Connecting a mailbox directly (Microsoft 365 and Gmail)

What a direct mailbox connection is

Carrier updates, TPA scorecards, vendor invoices, and payment notices already land in your inbox every day. Forwarding each one is the fastest way to start, but it depends on you (or a rule you set up once and then forget) remembering to forward the right message. A direct mailbox connection removes that step: Verinode reads a folder or label you choose, on a strictly read-only basis, and everything in it flows in on its own.

This is not a general inbox scrape. Verinode never asks for permission to send, delete, or change anything in your mailbox, and it never reads more than the scope you set. As an independent data trust, that mail is never sold to carriers, and it is encrypted under a key scoped to you, not shared with any other operator.

Microsoft 365 (Outlook business mail) connects today. Gmail is in limited pilot while Google completes a required security review, explained below.

Where to find it

Open Connect from the sidebar (iq.verinode.ai/connect). The page opens on a row of channel tiles, in this order: Email forwarding, Integrations, Upload, Photo, and Voice. Tap Integrations to reach the tile grid this article covers.

Inside Integrations you'll see:

• A Connect your tools. header, with a line explaining that a direct connection means you stop forwarding and exporting, and you decide exactly what Verinode can read.
• A trust strip, three pills restated at the top of every wizard: Read-only access, You choose what we read, Encrypted at rest.
• A grid of provider tiles: QuickBooks Online, Microsoft 365, Gmail, Microsoft 365 Calendar, Google Calendar, and Verinode Notetaker. This article covers the two mailbox tiles, Microsoft 365 and Gmail. Calendar connections and the notetaker are separate connections with their own scope and their own consent language.

Tiles are not in a fixed order: already-connected tiles sort first, tiles you can connect right now sort next, and "Coming soon" tiles sort last. So the grid re-orders itself as you connect things.

The Microsoft 365 and Gmail tiles

Each mailbox tile shows the provider's logo, its name, a one-line tagline ("Outlook business mail" for Microsoft 365, "Google Workspace mail" for Gmail), and a call to action in the bottom corner:

• Connect → in copper, when the provider is configured and not yet connected.
• Manage → in green, once a connection is live. A green Connected pill also appears in the top corner of the tile.
• Coming soon → in muted gray, when the provider isn't available yet (Gmail during the pilot period, or Microsoft 365 if your environment hasn't enabled it).

Tapping any tile opens that provider's wizard in place of the grid. A ← All integrations link at the top takes you back.

Scoping a folder or label

The wizard opens with a plain statement of what it does: a direct connection reads the folder (Outlook) or label (Gmail) you choose, so carrier, TPA, vendor, and payment mail flows in automatically, with no forwarding rule to keep up. It is strictly read-only. Verinode never sends, deletes, or changes anything in your mailbox.

Below that, a block titled You stay in control of what we read walks through the setup, three steps, before you ever connect:

1. 1Create a folder or label. In Outlook, create a folder (for example "Verinode") for carrier, TPA, and vendor mail. In Gmail, create a label instead (Gmail organizes by label, not folder).
2. 2Route mail into it automatically. In Outlook, set up a rule under Settings → Rules to move or copy those emails into the folder. In Gmail, add a filter under Settings → Filters and blocked addresses to apply the label automatically to those senders.
3. 3Point Verinode at it when you connect. Verinode reads only what carries that folder or label, nothing else in your mailbox.

If you'd rather not set up a rule, you can leave the folder or label field blank when you connect. Verinode then reads across the whole mailbox, but it still only processes mail that has a business attachment or comes from a known carrier, TPA, or vendor, it does not ingest personal mail either way.

The read-only consent step

Once a folder or label name is available to connect, the wizard shows an input field labeled Folder to read (recommended) for Microsoft 365 or Label to read (recommended) for Gmail, pre-filled with the placeholder Verinode. Type the exact name you created in the previous step. The helper text under the field spells out the fallback: leave it blank to read the whole mailbox, filtered to business-relevant mail as described above.

Below the field is a required consent checkbox. Its wording updates live as you type a scope, reading either:

"I understand Verinode will read Outlook mail in my 'Verinode' folder on a read-only basis, encrypted under a key scoped to me and never sold to carriers, and that I can disconnect in one click at any time."

or, if you leave the field blank:

"I understand Verinode will read Outlook mail, scoped to what I choose, on a read-only basis, encrypted under a key scoped to me and never sold to carriers, and that I can disconnect in one click at any time."

