Findest needs somewhere documents come from and somewhere they go to. Those are separate permissions with separate risks, and treating them as one is how people end up granting more than they meant to.
Turn on 2-step verification, create an app password and paste it in. It's encrypted before it's stored. Findest checks the mailbox every 5 minutes and opens it read-only, so nothing is sent, deleted or marked read.
Outlook and Hotmail connect through Microsoft's own consent screen, which grants mail read access and nothing more. Findest never sees your Microsoft password, and Microsoft tells Findest when new mail arrives.
Google Drive uses drive.file: Findest reaches only the folders you pick in Google's own picker, shared drives included. OneDrive and Dropbox need read and write access, which lets you browse your real folders and choose the library it writes into.
A signed hand-off proves that a Findest user began the flow. The nonce proves it was this browser. Both are needed, so a code stolen from someone else's consent screen can't attach their account to yours.
Connecting Google Drive
Every new connection sends an email naming the provider and the account. Disconnecting revokes access at Google and Dropbox. Microsoft doesn't let an app revoke itself, so Findest deletes its copy and shows you where to remove it.
New connection added
Google Drive (you@example.com) was just connected to your Findest account.
If this wasn't you, disconnect it now.
Review connectionsDisconnect
From a destination Findest never reads your files, only folder names so you can pick one; and nothing is ever written to a source.
A mailbox Findest watches for attachments. It is opened read-only: Findest can never send, delete, label or move anything, and it doesn't even mark a message as read.
A cloud folder Findest writes into. It creates and uploads files where your rule says, and it doesn't read, index or touch anything already in there.
Stated as capabilities rather than scope names, because a scope name doesn't tell you what it means in practice.
| Connection | What it allows | What it can't do |
|---|---|---|
| IMAP mailbox | Read attachments, through an app password scoped to mail and revocable on its own. | Send, delete or mark as read |
| Outlook | Read mail, granted on Microsoft's own consent screen. | Send or delete |
| Google Drive | Create files in the folders you pick in Google's picker (drive.file), shared drives included. | See the rest of your Drive |
| OneDrive | Browse folders and create files in personal, Microsoft 365, SharePoint and Teams libraries. | Send email |
| Dropbox | Browse folders and create files in personal and team folders, with the team's own permissions respected. | Send email |
Findest never sees the password to your Google, Microsoft or Dropbox account: you type it on their page, not ours. For mailboxes connected with an app password, that password is encrypted with AES-256-GCM before it's stored, so a database dump on its own doesn't open anyone's mail.
Gmail, iCloud, Yahoo or your company's own mail server all connect the same way: your address, an app password, and the server details if we don't recognise the domain. There's no waiting list and no review queue in between.
Most providers only offer app passwords once 2-step verification is on. If you can't find the option, that's almost always why.
Findest checks the mailbox every 5 minutes, so a document is usually filed within 5 minutes of reaching you. Outlook and Hotmail addresses go through Microsoft's sign-in instead, because Microsoft no longer accepts app passwords for them.
The read-only mode of the protocol itself, so unread stays unread.
The Free plan includes one mailbox; Pro and Business connect as many as you need, and each rule can be limited to one of them. Setting up Gmail step by step is on Gmail
Both halves are needed, and in an account-linking attack they end up in different browsers: the victim has the code, the attacker has the nonce, and neither can finish. A plain cookie can't do this job here. The app and the callback live on different domains, so Safari blocks the cookie outright and Firefox partitions it.
Every new connection triggers a message to your account address naming the provider and the account. If a connection ever appeared that you didn't make, you'd know the same day rather than never. It respects your security-alert setting.
Disconnecting from inside Findest revokes access at Google and Dropbox. Microsoft doesn't let one app be revoked on its own, so Findest deletes its copy and points you to account.live.com/consent/Manage to remove it there.
If you kill an app password, the next check fails to authenticate, the connection is flagged and you get one email. It isn't retried against your provider every five minutes forever.
On Business, a rule can archive the same document to more than one cloud at once. That's useful when finance keeps its own copy in SharePoint while the working folder lives in Drive.
The extra copies are genuinely secondary: if one fails, the main filing still succeeds and the failure is recorded against the document in your History rather than silently swallowed. A second destination can't cost you the first.
The main copy and the extra copy are logged separately.
Gmail and any other mailbox that supports IMAP, such as iCloud, Yahoo or your company's own mail server, using an app password. Outlook and Hotmail connect through Microsoft's own sign-in instead.
No. Destination access is used to create files and to let you browse folders when you're picking one. Existing contents aren't read or indexed.
Only the folders you pick yourself in Google's own picker, plus the files Findest writes into them. That is the drive.file scope: the rest of your Drive is invisible to it, including whatever was already sitting in the folder you picked. Shared drives can be picked too.
The Free plan includes one mailbox. Connecting a second mailbox, or more, is a Pro and Business feature. Each rule can also be limited to a specific mailbox once you have several connected.
Everything already filed stays exactly where it is: it's in your cloud, in your folders. Disconnecting only stops future archiving.
No. It's encrypted with AES-256-GCM before storage, with the key held separately in a secrets vault rather than beside the data.