Looking for technical information about ZAP (Zero hour auto purge)

Hi everyone, I'm looking for technical information about how ZAP is "screening" users mailbox for malicious email that came in undetected. I have read multiple article about it but can't find how it is "screenning" users mailbox. I'm trying to compare the "scanning at rest" feature of third party vendors vs ZAP. I know that ZAP isnt scanning at rest on demand but it has to scan mail in users mailbox for updated signatures?