what lumoise can and cannot do

Google sorts permissions by how much they expose. Reading someone's mail is a restricted permission: granting it obliges the company asking to pass a third-party security audit called CASA, and to pass it again every year. Published indicative pricing was $540 to $1,800 a year, recurring. Sending is merely sensitive, and needs no audit.

Lumoise read inboxes once, to notice when someone replied. Taking that permission away meant rebuilding how replies arrive. The honest reason it is gone is that the cheaper design turned out to be the one that touches less of your mail.

Every email Lumoise sends on your behalf carries a return address that belongs to Lumoise rather than to you. Inside that address is a code unique to that one message, signed so it cannot be guessed or altered. When the person replies, their reply goes to that address, and the code says which conversation it belongs to.

Your mailbox holds what went out under your name. The replies live at Lumoise.

That is the trade: nothing reads your mail, and in exchange the conversation is not sitting in your inbox. You are told the moment a lead shows interest, with the whole exchange in the email.

Google issues Lumoise a token that allows sending on your behalf. It is encrypted with AES-256-GCM before it reaches the database, so the stored value is unreadable without a key kept separately from it. It is never written to a log.

If someone asks to stop hearing from you, that link works. Always, whether or not signups are open. It applies to mail that has already been sent.

Lumoise answers interested leads automatically, within seconds, because answering quickly is most of the value. That is the default.

You can make every reply wait for you instead.

Approval mode holds each draft in a queue until you have read it. Edit it, send it, or delete it.