(Swap "Outlook" for "Gmail" on the Gmail wizard.) The Connect Microsoft 365 or Connect Gmail button stays disabled until you check that box. This is a real consent gate, not a formality: reading a mailbox is a materially larger grant than forwarding a single message, so Verinode requires an explicit, current acknowledgment before the OAuth exchange completes. If the wording of what Verinode reads changes in a meaningful way later, you may be asked to re-confirm before an existing connection keeps syncing.

Beneath the consent checkbox, a block titled What we ask for, and what we never do restates the guarantee in full: read-only access to your mail, scoped to the folder or label you chose; your mail encrypted under a key scoped to you, unreadable by any other operator or carrier and never sold; no request, ever, for permission to send or modify anything; disconnect in one click at any time, which revokes access immediately. It links out to the full detail, including retention, in the Data Use Policy.

Checking the box and clicking Connect opens a popup to Microsoft's or Google's own sign-in and consent screen, the standard OAuth flow, so the password itself is never seen by Verinode. Approve it there and the popup closes, syncing you back to the Connect page.

The dedicated-mailbox option

The wizard calls this out explicitly as the higher-trust alternative to scoping a folder inside a personal inbox: point Verinode at a mailbox built for the purpose, for example claims@yourcompany.com, instead of your own Outlook or Gmail account. Because the whole mailbox is dedicated to carrier, TPA, and vendor traffic, you don't need a folder rule at all, the entire inbox is fair game and nothing personal is ever mixed in. This is the recommended pattern for firms that route claims correspondence through a shared address already.

Why Gmail is limited pilot while Microsoft 365 connects today

On the Gmail wizard only, a block titled Gmail access is in limited pilot explains the gap directly:

"Google requires an annual third-party security review (CASA) of any app that reads Gmail. Until Verinode completes that review, Gmail connections stay pilot-only. Microsoft 365 has no equivalent review and connects today, and email forwarding brings Gmail in the meantime."

CASA (the Cloud Application Security Assessment) is Google's own certification process for any third-party app requesting a Gmail read scope, and it runs on an annual cycle. Microsoft's equivalent Outlook scope has no comparable third-party gate, which is why Microsoft 365 is live now while Gmail is not.

In practice this means:

• If your firm runs on Microsoft 365 / Outlook, the direct connection is available today (subject to your environment having it configured).
• If your firm runs on Gmail / Google Workspace, the tile reads Coming soon until the pilot opens more broadly. In the meantime, setting up email forwarding gets the same carrier, TPA, and vendor mail into Verinode without waiting on the review.

Once you're connected

A connected tile shows the green Connected pill, and opening it shows Read-only sync is live. next to a Disconnect button. Below that, a line states exactly what's in scope:

• If you set a folder or label: "Reading the '\<name\>' folder in \<your email address\>" (or "label," for Gmail).
• If you left it blank: "Reading business mail across \<your email address\>."

To change the scope, for example to switch from reading the whole mailbox to a specific folder, disconnect and reconnect with the new folder or label name. There's no in-place edit; a reconnect is how the scope changes.

Disconnecting

Clicking Disconnect asks you to confirm: "Disconnect this mailbox? Verinode will stop reading it." Confirming immediately revokes Verinode's access at the provider (Microsoft or Google) and stops the sync from reading anything further. The tile returns to its unconnected state and a confirmation reads "Mailbox disconnected."

Messages you might see after connecting

After the OAuth popup closes, the Connect page can show one of these banners above the tile grid, depending on what happened:

• Connected. "Mailbox connected. Your scoped mail will sync shortly."
• Canceled. "Connection canceled. No access was granted." This appears if you closed the popup or declined at Microsoft's or Google's consent screen.
• Something went wrong. "Something went wrong connecting your mailbox. Please try again."
• Not available yet. "Mailbox connections are not available yet." This shows only if a mailbox connect link is opened in an environment where the provider isn't configured.
• Consent required. "Please confirm you understand what Verinode will read before connecting." This appears if the consent checkbox wasn't acknowledged before the connect attempt.

Related reading

• Connect: get your data flowing
• Setting up email forwarding
• Connecting QuickBooks
• The Your Tools tab
• Adding a tool to your stack
• How Connect and Flow work: the sources model
• Understanding your margin