Frequently asked questions

Short answers to the questions customers ask most often about SecureThread. Most answers link to the guide that has the steps. If your question is not here, Support explains how to ask.

About SecureThread#

What is SecureThread?#

SecureThread sends professional email from the mailboxes your organization connects. It checks each message before it goes out, holds sends that need a person's approval, and keeps a record of what was sent and when. AI assistants can prepare email through it, within the rules in Agents and approvals.

Which mailboxes can I connect?#

You can connect a Google Workspace or Microsoft 365 mailbox through that provider's own sign-in page, a mailbox on your organization's domain signed in over TLS, or a consumer mailbox, which usually needs an app password. An administrator can also connect transactional email services and approve SMTP servers for your team. Choose Connect on the card for your provider. If a provider cannot be connected yet, its card says so and shows what is missing. Quick start, section 5, lists the options.

Does SecureThread see my mailbox password?#

Not when you sign in with Google or Microsoft. You sign in on the provider's own page, and SecureThread never sees your password. For a mailbox that needs an app password, create one in the account's security settings and enter it in SecureThread. Never send a password or an app password to support.

Getting started#

How do I create a workspace?#

Choose Create a workspace on the sign-in page, then enter your organization name, your name and your work email address. A personal address, such as one at gmail.com or outlook.com, cannot create a workspace. SecureThread emails you a verification link. It works once and expires after 24 hours. Quick start, section 1, has the steps.

Why does my workspace say it is waiting for approval?#

SecureThread reviews every new workspace before anyone can sign in. Until the review is finished, signing in with the right password shows "Your workspace is waiting for approval." SecureThread emails you when the workspace is ready.

What is the sandbox?#

A new workspace starts in a sandbox. While it is on, mail goes only to people in your workspace and to recipients on your verified domains. The workspace can send at most 50 messages and 100 recipients in any rolling 24 hours, and campaigns are not available. Starting a paid plan for the first time lifts the sandbox, and SecureThread can also lift it. See Quick start, section 7.

How do I invite my team?#

An administrator invites people under Administration › Users. If sign-up is closed for your SecureThread installation, the sign-in page offers Ask for an invitation instead. Ask an administrator of an existing organization to invite you.

What can my role do?#

Steps that need the Administrator role say so in the guides. If a step says your role cannot do it, ask an administrator. Your role also decides whether you can approve requests and use AI assistants.

Does SecureThread have a free trial?#

Some plans include a free trial, and its length is shown on the plan under Administration › Billing. Billing and plans explains trials, offers, limits, payment and invoices. Prices are shown in the app.

Sending domains#

Why must I verify a sending domain?#

Receiving mail servers check DNS records to decide whether to trust mail from your domain. New workspaces require a verified sending domain, and mail from a domain that is not verified is refused until its records check out. Sending domains and DNS explains each record.

Which records do I publish?#

SecureThread runs four checks: ownership, SPF, DKIM and DMARC. The domain card shows each record and the value to publish. An administrator who manages domains adds the records at your DNS host, then chooses Check now. A domain counts as verified when all four checks pass.

How long does verification take?#

New records usually show within minutes, but some DNS hosts take up to 48 hours. SecureThread checks a new domain every hour for seven days, and a verified domain every 12 hours. Choose Check now after you publish the records to check straight away.

What happens if a verified domain starts failing?#

Its status changes to Failing checks. Mail can still be sent from it for 72 hours after the first failed check, and the card shows the date that period ends. After that, mail from the domain is refused until the records check out again. A check that passes makes the domain verified again.

Can I send from a Gmail or Outlook address?#

Personal mail domains such as gmail.com and outlook.com belong to their providers, and your organization cannot verify them. A personal mailbox sends from its provider's domain. Mail from your organization should go through a mailbox on a domain you have verified.

