Abstract: The disclosed technology is generally directed to the retention of online files. An indication that a communication from a first user to a second user includes a reference to an online document is received. Responsive to the indication, via a first processor, a first request for metadata associated with the online document is sent. The first request is based on permissions associated with the second user. A signal is communicated to a second processor such that: if the first request is granted the signal includes the metadata, else the signal includes the reference to the first online document. Via the second processor, responsive to determining that the signal does not include the metadata, a second request for the metadata is made such that the second request has elevated permissions relative to the first request. Via the second processor, the online document is caused to be marked for retention.