Hidden risks of email automation

What “connect your Gmail” can grant

The button asks you to approve OAuth scopes, and the broad ones cover the whole mailbox, not just new mail. Google defines the main Gmail scopes like this:

Microsoft 365 mailboxes follow the same pattern, with separate permissions to read, send and change mail. Once approved, the platform typically holds a refresh token, so access keeps working while you are not using the service, until you or an administrator revoke it. Check the consent screen to see which scopes a tool requests.

The GDPR questions it raises

Full mailbox access is hard to square with data minimisation, and a platform outside the EU adds a transfer you must cover. Your customers' emails are personal data, and you remain the controller.

The stakes are real: infringing the basic principles or the transfer rules can bring fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5)). For the transfer question in detail, see inbound email processing for GDPR compliance.

One token, the whole mailbox

A compromised OAuth token exposes everything its scopes reach, far beyond the workflow it was granted for. Imagine a marketing manager connects the company mailbox to automate lead capture. Two years later the platform is breached. Client negotiations, financial mail and HR conversations are now part of the incident, though none of them had anything to do with leads.

For an attacker, one token with broad scopes provides:

• Insight into your business relationships and negotiations
• A trusted sender: phishing sent from your real address, if the token can send
• Years of internal mail to use for social engineering
• Partner and vendor correspondence

Why security teams push back

Once mail is in a third-party platform, the security team loses sight of where it goes. They will want answers to the same few questions, and often the platform's terms or documentation do not give them.

• Retention: how long are copies of processed mail and task history kept?
• Access: which messages did the platform read, and when?
• Sub-processors: which other companies handle the mail?
• Location: in which countries is it processed?
• Lock-in: how much work is it to move the workflows elsewhere?

Automation without handing over the mailbox

The fix is architectural: process specific email streams instead of granting access to entire mailboxes. Forward the invoices, orders or support requests a workflow needs, or route a dedicated address, to a processor that delivers each message to your application. Everything else stays in your mailbox.

How EmailConnect fits

EmailConnect processes mail you send it, not your mailbox. Each item links to the page behind it.

• No mailbox access. You send or forward mail to addresses we run; we never hold a password or OAuth token for your mailbox. Privacy promise →
• Processed in the EU. At Hetzner in Germany, with optional attachment storage at Scaleway in Paris and an encrypted backup copy in Amsterdam; no US company in the processing chain, apart from optional sign-in with Google or GitHub. Sub-processors →
• Email content exists only as long as you choose: one hour on Free and Maker, 24 hours by default on Business and Platform, deletable through the API on Business and above. Data retention →
• Logged access. No contractors or other companies have access; sign-ins, configuration changes and attachment downloads are logged for 90 days by default. Security and access →
• Gmail without the OAuth grant. Gmail's own forwarding sends mail to your EmailConnect address, and your webhook receives it as JSON; no Google API access involved. Gmail to webhook →

Sources

• Choose Gmail API scopes — Google for Developers
• General Data Protection Regulation (EU) 2016/679 — EUR-Lex

Concerned about your current email automation setup? Write to hello@emailconnect.eu.