How many sending domains can a workspace have?#

A workspace can have at most 25 sending domains. Your plan can set a lower limit, and an add-on can raise your plan’s limit, up to that 25. Billing and plans explains plan limits and add-ons.

Approvals#

Which actions wait for approval?#

Scheduled sends, campaigns, workflow runs, and sends and retries held for an administrator wait for an approval. The held sends are those from an account whose sends need an administrator's approval. Approvals appear under Messages › Approvals. Email that an AI assistant prepares follows its own rules, described in Agents and approvals.

Who can approve a request?#

People with the approval permission can approve, reject or void a request. Administrators hold the permission by default. Employees do not, unless an administrator gives it to a role. By default, nobody can approve their own work. An administrator can allow it under Administration › Sending policy, with the switch People may approve their own work, which is off by default.

How long does an approval wait?#

By default, an approval expires after 72 hours. An administrator can change the period under Approval requests expire after in Administration › Sending policy, up to 720 hours. An expired approval cannot be approved. An administrator can also require up to three approvals for each request.

Can I withdraw or cancel an approval?#

You can withdraw a request that is still waiting, and a withdrawn request does not go ahead. The requester, or anyone with the approval permission, can void a waiting approval. Voiding cancels the scheduled send, campaign, workflow run or queued send that it holds, and a voided approval can never be approved. A message that a mailbox provider has already accepted cannot be recalled.

What happens if an item changes while it waits for approval?#

Each approval is tied to one version of its item. If the item changes, the pending request is cancelled, and a decision made against an older version is refused. Make the request again if the action still needs to go ahead.

AI assistants and agents#

What is an AI assistant connection?#

SecureThread runs a Model Context Protocol (MCP) server. It lets Claude, ChatGPT, Cursor, VS Code and Claude Code look things up in SecureThread and prepare email. The assistant acts as one signed-in employee, and only within that person's permissions at the moment it acts. AI assistants (MCP) has the steps for each app.

Is AI access turned on?#

Not by default. AI assistant access is off for every organization until an administrator turns it on under Administration › AI access. While it is off, no assistant can connect or act.

Can an assistant send email without my approval?#

Not by default. Every email an assistant prepares waits for a person's approval, and only the person whose assistant asked can approve it. An administrator can let some low-risk emails go out without approval. The settings are under Sending without approval on Administration › AI access, and the switch Allow automatic sending is off by default. A scheduled send or workflow run that an assistant starts always waits for a person.

What can an assistant not do?#

No assistant can approve or reject anything, publish a shared template, invite people, change roles or change organization settings. Those actions stay in the app.

What can an assistant see and do?#

Each connection has access levels, which describe a kind of work: View, Write drafts, Send email, Manage templates, Contacts, Test mailboxes, Scheduled sends, Campaigns, Workflows, Analytics, Approvals and Administration. The consent page ticks the levels the app asks for, and you can untick any of them. The assistant may only do what its levels allow and what you may do at that moment. SecureThread checks both on every request. View, for example, lets it see your mailboxes, the templates you can use, your messages and your send requests.

What am I approving when an assistant asks to send?#

The send request, exactly as it was stored: the recipients, subject, message, attachments and mailbox. Read the preview and the reasons it needs approval, and check any link that hides where it goes. Before the email goes, SecureThread checks the request against every sending rule. If the request no longer matches what the page showed, SecureThread refuses it and asks you to look again. Decline sends nothing.

How long does an assistant stay connected?#

A connection lasts at most 90 days from the day you approved it. Access renews by itself while the connection lasts. After that, reconnect the assistant.

How do I disconnect an assistant?#

Choose Disconnect on AI access. The assistant stops at once, and the send requests it left waiting are declined. Changing your password also ends your personal tokens and connections.

What is an agent?#

An agent is a named identity for an AI assistant. It has an owner, a policy that can only narrow what the organization allows, the assistant connections assigned to it, and a status: Active, Paused or Revoked. A new agent starts with Every send needs approval. The number of agents your plan allows is shown under Agents on your plan. Agents and approvals explains each setting.

