Email

Lumate sends email through your company's own mailbox: links to people (confirming an address, setting a new password, joining the company), notifications, and the emails agents draft for your contacts. It does not read incoming mail.

Settings → Email (owners and admins)#

The company that set up Lumate (the first company) is special: its mailbox also sends everyone's sign-in and password links, so only the person who set up Lumate (the instance admin) changes its email; its other admins see it read-only. When its set-up was handed to a manager (2.16.0), the person who installed Lumate cannot open it: its owner changes its email instead, still not its other admins.

1. Choose the mail server:
   • Microsoft 365 (smtp.office365.com, port 587, STARTTLS);
   • Google Workspace (smtp.gmail.com, port 587, STARTTLS);
   • Other mail server: its name, the port and STARTTLS (usually 587) or SSL (465). Lumate never sends without encryption.
2. Choose how Lumate signs in:

   • Password: the mailbox's sign-in name and password. For Google Workspace use an app password (Google account → Security → 2-Step Verification → App passwords), not the account's own password.

   • Microsoft 365 sign-in (recommended for Microsoft 365): Microsoft turns off password sign-in for sending (SMTP basic authentication) by default from the end of December 2026. Your Microsoft 365 admin:

     1. registers an app in Microsoft Entra ID and creates a client secret;
     2. gives it the SMTP.SendAsApp permission (Office 365 Exchange Online) and grants admin consent;
     3. registers its service principal in Exchange Online and allows it the mailbox (New-ServicePrincipal, then Add-MailboxPermission … -AccessRights FullAccess);
     4. makes sure SMTP AUTH is on for that mailbox.

     Then enter the tenant (its id or domain, like contoso.onmicrosoft.com), the Application (client) ID, the client secret and, if it is not the From address, the mailbox it sends as.

3. Sender: the From address and name, and optionally where replies go.
4. Limits: most per hour (default 100, at most 1,000) and per day (default 1,000, at most 10,000). Over a limit, email waits for the next hour or day; it is never dropped.
5. Save, then Send a test (to the address you type, or your own confirmed email).

The password and the client secret are encrypted and never shown again, only their last characters. Agents never see them. Leave the field empty to keep the saved one.

The top of the page shows how many emails wait, when the last one went, and the last problem in plain words (for example "The mail server refused the sign-in (535)"). The switch turns sending off without losing the settings.

On the server edition, Lumate sends only through public mail servers. Lumate Local can also use a relay on the office network.

How sending works#

• Email goes out within about 20 seconds: Lumate's own links first (confirming an email, a new password, invites), then the rest oldest first. A tenth of the hourly limit (at least one) stays free for those links, so notifications and automations never hold a password link back.
• A message that fails is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours; then it shows as Not sent with the reason. An address the server refuses fails at once.
• If Lumate stops, or the connection breaks, in the middle of sending a message, that message is marked Not sent, never sent twice: check before sending it again. The ones not tried yet simply wait for the next round.
• If the mail server or Microsoft refuses the sign-in, nothing is tried for 1 minute, then 5 minutes, and so on, and no message loses a try for it. Other troubles (a name that does not answer, Microsoft's sign-in unreachable) spend a try as a refused connection does.
• Each round starts with the company whose mail has waited longest, and a name lookup or connection never takes more than the round has left.
• With an hourly limit of 1 nothing is kept back for links.
• Lumate's own messages (links) are not kept once they went or failed. Finished mail is deleted after 90 days.
• While Lumate is not activated (Settings → Licence), only its own links go (confirming an email, a new password, invites, tests); the rest waits.

Your email (Settings → Your account)#

Type your address and press Send link. The address becomes yours when you open the link within 24 hours and press Confirm my email (one press, because some mail systems open links on their own). Until then nobody, you included, gets anything there. An address can belong to one account only (in any mix of capitals); an address that belongs to another account gets no link, and the page says the same either way.

Links for your account (confirming it, setting a new password) go only through the mailbox of the company that set up Lumate (the first company), never through another company's mail server, whose admin could read them. If that company has no email set up, the page says so.

Notifications by email:

• None.
• Important (the default): hand-offs, appointments, call backs, a blocked office browser, and OXS's maintenance and security notices.
• All: everything that reaches your Inbox.

When a notification holds words someone outside chose (a caller's message, for example), the email carries Lumate's own summary instead, as on WhatsApp.

Forgot password?#

On the sign-in page, Forgot password? asks for your username or email. If it matches an account with a confirmed email, and the company that set up Lumate has email set up, a link to set a new password goes there. It works once, within 30 minutes; other sessions are signed out. The page says the same whatever matched. At most 5 links an hour per person.

Without a confirmed email, the person who runs the server sets a new password for you there (see Operations).

When the first company's set-up was handed to a manager (2.16.0), its mailbox is theirs and keeps what it sends: only that company's own people get reset and confirm links through it. The person who installed Lumate resets theirs on the server (python -m app.cli reset-password, see Operations); people of the server's other companies ask them for a new password the same way.

Inviting by email#

In Settings → Members, Email it to sends the invite link through the company's email. You can still copy the link.

Email to contacts#

Each card has an Email section (the card needs an email address):

• The agent's draft: agents write emails with draft_email. Edit the subject and text if you like, then Send, or Discard. A new draft replaces the waiting one. The draft goes to the address on the card when you send it.
• Write an email: a person writes and sends one, with files on the card or its thread.
• What was sent, what waits and what failed, with the reason.
• No emails: the contact gets nothing more; waiting emails and drafts are cancelled. Use it when someone replies "stop": every email to a contact ends with "To stop these emails, reply to this email and ask us to stop.", and replies reach your mailbox (Lumate does not read them).

An agent sends on its own (send_email) only when the manager asked in a message that names the contact, or on the card's own thread, never to an address an agent wrote on the card (a person sends that one from the card), and a retried request in the same run sends once. It can attach up to 3 files (10 MB together) from its thread or the card's thread. The card's History notes each email by its subject.

Apps#

An app's automation can send an email: to the people with chosen roles (their confirmed emails), or to a record's email field. The subject and text fill {{field}} from the record; sensitive fields stay empty. A record's address that a contact card marks No emails gets nothing.