Email on the client record

Taxporch files every email between your team and a client on that client's record (Clients > client > Emails). Only staff can see it. Clients never do. Portal messages stay separate under Messages.

There are three ways to get email in. You can use any of them, or all three. A message that arrives twice (say by BCC and by Gmail sync) is filed only once.

Way in	Works with	Who sets it up
Forwarding / BCC address	Any email provider	Nothing to install. Every staff member can use it.
Gmail sync	Gmail and Google Workspace	Each staff member connects their own mailbox.
Microsoft 365 sync	Microsoft 365, Outlook.com	Each staff member connects their own mailbox.

Because every team member can connect their own mailbox, every address syncs, not just one shared inbox.

What gets kept, and what doesn't

A message is kept only when its From, To or Cc address matches a contact email of one of your active clients. Everything else (newsletters, personal mail, mail with other businesses) is dropped right away. It is never stored and never logged.
With Gmail and Microsoft 365, Taxporch reads only the addresses first. It downloads the full message only for emails that match a client.
If one email matches two clients (for example spouses with separate client records), it is filed on both.
Subject and text are stored encrypted. Attachments go to the client's firm-only folder Email attachments. They follow the normal file rules: up to 50 MB, allowed file types only, virus-scanned. Small inline signature images are skipped.
Each filed email adds an "email.filed" entry to the audit log, so webhooks and automations can react to it.
When you delete a client, their emails and attachments are deleted with them. A full data export includes csv/emails.csv. The email text is included only when the owner chooses to include sensitive data.
Staff who can see only some clients see only those clients' emails.

1. Forwarding / BCC address

Go to Settings > Integrations > Email sync. Your firm's private address looks like yourfirm-3f9a1c2b7d@in.taxporch.com. Use the Copy button.

BCC the address when you email a client. Tip: save it as a contact named "Taxporch".
Or set up an automatic forwarding rule in your mailbox, so incoming mail is forwarded to the address. Gmail: Settings > Forwarding. Outlook: Rules > Forward to. Taxporch keeps only the client emails.
Forwarding by hand (clicking "Forward") doesn't work well, because the email then comes from you, not from the client. Use BCC or an automatic rule instead.

Keep the address private: anyone who knows it can send email into your client records. If the sender's domain fails SPF/DMARC checks, the email is marked Sender not verified. An owner or admin can Create a new address at any time. The old address stops working immediately.

2. Gmail / Google Workspace

Click Connect Gmail and approve read-only access. Taxporch files your client emails from the last 30 days. After that it checks for new mail every 5 minutes. It reads both received and sent mail. Drafts, spam and trash are skipped.

Access is read-only. Taxporch never sends, deletes or changes anything in your mailbox.
To stop syncing, click Disconnect. This revokes Taxporch's access at Google. Emails already filed stay on the client records. You can also remove access at myaccount.google.com > Security > Third-party connections.
If you change your Google password, or an admin removes access, the status becomes Needs attention. Click Reconnect.
Until Google finishes its review, you may see a "Google hasn't verified this app" screen, and Google allows at most 100 users. Reading mail is a restricted scope, so Google requires app verification and a yearly CASA security assessment before the screen disappears. Google Workspace admins can allow Taxporch for their domain under Admin console > Security > API controls.

3. Microsoft 365 / Outlook

Click Connect Microsoft 365 and sign in. Taxporch asks for Mail.Read (read-only), User.Read and offline_access. It syncs your Inbox and Sent Items. The first sync covers the last 30 days. After that it checks every 5 minutes.

Some organisations require an admin to approve new apps. If you see "Need admin approval", ask your Microsoft 365 admin to grant consent (Entra admin center > Enterprise applications).
Until Microsoft finishes publisher verification, the consent screen shows "unverified". This doesn't change what Taxporch can access.
Disconnect deletes Taxporch's tokens. To also remove the app from your account, go to myapps.microsoft.com (work accounts) or account.live.com/consent/Manage (personal accounts).
Mail in other folders (for example mail moved by rules into subfolders) is not synced yet. The forwarding address covers those cases.

Troubleshooting

An email didn't show up. Check that the client's contact has that exact email address under Clients > client > Overview. Only active clients are matched.
It shows up twice. It shouldn't: duplicates are detected by Message-ID. Tell support if you see this.
"Show quoted text": earlier replies quoted below an email are hidden by default. Click the link to see the full text.

For the operator (not shown to customers)

Environment (see .env.example, block "Email sync"): TP_INBOUND_MAIL_DOMAIN, TP_INBOUND_MAIL_TOKEN, TP_INBOUND_MAIL_SIGNING_KEY, TP_INBOUND_MAIL_MAX_MB, TP_GMAIL_CLIENT_ID/SECRET, TP_GMAIL_SCOPE (readonly or metadata), TP_MS_CLIENT_ID/SECRET, TP_MS_TENANT, TP_MAILSYNC_BACKFILL_DAYS. When a provider's variables are missing, that option shows "not yet available" and its routes return 404.

Forward Email (in.taxporch.com). Use a paid plan. On the free plan the webhook URL, which contains the secret token, sits in a public TXT record, and only paid plans have a webhook signing key.

In Forward Email, add the domain in.taxporch.com.
DNS for the host in: add MX mx1.forwardemail.net and MX mx2.forwardemail.net, both priority 0, and no other MX. Also add the TXT forward-email-site-verification=<code> that Forward Email shows.
Create a catch-all alias * whose recipient is the webhook URL https://<app host>/webhooks/inbound-mail/<TP_INBOUND_MAIL_TOKEN>?attachments=false. attachments=false keeps the JSON small: Taxporch parses the attachments from the raw message. The free-plan equivalent would be TXT forward-email=https://<app host>/webhooks/inbound-mail/<token>?attachments=false (whole domain), but don't use it.
Copy My Account > Domains > in.taxporch.com > Settings > Webhook Signature Payload Verification Key into TP_INBOUND_MAIL_SIGNING_KEY. Taxporch then checks X-Webhook-Signature, the hex HMAC-SHA256 of the raw body.

Unknown or revoked recipients get HTTP 200 {"status":"rejected"} and nothing is stored. The 200 is deliberate, because Forward Email retries non-200 answers for days. A bad signature gets 401, a bad token 404, and an oversized body 413.

Google. Google Cloud project > OAuth consent screen (External, app name Taxporch, privacy and terms URLs) > add the scope gmail.readonly > create a "Web application" OAuth client with redirect URI https://<app host>/app/settings/email-sync/callback/gmail. Enable the Gmail API. Submit for verification. Restricted scope means a CASA Tier 2 assessment through an authorised assessor, renewed yearly. Until then, at most 100 users see the unverified screen. TP_GMAIL_SCOPE=metadata switches to gmail.metadata: addresses and subject only, no body. This is a sensitive scope rather than a restricted one, so no CASA assessment.

Microsoft. Entra admin center > App registrations > New. Supported accounts: "Accounts in any organizational directory and personal Microsoft accounts". Redirect URI (Web) https://<app host>/app/settings/email-sync/callback/microsoft. API permissions (delegated): Mail.Read, User.Read, offline_access, openid, email. Create a client secret and put it in TP_MS_CLIENT_SECRET. Note its expiry date. Complete publisher verification: link a verified Microsoft Partner Network ID in Branding & properties.