Communications Hub

How Muin's Communications Hub unifies email, SMS, and WhatsApp in one inbox with AI auto-responses, so your team answers every message from a single place.

14 questions

How does Muin send email out of the box?

By default, Muin sends donor receipts, payment alerts, and broadcast campaigns from `<your-tenant-slug>@falaah.ai` over Muin's managed AWS SES infrastructure. No DNS setup is required — every tenant has a working sender from day one. Add your team's Reply-To address at **Settings** → **Communications** → **Channels** so donor replies route to a real inbox you watch.

Can I send from my own domain instead?

Yes. Run the optional 6-step branded sender wizard at **Settings** → **Communications** → **Set up branded sender**. It generates DKIM and MAIL FROM records; you add them at your DNS host; SES verifies (typically <15 min). After setup, receipts come from `support@your-domain.org` and replies route into the Muin comms hub. Every wizard step has a built-in **Get help →** link if a record won't verify.

What's the difference between the From address and Reply-To?

The From address is who the email looks like it's from. Reply-To is where replies go when a recipient hits Reply. With Muin's default sender, From is `<your-tenant-slug>@falaah.ai` and Reply-To is your team's inbox — donors see Muin's address but their replies land where you can see them. With a BYO branded sender, From and Reply-To both live on your own domain and replies route into the Muin comms hub.

My donor isn't receiving receipts. What should I check?

1. Confirm their address isn't on your tenant's suppression list at **Settings** → **Communications** → **Suppression**. 2. Check the audit log at **Admin** → **Communications** → **Audit** for the sent-email row — bounces and complaints will show the SES diagnostic. 3. If you're still stuck, click **My donor isn't receiving emails →** on the email channel card to open a tagged support ticket. Our ops team works the `email-deliverability` runbook within 1 business day.

Can I see emails my donors send to my regular inbox?

Not yet. Connecting your own Microsoft 365 or Google Workspace mailbox so its mail flows into the unified inbox is built but **not enabled** — it isn't available to any tenant today. Personal Gmail connect is unavailable too. What works now: donors who reply to mail Muin sent (receipts, campaigns, messages) come back into the comms hub automatically, and you can route an address like `info@` to Muin by pointing your email provider's inbound webhook at it. Ask us if you want that set up. Two limits to know for when mailbox connect does ship: it is **read-only** (Muin won't send from your address), and synced mail is visible to everyone on your team who can open the shared inbox — it isn't private to you.

Is my email content stored anywhere?

Email metadata and audit-log entries (sender, recipient, subject, message-id) are stored 90 days for operational diagnostics. Email body content is stored as part of conversation/document data in your tenant's database and follows your tenant's retention policy. Privacy controls: PII addresses are masked in operational logs (`mask_email`), and the platform never logs full message bodies.

Can I connect my Outlook account to Muin?

Yes — both Microsoft 365 (work) and Outlook.com (personal) accounts connect via the Microsoft 365 OAuth flow. Go to **Settings** → **Communications** → **Connected mailboxes** and choose **Microsoft 365**. If your IT admin hasn't granted Muin tenant-wide consent yet, you'll see an admin-approval gate the first time — share the [Microsoft 365 connection guide](/docs/platform/communications/connect-microsoft-365) with them. After admin consent, every teammate can connect without warnings.

Can I connect my Gmail to Muin?

Yes. The flow depends on which kind of Gmail you have. For **Google Workspace** (work Gmail at your organization's custom domain): your Workspace admin trusts Muin once at the org level, then each teammate connects via OAuth — Muin syncs the labels you select. For **personal `@gmail.com`**: Muin uses a privacy-first forwarding bridge — we never read your inbox, you set up a Gmail filter that forwards just the messages you want into Muin. See the [Workspace guide](/docs/platform/communications/connect-google-workspace) and the [personal Gmail guide](/docs/platform/communications/connect-personal-gmail).

What can Muin see when I connect my mailbox?

Microsoft 365 + Google Workspace: messages in the folders/labels you select (default: Inbox), plus your name and email. We never request access to calendar, contacts, files, Teams chats, Drive, or any other service — mailbox-only. Access is **read-only**: we do not request `Mail.Send` / `gmail.send`, because Muin never sends from your address. Note that mail synced from a connected mailbox is visible to teammates who can open your organization's shared comms inbox — it is not private to you. Personal Gmail connect is currently unavailable (it existed only to send).

Can my colleagues see my mailbox messages?

No. Mailbox connections are per-user — each person connects their own account, and tokens are stored against that user only. Muin never copies one user's mail into another user's view. Your tenant admin can open an admin-only Connected Mailboxes overview, but it shows connection metadata (who connected, when, last sync) — not message content. Messages from your connected mailbox stay yours.

What happens when I disconnect my mailbox?

Tokens are cleared immediately when you click **Disconnect** at **Settings** → **Communications** → **Connected mailboxes**. Sync stops on the next tick. Messages that were already synced into your comms hub remain by default — you can choose to delete them in the disconnect dialog if you'd like. For personal Gmail: we can't delete your Gmail filter for you (we never had access to it) — go to Gmail's **Filters and Blocked Addresses** to remove it manually if you no longer want forwarding.

Is the OAuth process secure?

Yes. We use OAuth 2.0 with PKCE (Proof Key for Code Exchange) for both Microsoft and Google flows — that prevents authorization-code interception even on a hostile network. State tokens are single-use, bound to your session, and expire after 5 minutes. Refresh tokens are encrypted at rest with our platform KMS. We never see your password — Microsoft and Google handle the sign-in directly. You can revoke Muin's access at any time from your provider's account-security settings.

Why does Google Workspace require admin trust?

Google Workspace lets organization admins decide which third-party apps can access their employees' Gmail. Until your Workspace admin trusts Muin once at the org level, every member of your team would see "unverified app" warnings during the OAuth flow. Trust is a one-time, ≤5-minute setup at admin.google.com — see the [Workspace admin guide](/docs/platform/communications/google-workspace-admin-setup). After trust, your whole team connects without warnings, and the admin can revoke trust any time to remove all Muin connections from your org at once.

Why doesn't personal Gmail show my inbox in Muin?

Personal Gmail connect is **currently unavailable**, so it doesn't show your inbox at all. The flow's only purpose was to send from your personal address — its inbound came from a Gmail forwarding filter you set up, never from inbox access — and sending from a connected mailbox isn't supported yet, so Muin no longer requests `gmail.send`. The design rationale still holds for when it returns: personal accounts often hold deeply personal mail (bank statements, medical records, family conversations), so the flow deliberately never asked for inbox-read access. If you want full inbox sync for a work account today, use the Workspace flow with your IT admin's approval.