Confidentiality in a practice has always been held up partly by friction. Threads too long to read, attachments nobody opens, history that scrolls further than anyone scrolls. None of that was a control, and all of it behaved like one. An AI inbox removes the friction deliberately, because removing it is the product. That is the change to work with.
- The things this software is built to do are the same things that used to limit who read what. Their removal is it working, not a fault in it.
- Access inside the firm feels the change first. The standard you are held to limits access person by person and record by record; the boundary in the software is the business.
- Software that composes for you makes one mistake your habits cannot catch, because the recipient is right, the tone is right, and a single fact came from somewhere else.
- What you seal off is chosen by who must not read a particular message, never by how sensitive the contents are.
The friction that was doing the work
A practice mailbox has always held far more than anyone in the practice reads. That was never a decision. It was an accident of volume, and it quietly did a great deal of work.
Think about what that looked like on an ordinary Tuesday. Your colleague could open any thread on the shared address and did not, because finding out whether the Halloran chain mattered meant reading forty messages to the bottom. The seasonal preparer had the password from January and used it for the eleven returns in front of them. A bank statement that arrived in February was, in every practical sense, unread by everyone except the one person who needed the closing balance.
Now put an AI inbox over the top of it. Ranking says which threads matter without anyone opening one. Summarizing hands over what a thread says in a line, so nobody has to read the forty messages. Asking a question of an attachment gets the number out without the file being opened at all.
Every one of those is a reason to buy the thing. Every one of them also takes away a cost that used to sit between a person who technically had access and information they had no particular reason to see.
None of this is an argument for staying on a plain mailbox, and it is not the vendor’s fault either. Whether to accept the trade is a question you settle before you connect, and it belongs with the duty and the questions to put in writing. The question after you connect is narrower and nobody asks it: which of those frictions was your practice leaning on, and what goes in their place. The rest of this page is that list.
It is a change of degree rather than kind. Search was already chipping away at it. But search hands you the thread and leaves you to read it, and a summary hands you the substance. Between those two sits most of what follows.
Who else has a seat
Start with the boundary these products actually hold, because it is not the one people assume. Separation runs between the businesses you operate. Inside one of them, what a colleague can reach is decided by which mailboxes and shared addresses are connected there, and not by any rule about which clients they happen to work on. If your firm runs a shared address for client correspondence, and most do, that is the whole practice in one surface.
The standard you are held to is finer than that. The FTC Safeguards Rule requires implementing and periodically reviewing access controls that “limit authorized users’ access only to customer information that they need to perform their duties and functions” (16 CFR §314.4(c)(1), checked 19 August 2026). Person by person, record by record. No product in this category works at that grain, because its unit is the business and the mailbox.
So the grant you actually make is a seat, and a seat is a blunt instrument. That was already true of a shared mailbox and nobody worried much, for the reason the section above gives: a seat used to buy you a haystack. It now buys a ranked, summarized, searchable account of the same haystack. The preparer you brought in for the season, who used to work eleven returns because eleven was what fitted in a week, can take in the state of two hundred clients over a coffee.
Nothing in that sentence is a breach. All of it is a disclosure you made in January without thinking of it as one.
Which makes “periodically reviewing” the phrase that matters most, and the one least likely to survive a busy season. Seats opened in February are the seats nobody closes in May, and the person who left in April is on a list somebody means to get to. Put the seat list beside the extension list and read them on the same afternoon. It is five minutes, once a quarter, against the only access control you actually operate.
What a forward carries under it
Confidential material leaves a practice through a forward far more often than it leaks. The forward is the ordinary act with the most concentrated client information in it, because a thread history is not a message. It is a relationship: nine years of questions, corrected figures and second thoughts, sitting under the line nobody scrolls past.
Practices do this constantly and have to. The lender wants the file history. A client is introduced to a lawyer, or to the specialist who handles the state they just moved to. Someone is looped in on a return at the point it stops being routine.
The AI inbox changes the price of the covering note, not the forward itself. Ask for a summary of where a client stands and one comes back, well organised, in a paragraph you would have taken twenty minutes to write. That paragraph is a disclosure wearing the clothes of an admin task, and a good one is unusually hard to cut down afterwards, because everything in it is relevant to something. So decide what the third party is getting before you ask for the draft. Afterwards you are editing, and editing is where things stay in.
