mailSend() - data security / how is it technically implemented?

Question

Hello,

I would like to request specific information on the PHP function mailSend(). I understood that those specified email addresses are stored in the log files (see: https://www.soscisurvey.de/help/doku.php/en:create:functions:mailsend).

For a project, I will be using an external server (not 'soscisurvey.de'). Log files on that server are being deleted 5 weeks after survey participation.

I want to use mailSend() with a unix timestamp, so emails are sent out on day that is about a year later than survey participation.

My questions:
(1) Does this work (given the log files are deleted after 5 weeks, whilst the emails should be sent later than that)?
(2) If yes to (1), how does that work? Where are the email addresses then stored and scheduled to be sent out?

Would you possibly be able to direct me to official information by soSci Survey that I can reference in my informed consent form?

Thanks a lot!
LE

Answer 1

understood that those specified email addresses are stored in the log files

mailSend() will add an entry in the scheduler when a specific email is to be sent to which email address. The access URL is also stored in that entry.

And then, when the email is sent, the mailserver (which could be ours or yours, if you're using SMTP) will store an entry in the logfiles about the communication with the receiving mailserver. That is, whether the email could be sent or not, and when.

Logging is only for clarifying trouble, searching for errors and identify abuse (such as hacking attempts). They are important, but they will usually not be used to drive any activity.

(1) Does this work (given the log files are deleted after 5 weeks, whilst the emails should be sent later than that)?

The entries in the scheduler are kepts until their time has come.

Where are the email addresses then stored and scheduled to be sent out?

The addresses will be stored in the scheduler's database table.

Would you possibly be able to direct me to official information by soSci Survey that I can reference in my informed consent form?

For official documents, that is simply: In the server's database.

I can add a few lines to the mailSend() manual, if that helps. There is no official technical manual that would explain how SoSci Survey works in every detail.

Comments

Thank you so much for the speedy response!

Could you possibly help me out with those further questions:
(1) What is a 'scheduler'
(2) where is the 'scheduler's database table' stored? --> on the 'mailserver'?
(3) Who can access that table?
(4) What do you mean by that: 'the mailserver (which could be ours or yours, if you're using SMTP)'?
(5) Is the 'mailserver' something different than the external server the survey data is stored on?

Thanks a lot!

---

> (1) What is a 'scheduler'

It's a program or script running regularly and taking care to perform tasks at a defined time.

> (2) where is the 'scheduler's database table' stored? --> on the 'mailserver'?

Its the database that stored most things in SoSci Survey. Usually that database is running on the same server like SoSci Survey.

> (3) Who can access that table?

Usually the IT staff.

> (4) What do you mean by that: 'the mailserver (which could be ours or yours, if you're using SMTP)'?

IT shares work. There are different components usually based on hardware and software. The webserver is one such component, the database is another one, and the mailserver is the third one. The latter takes care of sending the email out.

The mailserver may use the same hardware as the SoSci Survey webserver or a different hardware.

> (5) Is the 'mailserver' something different than the external server the survey data is stored on?

Depends on what you mean by "external". But yes, depending on the server and the project configuration, the mailserver may be a different server. Or not.

---

Hi, thanks a lot for your reply!

We use our own server at my research institution. Does this mean that...
(1) *the scheduler*, 'the program or script running regularly and taking care to perform tasks at a defined time' (see your previous response), is running on my research institution's own server? Or does this run on the Sosci Survey's server?
(2) the 'scheduler's database' is also stored on that server of my research institution? Or somewhat centrally on Sosci Survey's regular server?

More specifically, if a research institution uses their own server (and not Sosci Survey's regular server), are all of the components [webserver, database, mailserver] all stored on that own server of my research institution or not?

---

> We use our own server at my research institution.

That means that *everything* runs on your server. We take privacy serious, and that means that your server will not send any data to our server (except its program version when the licence is activated).

ad 1) on your server
ad 2) on your server

> are all of the components [webserver, database, mailserver] all stored on that own server of my research institution or not?

That actually is a question that you need to ask your IT. Your institution may choose to locate their ressources in hosted infrastructure (for example, use a CDN, or install the webserver application on a server hosted externally). The most common case is that they created a virtual machine on institutional hardware, and installed all components there.