Selective email access vs full mailbox
Connecting a mailbox over OAuth gives a tool every message in it; forwarding or routing mail to a processor gives it only the messages you choose. Unless you need old mail or need to act inside the mailbox, selective processing is the smaller risk.
By Xander Groesbeek, founder · Published September 2025 · Updated October 2026 · 5 min read
In brief
The issue. Most email automation tools ask to connect your mailbox with OAuth. That grants access to every message in it, past and future, until someone revokes the token.
What it means for you. A tool that needs ten invoices a week can read your contracts, HR mail and customer data, and a leaked token exposes all of it. Selective processing limits both the vendor's view and the damage of a breach to the mail you chose to send.
What to do.
- List which emails each workflow actually needs.
- Forward or route only those to a processor, instead of connecting the mailbox.
- Keep OAuth for tools that genuinely need history or must act in the mailbox.
Two ways to automate email
You either connect the tool to the mailbox, or you send the tool the mail. With OAuth mailbox access (for example Gmail connected to Zapier), the tool reads from your mailbox through the provider's API. With selective processing, you forward specific mail, or route a dedicated address or subdomain, to a processor that turns each message into data for your application.
What each approach can see and do
The difference is scope: OAuth works on the whole mailbox, selective processing on single messages.
| Aspect | OAuth mailbox access | Selective processing |
|---|---|---|
| Access scope | The mailbox, as far as the granted scopes reach | Only mail sent or forwarded to the processor |
| Old mail | Available from the moment you connect | None |
| Who decides what is processed | The scope you grant, usually all or nothing | You, per rule or per address |
| Business and personal mail | Mixed in the same mailbox | Separated by what you forward |
| Ongoing connection | A token that keeps working until revoked | None to the mailbox |
The difference shows when something goes wrong
A compromised OAuth token exposes the whole mailbox; a compromised processor exposes only what it received. The same logic decides how hard a compliance review is.
| Situation | OAuth mailbox access | Selective processing |
|---|---|---|
| Privileged mail (legal advice, HR) | Within reach of the tool, though the workflow never needs it | Never leaves your mailbox |
| Health data (a special category under GDPR Article 9) | Readable by the tool if it is anywhere in the mailbox | Only reaches the processor if you send it |
| Processing outside the EU | All customer mail in the mailbox is exposed to the tool's jurisdiction | Limited to the forwarded mail, and avoidable with an EU processor |
| Breach at the vendor | Potentially the whole mailbox history; a wide incident to scope and report | The specific messages processed; a narrower, clearer incident |
| Record of processing | Hard to state why a tool may read everything | These addresses, these messages, this purpose |
How the two flows work
OAuth is a lasting connection that the tool queries; selective processing is a message pushed once.
OAuth mailbox access
- You grant the tool OAuth scopes on your mailbox.
- The tool receives an access token and a refresh token.
- It queries the mailbox through the provider's API.
- It processes whatever its queries return.
- Access continues until the token is revoked.
Selective processing
- You set up a forwarding rule, or point a subdomain's MX records at the processor.
- Matching mail is delivered to the processor.
- The processor parses each message and posts it to your webhook.
- There is no connection to your mailbox.
Setup and failure modes
Selective processing has fewer moving parts; OAuth adds a token to manage and an API to stay within.
| OAuth mailbox access | Selective processing | |
|---|---|---|
| Setup | Consent screen, scope choices, often admin approval | A forwarding rule or DNS records |
| What breaks | Token expiry or revocation, scope changes, API rate limits | Mail delivery, or your webhook endpoint |
When to choose each approach
Choose OAuth only when the workflow needs the mailbox itself; otherwise choose selective processing.
| OAuth mailbox access fits when | Selective processing fits when |
|---|---|
| You need to process mail that has already arrived | You only need new mail of a known kind |
| The tool must send as you, or label, move or archive mail | Your application only needs the message as data |
| The mailbox holds only mail the tool may see | The mailbox mixes this workflow with other business or personal mail |
| You can manage tokens and review scopes regularly | A security or privacy team has to approve the tool |
In short
Start with selective processing: send the tool only the mail a workflow needs. Widen access later if a real requirement, such as processing old mail, justifies it.
How EmailConnect fits
EmailConnect is a selective processor. Each item links to the page behind it.
- No mailbox access. You send or forward mail to addresses we run; we never hold a password or OAuth token for your mailbox. Security and privacy →
- Forward, or route a domain. Forward mail to an EmailConnect address, or point your own domain or subdomain at us so senders write to it directly. Domain setup →
- Email content exists only as long as you choose: one hour on Free and Maker, 24 hours by default on Business and Platform, deletable through the API on Business and above. Data retention →
- Processed in the EU. At Hetzner in Germany, with optional attachment storage at Scaleway in Paris and an encrypted backup copy in Amsterdam; no US company in the processing chain, apart from optional sign-in with Google or GitHub. Sub-processors →
- Signed, retried deliveries. Every webhook can be signed (HMAC-SHA256); failed deliveries are retried up to 7 times over about 22 hours, within your retention window. Delivery and retries →
Set up your first address: getting started →
Related
Choosing an email automation architecture for your security requirements? Write to hello@emailconnect.eu.