# External mail accounts

External IMAP and POP3 credentials are stored in
`external-accounts.sqlite`. Credential values are encrypted with AES-256-GCM;
the per-installation master key is stored separately as
`external-accounts.key` in Bongo's DBF directory. Both files are restricted to
the Bongo service account.

Back up the database and master key together. A database backup without the
matching key cannot decrypt external-account credentials. Do not copy the key
to another installation unless the associated database is moved as well.

The collector verifies TLS certificates and host names by default. Provider
passwords are never included in URLs or log messages. Existing plaintext
credential records from early 0.7 development versions are encrypted
automatically the next time they are read.

Remote deletion policies are `never`, `after_import`, and `after_days`.
Messages are recorded as imported only after the Bongo store accepts them over
NMAP. A failed remote deletion does not cause the message to be delivered
again; the collector retries the deletion during a later poll.