📨 Mail

Read and reply to your work email without switching tabs. Inbox reading is available through Outlook (Yahoo + custom IMAP next). Gmail connects send-only — compose in Synalux and deliver from your Gmail address without granting access to mailbox contents. Connect once via OAuth for folder support, spam filtering, and audited reads on read-capable providers.

Live at synalux.ai/mail.

✉️ Unified Inbox Across Providers

One inbox view that combines mail from every connected provider. Click a thread to read inline; reply without leaving the page.

• Connect once — OAuth handshake via the generic Connect-Integration pattern; no per-provider page changes.
• Folder support — inbox, spam, all, plus Outlook provider folders.
• Thread view — full RFC 2822 threading; collapses replies; expands quoted history on demand.
• Search — server-side search across subject, from, body (workspace-scoped, RLS-enforced).

📤 Send + Reply In-Place

• Compose — rich-text + plain-text modes; auto-saves drafts every 3 seconds.
• Reply / Reply-All — threads on the original Message-ID, preserves provider-side conversation grouping.
• Attachments — uploaded via the Drive module; storage_path validated against allowlist (no path traversal).
• Body sanitization — body_html is HTML-escaped on render to close stored XSS via crafted incoming mail.

🛡️ Spam Blocker Module

Built-in spam classification with per-workspace block lists.

• Per-workspace block list — admins block sender/domain; immediate effect across the workspace.
• Provider-side spam folder is still respected (the read-capable provider's classifier wins on its own folders).
• Phishing heuristics — flags links pointing to recently-registered domains, mismatched SPF/DKIM, lookalike-domain tactics.

🔌 Connect-Integration Pattern

Adding a new mail provider (e.g. Outlook) is ~30 LOC because all providers go through a generic OAuth + message-provider abstraction.

• Connect cards are auto-rendered from a provider declaration — no per-provider UI page.
• Token storage: OAuth tokens AES-256-GCM encrypted at rest; per-workspace isolation enforced.
• Token refresh is centralized; expiry detected and rotated transparently.
• CLI for ops: portal/scripts/fetch-messages.mjs to pull mail outside the web flow (e.g. for bulk import).

🔒 HIPAA + Audit

• Every read writes an oauth_token_access_log row with operation type (list / read / send / delete) so an auditor can reconstruct who accessed what and when.
• Workspace isolation guard — requireWorkspaceMember runs on every endpoint; RLS double-locks at the database layer.
• Credential encryption — provider tokens never stored in plaintext.
• No PHI in URLs — all sensitive identifiers in POST body / signed cookies; logs scrub query strings.

🏗️ Architecture

GET  /api/v1/mail/inbox            List threads (folder=inbox|spam|all)
GET  /api/v1/mail/thread/:id       Full thread with quoted history
POST /api/v1/mail/send             Send / reply (validates attachments)
POST /api/v1/mail/sync             Force-sync from provider (bulk pull)
GET  /api/v1/mail/ai-inbox         Rules-based priority categorization (no LLM)
GET  /api/v1/mail/suggest-replies  AI-generated reply suggestions
GET  /api/v1/mail/settings         Per-user mail preferences

💳 Plans

See full pricing →

🧰 Setup Guide

A built-in modal walks the admin through:

1. Click Connect Gmail (send-only) or Connect Outlook on the /chat or /mail page.
2. Approve the provider consent screen. Gmail requests gmail.send (no read, search, archive, label, or delete access) plus contacts.readonly for recipient autocomplete. Outlook requests the permissions needed for its unified inbox.
3. With Outlook, folder sync starts in the background.
4. Outlook mail appears in the unified inbox; Gmail-connected users compose and send from Synalux with their Gmail address.

For Outlook / Yahoo / custom IMAP support, watch the Roadmap or contact sales.