Can I stop an agent quickly?#

Yes. Pause agent stops it at once, and resuming it lets it act again. Revoke agent is permanent: the agent's credentials are revoked, and it can never act again. Pausing, resuming and revoking each ask for a short reason.

What is a personal access token?#

A personal access token lets a client that cannot sign in through a browser act as you. Use one only for a client on your own computer, because anyone who has the token acts as you. Tokens last 7, 30 or 90 days. SecureThread shows each token once, and Revoke on AI access ends it at once. Never put a token in a web address. AI assistants (MCP) explains how to create one.

Data and privacy#

Where are the legal documents?#

The terms, the acceptable use policy, the data processing agreement, the privacy policy and the list of sub-processors are at /legal. The privacy policy is at /legal/privacy. The trust page is at /trust. Each legal page shows its version. Until counsel has reviewed a document, its page carries the notice "DRAFT, pending legal review".

How do I make a privacy request?#

Open the privacy request form at /privacy/request. You can ask for a copy of your personal data, a correction, deletion, an objection to how your data is used or a grievance, or you can ask a privacy question. SecureThread emails a confirmation link to the address you give, and nothing happens until you open that link and confirm it. A request that is not confirmed is deleted after 7 days. After you confirm, SecureThread emails you an acknowledgement with a reference, and emails you again when the request is closed.

What happens to a request about email an organization sent me?#

When a request concerns email that an organization sent you through SecureThread, staff can pass it to that organization. Its administrators then get the request by email. SecureThread tells you that the request was passed on, without naming the organization.

Does a support request include the content of my email?#

No. SecureThread attaches the page you were on (the path only, without any query string), your browser and your time zone. Do not add the content of your email to a request unless support asks for it.

Does SecureThread keep a record of what was sent?#

Yes. SecureThread keeps a record of what was sent and when, and administrators can search the audit log.

Status and support#

Where is the status page?#

The public status page is at https://status.securethread.co. It needs no sign-in. It shows whether the web app, the API, sending, the MCP server for AI assistants and new sign-ups are working now, with 90 days of history and recent incidents. Status explains each state.

Does the status page promise an uptime?#

No. The page reports recorded checks and current incidents. It does not state a service level, a response time or a percentage that SecureThread has committed to.

How do I get emails about incidents?#

Choose Subscribe to updates on the status page and enter your email address. Open the confirmation link, then choose Confirm on the page it opens. After that, you get an email whenever an incident is posted or updated. Every update email has a link that unsubscribes you in one step.

How do I contact support?#

Open Help and support from the account menu and choose New request. Choose a topic, then enter a subject of 3 to 160 characters and details of 10 to 10,000 characters. Your requests appear under Help and support, with a reference, a status and the replies from support. If your SecureThread has a support inbox, Help and support shows its address as well. Support has the details.

How quickly will support reply?#

When a response target applies, Help and support shows it above your requests. Until a target is set, SecureThread does not promise a particular response time.

How do I report a security problem?#

Open Help and support, choose Something is broken, and say in the subject that it is a security report. Do not send passwords, personal access tokens, mailbox passwords or app passwords in a report. Support has the details.

Where do I look up an error message?#

Troubleshooting lists the refusal codes, the sign-in messages, the mailbox connection messages and the AI assistant connection messages, each with what to do about it.

Billing#

How do I change or cancel my plan?#

Administrators with the billing permission change plans under Administration › Billing. An upgrade applies at once, and a downgrade applies when the current paid period ends. Cancel plan ends the plan at the end of the paid period. Billing and plans covers add-ons, invoices, GST and payment.

How do I pay?#

Payment runs through Razorpay. Choose a plan and choose Continue to payment. A plan changes when Razorpay confirms the payment, not when the checkout window closes. Invoices carry the billing profile you enter under Administration › Billing.