Communications Hub

Email, SMS, WhatsApp, the unified inbox, and AI auto-response.

14 questions

How does Muin send email out of the box?

By default, Muin sends donor receipts, payment alerts, and broadcast campaigns from `<your-tenant-slug>@falaah.ai` over Muin's managed AWS SES infrastructure. No DNS setup is required — every tenant has a working sender from day one. Add your team's Reply-To address at **Settings** → **Communications** → **Channels** so donor replies route to a real inbox you watch.

Can I send from my own domain instead?

Yes. Run the optional 6-step branded sender wizard at **Settings** → **Communications** → **Set up branded sender**. It generates DKIM and MAIL FROM records; you add them at your DNS host; SES verifies (typically <15 min). After setup, receipts come from `support@your-domain.org` and replies route into the Muin comms hub. Every wizard step has a built-in **Get help →** link if a record won't verify.

What's the difference between the From address and Reply-To?

The From address is who the email looks like it's from. Reply-To is where replies go when a recipient hits Reply. With Muin's default sender, From is `<your-tenant-slug>@falaah.ai` and Reply-To is your team's inbox — donors see Muin's address but their replies land where you can see them. With a BYO branded sender, From and Reply-To both live on your own domain and replies route into the Muin comms hub.

My donor isn't receiving receipts. What should I check?

1. Confirm their address isn't on your tenant's suppression list at **Settings** → **Communications** → **Suppression**. 2. Check the audit log at **Admin** → **Communications** → **Audit** for the sent-email row — bounces and complaints will show the SES diagnostic. 3. If you're still stuck, click **My donor isn't receiving emails →** on the email channel card to open a tagged support ticket. Our ops team works the `email-deliverability` runbook within 1 business day.

Can I see emails my donors send to my regular inbox?

Yes — the unified inbox is built for that. Connect your Microsoft 365, Google Workspace, or personal Gmail mailbox at **Settings** → **Profile** → **Connected accounts** (rolling out for beta tenants). After connect, your inbox appears alongside Muin-routed conversations in the comms hub.

Is my email content stored anywhere?

Email metadata and audit-log entries (sender, recipient, subject, message-id) are stored 90 days for operational diagnostics. Email body content is stored as part of conversation/document data in your tenant's database and follows your tenant's retention policy. Privacy controls: PII addresses are masked in operational logs (`mask_email`), and the platform never logs full message bodies.

Can I connect my Outlook account to Muin?

Yes — both Microsoft 365 (work) and Outlook.com (personal) accounts connect via the Microsoft 365 OAuth flow. Go to **Settings** → **Communications** → **Connected mailboxes** and choose **Microsoft 365**. If your IT admin hasn't granted Muin tenant-wide consent yet, you'll see an admin-approval gate the first time — share the [Microsoft 365 connection guide](/docs/platform/communications/connect-microsoft-365) with them. After admin consent, every teammate can connect without warnings.

Can I connect my Gmail to Muin?

Yes. The flow depends on which kind of Gmail you have. For **Google Workspace** (work Gmail at your organization's custom domain): your Workspace admin trusts Muin once at the org level, then each teammate connects via OAuth — Muin syncs the labels you select. For **personal `@gmail.com`**: Muin uses a privacy-first forwarding bridge — we never read your inbox, you set up a Gmail filter that forwards just the messages you want into Muin. See the [Workspace guide](/docs/platform/communications/connect-google-workspace) and the [personal Gmail guide](/docs/platform/communications/connect-personal-gmail).

What can Muin see when I connect my mailbox?

Microsoft 365 + Google Workspace: messages in the folders/labels you select (default: Inbox), plus your name and email. We never request access to calendar, contacts, files, Teams chats, Drive, or any other service — mailbox-only. For personal Gmail: **no inbox-read access**. We only request `gmail.send` so we can send a reply when you accept an AI suggestion or compose in Muin. The mail Muin sees comes from a Gmail filter you set up, which you can change or delete any time from your Gmail settings.

Can my colleagues see my mailbox messages?

No. Mailbox connections are per-user — each person connects their own account, and tokens are stored against that user only. Muin never copies one user's mail into another user's view. Your tenant admin can open an admin-only Connected Mailboxes overview, but it shows connection metadata (who connected, when, last sync) — not message content. Messages from your connected mailbox stay yours.

What happens when I disconnect my mailbox?

Tokens are cleared immediately when you click **Disconnect** at **Settings** → **Communications** → **Connected mailboxes**. Sync stops on the next tick. Messages that were already synced into your comms hub remain by default — you can choose to delete them in the disconnect dialog if you'd like. For personal Gmail: we can't delete your Gmail filter for you (we never had access to it) — go to Gmail's **Filters and Blocked Addresses** to remove it manually if you no longer want forwarding.

Is the OAuth process secure?

Yes. We use OAuth 2.0 with PKCE (Proof Key for Code Exchange) for both Microsoft and Google flows — that prevents authorization-code interception even on a hostile network. State tokens are single-use, bound to your session, and expire after 5 minutes. Refresh tokens are encrypted at rest with our platform KMS. We never see your password — Microsoft and Google handle the sign-in directly. You can revoke Muin's access at any time from your provider's account-security settings.

Why does Google Workspace require admin trust?

Google Workspace lets organization admins decide which third-party apps can access their employees' Gmail. Until your Workspace admin trusts Muin once at the org level, every member of your team would see "unverified app" warnings during the OAuth flow. Trust is a one-time, ≤5-minute setup at admin.google.com — see the [Workspace admin guide](/docs/platform/communications/google-workspace-admin-setup). After trust, your whole team connects without warnings, and the admin can revoke trust any time to remove all Muin connections from your org at once.

Why doesn't personal Gmail show my inbox in Muin?

For privacy. Personal Gmail accounts often hold deeply personal mail you wouldn't want a third-party tool reading — bank statements, medical records, family conversations. Instead of asking for inbox-read access, Muin asks only for `gmail.send` (so you can send replies via Muin) and uses a **forwarding bridge**: you set up a Gmail filter that forwards just the messages you want into a Muin ingestion address. You stay in control of which mail flows; everything else stays in your inbox where Muin can't see it. If you actually want full inbox sync (e.g. for a work account), use the Workspace flow with your IT admin's approval instead.