Approving Revr for your organization’s mailboxes

Revr asks for the minimum needed to send from the broker’s address, and, if they leave the boxes ticked, to place calendar holds and read their own mailbox. The last column says what each permission is for. Section 4 explains why a tenant-wide approval grants more than a single broker’s connection does.

Approve Revr by its OAuth client ID (a public identifier, safe to allowlist):

Publisher: Revr AI, Inc. · Domain: getrevr.com

1. Admin console → Security → Access and data control → API controls.
2. Under App access control, choose Manage third-party app access → Configure new app → OAuth Client ID.
3. Paste the Google client ID above, select the org units / groups that should have access, and mark the app Trusted (or grant access to the gmail.send scope).

Your brokers can then connect their mailbox without the “unverified app” or blocked-app screen.

There are two ways to approve Revr, and they do not grant the same thing. Please read both before choosing.

A. Approve each broker’s own request (grants the least)

A broker starts the connection in Revr and chooses what Revr may do before the Microsoft screen appears. Their request reaches you as a normal admin consent request in Enterprise applications → Admin consent requests, and it asks for only what that broker ticked.

This is the route to use if your policy is send-only. Tell your brokers to untick Read my inbox, and the request that reaches you contains no mail-read permission at all. Sending, calendar holds and every other part of Revr still work; only reply detection stops.

B. Grant tenant-wide consent (grants everything Revr is registered for)

Approving Revr for the whole tenant, either from Enterprise applications or through the link below, grants every permission on Revr’s app registration, not the subset an individual broker asked for. That is the complete list:

• Mail.Send — send mail as the signed-in user.
• User.Read — read the signed-in user’s own profile, so Revr can confirm which account connected.
• offline_access — keep the connection alive without asking the user to sign in again.
• Calendars.ReadWrite — create tour and meeting holds on the user’s calendar.
• Mail.Read — read the user’s mailbox. See section 5 for exactly what reads it and when.
• Mail.ReadWrite— read and change the user’s mailbox. This is registered so that a broker can eventually archive, delete or mark mail read from inside Revr and have it apply to their real mailbox. Revr does not call any mailbox write operation today. It is listed here because tenant-wide consent grants it, and we would rather you saw it here than on the consent screen.
• Files.Read.All and Sites.Read.All— read the files in the user’s OneDrive and the SharePoint sites they can already reach. This is how a broker points Revr at the folders holding their offering memorandums and rent rolls, so Revr can copy those documents in and turn them into records. Revr reads only the folders the broker explicitly picks, never the whole drive, and never writes to either. A broker connecting a mailbox is never asked for these: they are requested only by the Connect OneDrive button in Settings. As with Mail.ReadWrite, tenant-wide consent grants them regardless, which is why they are named here.

If that full set is more than you want to grant, use route A instead. Tenant-wide consent cannot be narrowed to a subset.

Either route can be scoped to a security group of just the brokers who use Revr, under Enterprise applications → Users and groups, with Assignment required switched on.

Tenant-wide consent link (replace {tenant} with your tenant ID): https://login.microsoftonline.com/{tenant}/adminconsent?client_id=fc93a48c-9ea6-4154-9a4f-56b2b81df3f1

Mail.Readgrants access to the whole of the connected mailbox. Microsoft Graph has no scope for “only the threads this application sent”. Revr uses it for two separate things, and they are not the same thing.

Reply detection, on whenever Mail.Read is granted.A scheduled job runs every five minutes. For each connected mailbox it asks Graph for messages received in the previous ninety minutes, at most fifty, from the Inbox folder only, and requests just these fields: sender, subject, received date, read flag, conversation id, and the short text preview Graph returns. A message is kept only if its subject begins “Re:” and its sender matches somebody the broker had already emailed from Revr. Everything else is discarded in memory and never stored. This is what pauses a sequence when a prospect replies, and what honours an opt-out sent by email.

The full mailbox mirror, off by default. This is the separate feature that copies a mailbox into Revr so a broker can read and search it in the product. It is off for every account, there is no self-serve control that turns it on, and it is enabled for an account only on request. The rest of this section describes that feature, not reply detection.

• Availability. Available for Microsoft 365 where Mail.Read was granted, on request. For Google Workspace it is in limited early access: turning it on requests the restricted gmail.readonly scope through its own consent screen, and Google’s verification review of that scope is still running, so it is offered only to accounts we have invited.
• Scope of the read. When it is on, Revr reads the whole connected mailbox, not only threads Revr itself sent, going back up to twelve months on the first sync and every new message after that.
• Retention. Message bodies are kept for ninety days from when the message was received, then deleted automatically; sender, recipients, date, subject and a short preview are kept for as long as reading stays on. A message that was already older than ninety days the first time Revr read it never has a body stored, opening it fetches the text live from the provider instead.
• Attachments. Never stored. Only the filename, type and size are recorded; opening an attachment streams the file live from the provider and it is never copied into Revr’s storage.
• Turning it off. Switching mailbox reading off deletes every message Revr stored from that mailbox by default.
• Google Limited Use. Mail read through this feature is used only to show the broker their own mail and to power the Revr features they invoke. It is never sold or used for advertising, never used to train or fine-tune any AI model including Reggie, and never reviewed by a human except with the broker’s consent, to investigate abuse or a security incident, or where the law requires it.

• Send-only by default, consent-gated. The send scope carries only recipients the broker has an existing relationship with or who opted in; cold prospecting routes through the user’s own separate sender, never this connection.
• Reading the inbox is a tick box at connect. Untick it and Revr never requests Mail.Read, so no mailbox content is read at all. Leave it ticked and the only thing that reads is the reply poll described in section 5, which keeps a message only when it is a reply to outreach the broker sent. The full mailbox mirror stays off either way.
• Credentials encrypted at rest (AES-256-GCM), decrypted only server-side at send time, never exposed to the browser or any AI model.
• Volume-paced per mailbox with a hard daily ceiling and business-hours spacing, so a connected mailbox can’t be used for a spam spike.

More detail: Security overview · Privacy policy