Then the case nobody watches for: a thread that grew a reader. Your client added their business partner at message forty, or the bookkeeper’s replacement was copied in last spring. Everything below is one reply-all away from a person who was not there when it was written, and no inbox flags that, including the one you have now. What is genuinely new is that you can ask. Who has been added to this chain since it started is exactly the sort of question an inbox you can talk to will answer, and it is worth asking before you reply to anything that has been running since March.
The mistake you cannot see
Every confidentiality failure a firm trains its people for is visible in the header. The wrong Baker offered by autocomplete. The reply-all. The attachment picked up from the row above. This is why the training is always the same sentence: look at who it is going to before you send it.
Software that composes for you produces a second kind, and in that one the header is perfect. A reply to the right client, on the right thread, in something close to your voice, carrying one figure that came from a different engagement. A sentence recapping a decision this recipient never made. A chase quoting a deadline agreed with someone else.
What makes it different is not how often it happens, because it is rarer than the envelope mistakes and will not be in most drafts you read. What makes it different is that your existing habit cannot catch it. Every check a firm has is an envelope check, and this one is in the body. It also reads correctly to the person receiving it, which is how it survives long enough to become an actual disclosure instead of an awkward email.
So it earns a habit of its own, and the habit is short. Read a draft for its facts, not for how it sounds. Tone is the thing these systems are best at and the thing you least need to check. Go through the specific claims instead, the figure, the date, the name, the commitment, and ask of each one whether you can point at where in this conversation it came from. If you cannot source it from the thread in front of you, it does not go out, and whether it is true is beside the point.
That check costs about fifteen seconds on a reply, which is the honest reason to keep client correspondence on review rather than raising it early. It is also the reason a firm should watch a season of drafts before it decides how much it trusts them.
Being able to say what happened
The duty has a second half that firms forget until the day it is needed. Not only avoiding disclosure, but being able to account for what was disclosed. A client asks who at your firm has seen their file. An insurer asks after a laptop goes missing. A partner asks whether the September letter went to the old address. In each case an answer has to be producible, and “I am fairly sure not” is not one.
Until now the answer was your sent folder plus your memory of who was copied, and that was adequate for a reason worth naming: you performed every action yourself, so recall covered the ground. Memory scales to what one person did.
Once software is acting for you, recall runs out first. Something was filed, something was forwarded, a scheduling exchange ran to a conclusion while you were with a client. If none of it is written down where you can read it, the truthful answer to who saw this is that you do not know.
So the record is a confidentiality control rather than a convenience, and worth judging as one. Is it in plain words or in event codes. Can you get at it by client and by thread, or only by day, because the question always arrives months late and about one person. Does it show what was read as well as what was done. How long is it kept, measured against how long you might be asked.
This is the one place where the trade runs the other way, and it is worth saying plainly. Your old mailbox kept no account of anything except what left it. A practice that can produce a readable history of what happened on a client’s correspondence is holding something it did not have before, and it is the sort of evidence firms are usually asked for and usually improvising.
What actually needs sealing
Every product here offers some version of a lane that nothing can read, and the question firms bring to it is which data belongs inside. That sorts the wrong thing, and the reasons run deeper than they look.
Sensitivity cannot select, for a practical reason before a legal one. In a practice nearly everything qualifies, so a lane you use for everything has stopped being a lane and become a mode. It also has a real price. A sealed message gets no ranking, no summary and no task lifted out of it, because your software cannot read it either. Seal the mailbox and you have paid for an ordinary mailbox.
What does select is the second reader. The question is not whether a message is confidential. It is whether there is a person, legitimately on this thread or legitimately inside your firm, who must not read this particular one. That set is small and you can usually name it on your fingers.
One partner writing to you about another partner, on an address the practice shares. A client telling you about a separation before their spouse knows, on the chain you have both used for four years. An employee raising something about their employer, who is your client. A letter to one shareholder that the board’s own inbox must not receive.
