Why white-label webmail is usually the wrong shape, and what this one is
Most white-label webmail is a hosting product: mailboxes on somebody's server with your logo on the login page. That solves branding and nothing else. The clients an agency or an MSP actually manages already have mail somewhere, usually Google Workspace or Microsoft 365, and the problems are operational: who holds the passwords, what junior staff can see, what leaves the company by forward, what happens to deleted mail, and who can prove any of it later.
This door is built around those problems. It can host mailboxes on the platform's own servers, and it can put a client's existing Gmail and Microsoft 365 behind the same administration, so staff work the mail without ever holding the provider credential. Either way the client sees one thing: their own address, their own brand, their own rules.
What the client sees
| Surface | What it is |
|---|---|
| Sign-in | Their brand, their address, 'keep me signed in on this device', optional or required two-factor, one-time codes for sign-up if they allow it |
| Mail client | Threads, whole-mailbox search, labels, snooze, scheduled sending, templates, signatures, attachments and inline images, filters, vacation reply, several mailboxes behind one sign-in when granted; a phone layout on phones |
| Privacy | Correspondents shown by name or as 'Contact at company.com' when the workspace hides addresses; contacts the administrator hands out appear when staff start typing a name |
| Files | A drive per person with allowances, sharing inside the company, and outside sharing that waits for the administrator; Google Drive per account when the administrator allows it |
| Console (administrators only) | People, joining rules, privacy, forwarding, deleted mail, files, activity: see below |
What the administrator controls
- People: create and retire mailboxes, issue app passwords shown once, rotate them, suspend, sign out everywhere, make or remove administrators.
- Connected accounts: connect a Google or Microsoft account once, hand staff the address and an app password, never the provider password; the link is re-checked four times a day and never dropped on a temporary failure; only the administrator disconnects.
- Joining rules: nobody, named domains, or any work email; approval per person; personal Gmail and Outlook allowed or not; throwaway addresses refused always; a security check on every sign-in and sign-up with a review queue.
- Privacy: hide every address from staff; show or hide the company behind it; unhide named contacts for everyone or for named people; give outside contacts a display name and picture; reveal on the record, rate limited.
- Forwarding: hold every forward, or only forwards outside the company, until an administrator approves and sends it exactly as written, or declines with a reason the person reads.
- Deleted mail: a copy of whatever staff throw away, kept outside every mailbox, graded (ordinary, copied, outside the company, hidden recipient, contact exposure), listed per person and readable with the body, live Trash readable without changing a flag, and removable only by the administrator. Staff see nothing of it.
- Activity: sign-ins, password issues, changes, reveals, reviews and removals, as sentences, with the address they came from.
Where it fits for an MSP
Clients who left shared hosting webmail but do not want the full Google or Microsoft experience for every seat; clients who need a compliance layer over mail they already have; clients whose staff churn and whose passwords therefore cannot be shared; and the agency's own outbound team, where the same door runs the campaign side. Billing is per client through the built-in invoicing, with card and bank payment and receipts.
Under the hood
| Area | How it is done |
|---|---|
| Hosted mail | Dovecot and Postfix on the platform's servers, per-mailbox quota, IMAP and SMTP with the app password, push updates to the client, Sieve filters compiled from the person's rules |
| Connected Google and Microsoft | OAuth with refresh tokens sealed at rest; IMAP and SMTP with XOAUTH2; provider security mail held for the administrator so a reset link never reaches staff |
| Sessions | Random tokens stored hashed; HttpOnly, Secure, SameSite cookies; CSRF token on every change; 12 hours or 30 days with 'keep me signed in'; every device listed with sign-out |
| Authentication | scrypt password hashing, TOTP second factor, rate limits on every sign-in path |
| Isolation | Every query scoped to the workspace; a door administrator reaches only their own domains; the doors carry a full-disallow robots file and a brand guard |
| Backups | Nightly, encrypted, database plus mail store plus files; the administrators' deleted-mail store is excluded so a purge is final |
Questions, answered straight
- Is this hosted email, or a front for Gmail and Microsoft 365?
- Both, per mailbox. A client can have mailboxes hosted on the platform's own mail servers, or keep Gmail and Microsoft 365 accounts and have their staff work them through the door under the administrator's control. Most clients mix the two.
- How is a client's door set up?
- Add the client's domain, prove it with a CNAME or an A record, upload their logo and colours. The certificate is issued and renewed for you. The sign-in, the mail client and the console take the brand at once, and a guard checks every deployment that nothing on the door mentions us.
- What does the client's administrator control?
- People and passwords, who may sign up, two-factor policy, connected Google and Microsoft accounts, address masking and per-contact exceptions, names and pictures for outside contacts, forward approval, the review of deleted mail, storage allowances, Google Drive access, and an activity log in plain sentences.
- Can staff read client Gmail without knowing the Gmail password?
- Yes. The administrator connects the Google account once by signing in as it; the platform keeps a refresh token that does not expire on its own. Staff sign in with the address and an app password the administrator issued, and can be given several mailboxes to switch between. Only the administrator can disconnect.
- Is there an IMAP or mobile app?
- The door is a responsive web client with a phone layout, and hosted mailboxes are reachable over IMAP and SMTP with the same address and app password where the administrator allows it. Connected Gmail and Microsoft accounts are read through the door only, which is what keeps the provider password out of staff hands.
- What about data protection?
- Passwords hashed with scrypt, session tokens stored hashed, two-factor per person or per workspace, every administrator action in the audit log with its origin address, correspondent addresses masked by policy with audited reveals, and copies of deleted mail kept owner-only on disk and removable only by the administrator. A CASA security assessment for Google's restricted scopes is in progress.
Published 19 September 2026. Updated 19 September 2026. Written by the team that runs the infrastructure; numbers come from the platform's own provisioning and sending, and from the providers' published documentation at the time of writing.