Shared where it should be. Private where it matters.

The two layers

Narlo separates two kinds of data with different default visibility:

• Mailbox content — message bodies, attachments, and anything inside your connected inbox. Private to the person who connected that mailbox, by default, with no exceptions.
• Commercial/business records — customers, organisations, products, quotes, and opportunities. Shared across your workspace, by default, so your team works from the same picture.

These are enforced as two genuinely separate permissions in Narlo's authorization layer, not one setting that happens to control both. Reading mailbox content requires being the connecting user, or holding an explicit grant. Reading or writing shared business records only requires workspace membership — it does not require, and does not grant, mailbox access.

Workspace admin doesn't mean mailbox access

Being a workspace Owner or Admin changes what you can manage — team membership, roles, the business-record layer — not what mailbox content you can read. There is no "view all employee email" permission anywhere in Narlo's design. This is different from how Gmail and Outlook themselves work at the organisation level: a Google Workspace or Microsoft 365 administrator genuinely can access employee mail through tools like Google Vault or Microsoft Purview eDiscovery, with the right permissions configured. Narlo's workspace-admin role is deliberately not given that capability over the mailboxes connected through it.

Sharing a mailbox is explicit, scoped, and revocable

The only way anyone other than the connecting user sees a mailbox's content is an explicit grant: the person who connected the mailbox chooses to share it with a specific teammate, for a specific set of actions, and can revoke that access at any time. Every grant and revocation is recorded.

What "shared business context" actually means today

Once a customer, organisation, quote, or opportunity exists in your workspace, any team member with business-record access can see it — independent of who created it. This is workspace-wide sharing, not per-record sharing: there is currently no way to share one customer record with a subset of your team while keeping it from another teammate. If you need that kind of finer-grained control, it is not available yet — we'd rather say so than imply it.

Linking an email to a business record

Narlo's architecture is designed so that, when this feature ships, linking a specific email into a shared business record will share only the fact of that link and whatever fields are explicitly chosen — never mailbox-wide access, and never the rest of the thread or inbox. As of today, this linking feature does not exist yet: quotes, contacts, and organisations are not currently linked to actual email messages. This page will be updated when that changes.

What Narlo does not claim

Narlo is not end-to-end encrypted and does not use zero-access encryption. The server needs to be able to read business-record data to search it, link it, and show it to your team — that's a deliberate tradeoff in favour of a genuinely useful shared workspace, not an oversight. If your requirement is that literally no one but you can ever read your mail under any circumstance, that is a different, stronger guarantee that products like Proton Mail are built around, and Narlo does not make that claim.

Other security measures

• Two-factor authentication is supported and can be required for all accounts in a workspace.
• Connected mailbox credentials (OAuth tokens) are encrypted at rest.
• Privileged actions — invitations, role changes, mailbox-sharing grants and revocations — are recorded in an audit history visible to workspace owners/admins.
• Registration is closed by default; joining requires an invitation or an allowlisted email address.