Help Center

Google Workspace: a super admin, because only super admins can grant domain-wide delegation. Microsoft 365: anyone can start, but a Global Administrator has to approve the consent screen.

The account signing in is not a Global Administrator. Ask one to sign in to Zoes and approve the consent screen - one approval covers the whole tenant, and you can then use your own account.

In the Google Admin console go to Security → Access and data control → API controls → Manage domain-wide delegation, and check the client ID and every scope match what Zoes showed you exactly. A single missing scope fails the whole check.

If it matches, wait a few minutes and retry - Google does not apply delegation changes instantly.

No. Every synced user appears in Members with a toggle. Only protected mailboxes are scanned and only protected mailboxes count toward billing.

Members is synced from your Google or Microsoft directory. Run a sync from Members to pick up new users right away, then protect them.

Open it in the dashboard and set the verdict to Safe. The dashboard updates everywhere.

The message goes straight back to the inbox, on Google Workspace and on Microsoft 365 alike, and other copies of the same email are released with it.

Check three things, in order:

1. Is the recipient protected in Members?
2. On Gmail, did it land in Promotions, Social or Forums? Those tabs are not scanned.
3. Did it arrive before the mailbox was protected? Earlier mail is reported, never moved.

If none apply, open it in the dashboard and mark it Dangerous. It is kept to improve detection.

There was not enough signal to call it either way, so Zoes left it where it was. Review it and set the verdict yourself if you want it filed.

That is by design. The scan of mail already in inboxes is a report - it shows what was sitting there and never reorganizes a mailbox after the fact. New mail is filed automatically from then on.

Real-time alerts go out only when a Dangerous message is moved out of an inbox. Suspicious, Spam and Graymail never trigger one. If it was Dangerous, check the channel is still connected in Settings → Integrations.

Yes. Each channel has its own digest setting - daily, weekly on Mondays, or monthly on the 1st - independent of real-time alerts.

Those channels are part of Team and Business. Starter includes email alerts. See pricing.

One protected person. Users who appear in Members but are not protected do not count.

Starter covers up to 4. At 5 you need Team or Business (14-day trial, card required). Until a plan is active, Zoes keeps recording verdicts but stops moving mail.

Protection keeps running while the payment is retried - a failed charge does not switch it off. Update the card in Settings → Billing.

Settings → Billing opens the billing portal, where you can cancel, change the card and download invoices. Annual billing costs ten months instead of twelve, about 17% less.

The owner invites them by email from Settings. There is no link to expire - the seat is attached the first time that person signs in.

Disconnect from Settings. To be thorough, also remove the delegation in the Google Admin console or the enterprise app in Microsoft Entra.

Scan records are kept for 90 days. Message bodies are not stored, except a copy of each email Zoes flags or an admin corrects (up to 12 months, to improve detection). Delete the account from Settings to remove your data. Detail in the Privacy Policy.