Getting started
An admin connects the organization once. Nothing is installed on employee devices and mail routing does not change - Zoes reads and files mail through the same APIs Google and Microsoft provide to any business app.
Google Workspace
- 1Sign in to Zoes with a Google Workspace super admin account.
- 2Grant domain-wide delegation in the Google Admin console when prompted. Zoes shows the exact client ID and scopes to paste.
- 3Zoes syncs your directory and lists every user. Choose which mailboxes to protect.
Microsoft 365
- 1Sign in to Zoes with a Microsoft work account.
- 2A Global Administrator approves Zoes on Microsoft's admin-consent page. One approval covers the whole tenant.
- 3Zoes syncs your directory and lists every user. Choose which mailboxes to protect.
Access can be revoked at any time - in the Google Admin console (remove the delegation) or in the Microsoft Entra admin center (remove the enterprise app). Disconnecting from Zoes Settings does the same from our side.
What gets scanned
On Gmail, Promotions, Social and Forums hold marketing and notification mail that Gmail has already sorted away from the reader. If a message you expected Zoes to catch landed in one of those tabs, it was not scanned.
Verdicts and actions
Every scanned message gets one of six verdicts. The verdict decides what happens to the message in the mailbox.
Unknown means there was not enough signal to decide. Zoes does not move a message it is not sure about.
Attack categories
Dangerous and Suspicious messages carry a plain-language label for the kind of attack, plus the signals behind the verdict - for example a lookalike sender domain or a link to a newly registered site.
Correcting a verdict
Open any message in the dashboard and pick the verdict it should have had: Dangerous, Suspicious, Spam, Graymail or Safe.
- The dashboard switches to your verdict everywhere - totals, activity, the feed, the map and Members.
- On Google Workspace the message is re-filed to match: Safe puts it back in the inbox, Graymail moves it to Promotions, and so on.
- The corrected message is kept for up to 12 months to improve Zoes detection. It is never used to train generalized AI models.
The dashboard
The overview is made of widgets you can drag, resize, hide and add back.
Time saved is estimated per message from how long that message would take to read, not a flat number per email.
Members
Members lists everyone synced from your directory and whether their mailbox is protected. Protecting or unprotecting a mailbox is a toggle; billing counts protected mailboxes only.
Clicking a person opens what they were sent: every flagged message, its verdict and the reason. Most Targeted Members ranks people by severity, not volume - one well-crafted dangerous message counts for more than several low-grade suspicious ones.
Reports
Reports are generated from the dashboard and download as PDF.
Alerts and digests
Set up channels in Settings → Integrations. Each channel is configured on its own.
EmailSlackMicrosoft TeamsTelegramReal-time alerts
Sent when a Dangerous message is moved out of someone's inbox. Suspicious messages do not trigger an alert - there are too many for that to stay useful.
Digests
A summary of everything that happened in the period. Each channel has its own frequency - daily, weekly (Mondays) or monthly (the 1st) - so real-time Slack alerts can be off while a weekly email digest stays on.
Admins
The person who connects the organization is its owner. The owner can invite more admins by email from Settings; the seat is bound the first time that person signs in. Anyone with a seat can see who else has one.
Plans and limits
Starter is free for up to 4 protected mailboxes, with no card and no time limit. Team and Business are priced per mailbox - see pricing.
The existing-inbox scan is a report: it shows what is already sitting in inboxes and never moves anything. Only new mail is filed automatically.
Data and retention
- For email judged likely safe, Zoes stores the verdict and the signals behind it, not the message. Sender and subject are stored as hashes.
- A copy of every email Zoes flags, and of every email an admin corrects, is kept for up to 12 months to improve detection.
- A picture of each message is kept for 7 days so an admin can review it, then discarded.
- Scan records are kept for 90 days, then deleted.
- Disconnecting revokes access; deleting the account removes your data.
Full detail: Security and Privacy Policy.