None of those turn on the contents being unusual. Every one turns on the audience being wrong by exactly one person. That is a judgment nobody else holds and no system can infer, and it happens to be available to you at the moment you are writing, which is the moment the lane is offered. A handful of messages a year, and the entire reason to have it.
Where does Point fit?
Point is one of these, so the whole page applies to it. What it does with the mail is the friction removal described above: threads ranked before you arrive, a summary on every conversation, an answer pulled out of an attachment with a link back to the page it was read from. The habits are the other half of that, not an objection to it.
- The separation Point holds is between the businesses you run. A practice and a rental company stay apart. Inside the practice, everyone you invite works in the same surface, which is what makes the shared address useful and what makes the seat list your real access control.
- Every action Point takes is written down in plain language, and what it did can be approved, turned down or reversed. One thing cannot: a message already delivered is on somebody else’s server, and Point says so rather than implying otherwise.
- How far Point goes is a dial, set separately for each kind of work, from suggest only, through preparing and waiting on you, to handling it. Review is where every kind starts. The drafting check above is what review exists to give you room for. Push one kind to the top of the dial and the checking in stops, which is the whole reason to push it.
- A message that must stay between two people is locked in the composer, sealed on your device and opened on theirs, and Point cannot read that one either. The cost is stated rather than buried: no summary, no ranking, no task.
Who else touches the mail is a list of names in subprocessors rather than a paragraph of reassurance. What Point will and will not do with your content, and which data its standard service excludes, are settled in the terms. The complete inventory of what the product does sits on the benefits page, and Point for accountants reads it back in the language of a firm.
Common questions
Does a summary count as a disclosure?
To the person who reads it, yes, in every way a client would care about. It is worth going further than that. A summary is easier to read than the thread it came from, which is the point of having one, so it travels further inside your firm than the original ever did. Treat the ability to summarize as a change in who effectively reads what, and let it drive the review of your seat list rather than the review of your vendor.
How do I stop a draft quoting one client’s figures to another?
You cannot stop it happening, and no honest vendor promises to. What you can change is what you check. The habit your firm already has looks at the header, and this mistake is in the body with a correct header above it. So add one pass over the specific claims in the draft, asking of each figure, date and commitment whether you can point at where in this thread it came from.
Our seasonal staff only touch a few clients. Is a seat really a problem?
The rule limits access to the information a person needs for their duties, record by record, and no product in this category works at that grain. So a seat is the grant you actually make, and it is worth more than it used to be, because ranked and summarized mail can be taken in far faster than a mailbox. Open those seats as late as the season allows and close them in May, with the extensions.
A client asks who at my firm has seen their file. Can I answer?
That is the question to run on yourself before a client runs it for you. Your sent folder and your memory cover what you did, which used to be everything. They do not cover what software did on your behalf. If the actions are logged in plain words and you can reach them by client, you have an answer. If they are not, the honest answer is that you do not know, and knowing that now is better than finding out in the moment.
Which threads should be locked end to end?
The ones where somebody legitimately on the thread, or legitimately in your firm, must not read that particular message. Not simply the sensitive ones, because in a practice that is most of them, and a lane used for everything costs you the ranking and the summaries you bought. The partner writing about the other partner is the case. The routine K-1 chain is not.
The short version
- Some of your confidentiality was resting on how expensive reading used to be. This software is built to make reading cheap, so that support goes when you connect, on purpose.
- Inside one business the software’s boundary is the mailbox, while the standard you answer to is per person and per record. The seat is the grant you actually make, so read the seat list every season.
- A forward carries the whole relationship under it, and an AI inbox makes the covering note cheap. Decide what the third party gets before you ask for the draft.
- The new mistake has a correct header and a foreign fact in the body, which is exactly what your existing check cannot see. Read drafts for claims you can source, not for tone.
- Sealing is chosen by who must not read a message, never by how sensitive it is, and the record of what happened is a control worth judging as carefully as anything else.
For the category itself, start with what an AI email client is. The duty, the vendor interrogation and who should not connect at all are in the client data guide, and which of the five kinds of product a firm is choosing between is in AI email for accountants. If two of you share the surface this page is about, one inbox for a two-person company covers the working half. The calm version of all of it is Point.