Aeion Inbox + Email Providers
Connect the mailboxes you already run — no migration, no MX-record swap, no "use our domain instead." Generic IMAP/SMTP is wired end-to-end today: Aeion syncs incoming mail and sends outbound through your own server. Gmail (OAuth 2.0) and Microsoft 365 / Outlook (Microsoft Graph OAuth) authorization is live with encrypted refresh-token storage; routing their message sync and send through the native provider APIs is being built on top of the same connected-account model. Credentials are encrypted at rest with AES-256-GCM.
What Connects
`
Generic IMAP + SMTP — Live End-to-End
This is the fully wired path today. It works with any standards-compliant provider: Fastmail, ProtonMail Bridge, on-prem Exchange, Zoho, a custom mail server — anything that speaks IMAP for receiving and SMTP for sending.
Gmail / Google Workspace — OAuth 2.0
Connect a Gmail or Google Workspace mailbox with a standard OAuth 2.0 authorization-code flow. What's live today:
Microsoft 365 / Outlook — Microsoft Graph OAuth
Connect a Microsoft 365 / Outlook mailbox via Microsoft Graph. Works with personal Outlook accounts and Entra ID / Azure AD enterprise tenants. What's live today:
Credential Security
The credentials group on every connected account — IMAP/SMTP passwords, and OAuth access/refresh tokens alike — is encrypted before it ever touches the database by a beforeChange hook, and transparently decrypted on read for the code that needs it.
What This Does NOT Do
Candid boundaries so you can plan around them:
FAQ
No. Inbox connects to your existing account and adds a unified team layer on top. Your address keeps working and you can keep using Gmail/Outlook in parallel.
If you want mail actually flowing into Inbox today, use the generic IMAP + SMTP account type — it's wired end-to-end (Gmail and Outlook both expose IMAP/SMTP if you enable it). Gmail OAuth and Outlook OAuth complete authorization and store credentials today, but their native-API sync/send is still being wired.
IMAP/SMTP passwords and OAuth refresh tokens are encrypted at rest with AES-256-GCM before they hit the database, and secret fields are stripped from API responses. Access tokens are short-lived and rotated automatically. We never surface raw credentials in logs or the admin UI after first save.
`gmail.readonly`, `gmail.send`, `gmail.modify`, and `userinfo.email`. You can revoke access at the Google Workspace admin console at any time.
`Mail.Read`, `Mail.Send`, `Mail.ReadWrite`, `User.Read`, and `offline_access`. Works with personal Outlook and Entra ID / Azure AD enterprise tenants.
The live IMAP path pulls unseen messages on a sync cycle; there's no provider-side push subscription registered for you. Provider-native push is part of the same native-API work that's being wired for Gmail/Outlook.
Yes. Connect any combination of accounts (e.g. support@, sales@, billing@) and route incoming mail into team queues with rules. See the shared-team-inbox use case linked below.
Connect your mailboxes, keep your address.
IMAP/SMTP live end-to-end today; Gmail and Outlook OAuth authorization live with encrypted token storage. All credentials AES-256-GCM at rest.