Gmail in the internal pilot

Information supplement prepared on 9 October 2026. It describes the pilot's technical scope and the requirements to complete before admitting customer accounts.

What the connection authorises

Google requests basic identity —openid, email address and profile— to identify the connected account. The gmail.readonly permission allows access to messages and settings across the whole mailbox. Our test filters limit Lead Relay's requests; they do not narrow the permission granted by Google.

Replying requires gmail.send, requested separately for the sending pilot. Saving a draft in Lead Relay does not send an email. Internal rehearsals enable bounded, reviewed and authorised operations; connecting an account does not by itself enable continuous reception or sending.

What data passes through Lead Relay

The server may read message and thread identifiers, dates, labels, senders and recipients, subjects, headers needed to maintain threading and the bodies of messages included in the rehearsal. Content and context are stored in the internal Supabase workspace to display conversations, coordinate ownership and retain follow-up. Render runs the application and its transport to Google. Messages retain their original language.

OAuth credentials are stored encrypted and separately from text visible to operators. This does not mean all workspace data uses the same encryption or guarantee an unverified geographic location. Reading a MIME part needed to recover a message body does not provide general attachment downloads.

Who can access messages

The application checks the workspace and member permissions before showing conversations or performing actions. The pilot includes a team authorisation control: a workspace owner or administrator must review the specific account and confirm that they own the mailbox or are authorised to permit this use. The checkbox starts unchecked; signing in or connecting Google does not replace this confirmation.

Authorisation is tied to that workspace, mailbox, connection, Google permissions and notice version. Changing the account, connection or permissions requires reviewing and authorising the corresponding access again. The record identifies who accepted, when, the language and notice version; withdrawal is also recorded. This record contains neither email bodies nor Google tokens.

The agreement does not grant new Google permissions, enable sync or authorise sending. Each member remains subject to their role and assignments. Assigning a conversation does not remove these controls. Pilot notice version: gmail-team-access-2026-10-09.1. This is internal preparation; it does not open connections to businesses or establish Google approval.

Disconnecting and retention

Withdrawing team authorisation in Lead Relay blocks protected operational access to Gmail history and stops the corresponding sync job. It does not delete messages or itself revoke Google permissions. Disconnecting the provider does not automatically withdraw the team agreement either: stored history may remain visible while its authorisation remains valid. You can review and withdraw previous agreements even when the connection needs review.

The workspace owner may retain records in an administrative export or backup. Operators do not have that access. Withdrawal does not automatically delete those records or copies or retroactively cancel an operation that has already started.

Removing access in the Google Account prevents use of that authorisation once the provider makes revocation effective. It does not by itself delete copies already stored in Lead Relay. To request a review, export or deletion, contact contact@azprojs.net. Before opening customer accounts, retention periods for content, credentials, records and backups must be set and verified. Automatic or immediate deletion is not promised without verified execution.

Before connecting a business

Outstanding requirements include applicable Google access verification, the security assessment and its applicable cost, full controller information, the provider and safeguards inventory, retention periods and review of the team access notice throughout business onboarding. Meanwhile, the public demo uses fictional data and does not require a mailbox connection.

Processing must be limited to disclosed and authorised features. Connected email must not be used for advertising, selling data or undisclosed purposes. This page describes the pilot; it does not declare a completed compliance audit.