovery workflows. It does not replace a legal assessment of the retention, privacy, or production obligations that apply to an organization.
Tenant isolation
Validated identity claims resolve to a canonical tenant UUID, and repository, storage, search, case, and audit operations carry that tenant scope.
Encrypted evidence
Raw messages and attachments are encrypted with AES-256-GCM using tenant-derived keys before S3-compatible storage.
Identity and roles
Keycloak JWT authentication and viewer, auditor, legal, compliance, and administrator roles separate routine access from high-risk operations.
Content integrity
SHA-256 content hashes support message and attachment identification and prevent duplicate journal copies from creating duplicate evidence records.
Hold protection
Emails with active legal-hold identifiers are excluded from retention expiry selection and deletion operations.
Audit and monitoring
API activity is logged through audit middleware, high-risk routes expose dedicated metrics, and configured events can be delivered to SIEM systems.
10 — Pricing
Start with published pricing, then map archive volume and evidence workflows.
Aevis is listed at €13 per user per month on the Vianordis rate card. A demo is the fastest way to review journal routing, tenant boundaries, expected mail volume, retention policy, legal roles, AI processing, and export requirements.
11 — FAQ
Questions technical buyers usually ask.
Who is Aevis for?
Aevis is for legal, compliance, security, audit, and IT teams that need an independent, searchable record of business email with controlled preservation and evidence access.
How does email enter the archive?
Mail servers send journal or always-BCC copies to the Aevis SMTP service. Aevis resolves the tenant from trusted recipient-domain data, parses the message, stores the evidence, and queues indexing and analysis.
What can users search?
Users can combine full-text or semantic queries with sender, recipient, subject, date, direction, attachment, classification, sentiment, label, and legal-hold filters. Searches can also be saved.
How is archived content protected?
Raw email and attachments are encrypted with AES-256-GCM using tenant-derived keys before S3-compatible storage. API access requires a validated Keycloak token and tenant-aware authorization.
What happens when a legal hold is active?
Aevis associates matching messages with the hold. Messages carrying active hold identifiers are excluded from retention expiry and deletion selection until the hold is released.
Which export format is implemented today?
The current case export workflow builds a downloadable ZIP containing raw EML files from an approved review set. Additional formats should not be assumed until their production pipeline is implemented.
Is Aevis certified against a specific compliance framework?
No product certification is claimed. Aevis provides technical controls for capture, retention, legal hold, role-based access, audit history, and evidence export; customers remain responsible for validating those controls against their legal obligations.
12 — Next step
Make the email record searchable before the next investigation begins.
See how Aevis can capture journaled mail, protect tenant evidence, accelerate discovery, and keep legal holds, retention, audit, and exports in one controlled archive.