The best email setup for a consultant is one address you own, and every engagement runs through it. You make a deliberate choice about the client mailboxes you get issued along the way. The record lives in one place after the engagement closes. And you hold one rule about what leaves in an attachment. Almost none of it is a purchase, and the software you pick afterward sits on top of it.
- No regulator writes rules for consultants. Your obligations arrive through your clients instead. They’re in the NDA, in the security questionnaire, and in a handful of statutes that reach you because of who hired you.
- The mailbox a client issues you runs on a clock you don’t control. Their IT disables the account when the engagement ends, and everything in it starts counting down, in one case from 20 days.
- Your deliverable is usually too large to send, so it travels as a link. The link is now the access control.
- Business development and delivery share one inbox, and the two halves follow different rules. One of those rules is a federal statute with a per-message penalty.
The address you own, and the ones you are lent
Owning your domain is the part every version of this advice agrees on. The registrar housekeeping that goes with it is worked through in the accountants’ version of this setup. What’s specific to consulting is the addresses you don’t own.
Clients hand them out constantly. You’re on site for six months, so you get a badge, a laptop image and firstname.lastname@clientco.com. They have good reasons on their side: their access rules, their data controls, their internal directory, their own sense that a person doing this work should be reachable inside the building. Take the mailbox. What it needs is a plan, because the mailbox they give you is theirs in every sense that matters.
Start with what happens on the last day. Google Workspace admins can restore a deleted account “up to 20 days after deleting it. After 20 days, the data is gone and you can’t restore it” (Google Workspace admin help, checked September 6, 2026). Microsoft’s is slightly longer: “After you delete a user, the account remains in a suspended state for 30 days. During that 30-day window, the user account can be restored, along with all its properties” (Microsoft Entra documentation, checked September 6, 2026). After that the permanent deletion runs on its own, and nothing stops it.
Twenty days. Thirty days. The clock lives in their admin console, and an offboarding ticket you never see usually starts it. Two years of decisions, approvals and scope changes can be inside that account. The person who decides whether it survives has never met you.
The instinct is to forward the whole thing to your own address. Usually you can’t. In Microsoft 365 the automatic forwarding control in outbound spam filter policy defaults to “Automatic - System-controlled,” and Microsoft’s own note is that “In 2021, the value changed to Off - Forwarding is disabled for new organizations and for existing organizations that weren’t actively using the Automatic - System-controlled value” (Microsoft Defender for Office 365 documentation, checked September 6, 2026). When it’s off, the message bounces with 5.7.520 Access denied, Your organization does not allow external forwarding. Where it does work, it’s very often a breach of the acceptable use policy you accepted when they created the account. That’s a worse outcome than the bounce.
A second surprise waits earlier in the engagement, at the point where you try to open their mail on your own laptop. Clients with Conditional Access can require a managed device, and the control that does it “only supports Windows 10+, iOS, Android, macOS, and Linux Ubuntu devices registered with Microsoft Entra ID and enrolled with Intune” (Microsoft Entra documentation, checked September 6, 2026). Read plainly: to read their mail on your machine, your machine may have to be enrolled in their device management. That gives their administrators standing over a laptop that also holds four other clients’ work. Have that conversation while you’re still contracting. Ask early whether they’ll issue a device, and if they ask you to enroll your own, say no and take the loaner.
Guest access is the gentler version, and it’s worth asking for by name. An invitation into their files and their chat gets you into the work, and it leaves your mailbox out of their tenant. Their mail to you keeps arriving at your own address, where it stays.
So the rule for the whole arrangement is short. Their mailbox holds their internal traffic. Your address holds the record of the engagement. Scope, changes, approvals, invoices and deliverable transmittals go through the address on your own domain. So does anything you’d want in front of you two years later. When something that matters gets decided in their system, write it back out to your address. One message that says what was agreed and who agreed it. That single habit is worth more than any product in this category, and it’s free.
The rules that reach you through the client
There’s no consultants’ regulator, no license to lose and no Circular 230 for strategy work. That absence is exactly why the setup question feels ungrounded: nothing tells you what “adequate” means. If you’ve never been sure where your line is, that’s the reason. Four routes reach your mailbox anyway, and who your clients are decides each one, rather than what you call yourself.
A healthcare client makes you a business associate. The HIPAA definition names your work directly. A business associate includes a person who provides “legal, actuarial, accounting, consulting, data aggregation…, management, administrative, accreditation, or financial services” to a covered entity, where “the provision of the service involves the disclosure of protected health information” (45 CFR 160.103, checked September 6, 2026). The hospital needs a written agreement before it hands you the data: it may disclose protected health information to a business associate “if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502(e)(1)(i), checked September 6, 2026). Decide what this changes about your mailbox before the first file lands. The cheap answer is to agree in the statement of work that protected health information stays out of email in both directions, and that you work in their environment when you need it. The expensive answer is to stand up safeguards for a mailbox that now holds patient data.
Federal work as a subcontractor pulls your mailbox into the contract. FAR 52.204-21 defines a covered contractor information system as “an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information,” and lists fifteen basic safeguarding requirements for it. Then it flows down. The prime “shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract… in which the subcontractor may have Federal contract information residing in or transiting through its information system” (FAR 52.204-21, checked September 6, 2026). Your mailbox becomes a covered contractor information system the moment the prime emails you a draft deliverable. Six of the fifteen requirements are about who may sign in and how they’re authenticated, starting with “Limit information system access to authorized users, processes acting on behalf of authorized users, or devices.” All of it is ordinary, and all of it is easier to have already done than to retrofit while a prime is asking.
A financial-sector client is why the questionnaire arrives. Under the FTC Safeguards Rule, a covered institution must oversee its service providers by “Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue,” “Requiring your service providers by contract to implement and maintain such safeguards,” and “Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards” (16 CFR 314.4(f), checked September 6, 2026). That’s the whole explanation for the eighty-question spreadsheet in your inbox. It goes to every service provider they use, and your contact is following a rule they can’t waive for you. The word “periodically” means it’ll come back. Answer it once, properly, and keep the answers in a file you update, because the second and third clients ask the same things in a different order.
Personal data brings state law with it. An HR project, a customer analysis or a churn model puts other people’s data in your possession, and two obligations follow. California requires the business to bind you by contract, including a term that obligates a service provider “to comply with applicable obligations under this title and obligate those persons to provide the same level of privacy protection as is required by this title” (Civil Code 1798.100(d), checked September 6, 2026). And if your mailbox is compromised, the notice runs to your client first: a business “that maintains computerized data that includes personal information that the individual or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery” (Civil Code 1798.82(b), checked September 6, 2026). Immediately, on discovery. Most other states have a version of the same duty. Whatever else your incident plan says, the first name on it is the client’s.
Underneath all four sits the reason the NDA has teeth. Information is only a trade secret if “the owner thereof has taken reasonable measures to keep such information secret” (18 U.S.C. 1839(3)(A), checked September 6, 2026). Your client’s protection depends partly on how you handle what they gave you. That’s why the confidentiality clause reads the way it does, and why sloppy handling on your side is a live claim against you.
None of this is legal advice, and your counsel may read your particular contract differently. The working version is three questions, answered before the first document arrives. What counts as confidential here. Where does it live while we work. What happens to it at the end.
One inbox, or one per engagement
Four clients suggests four mailboxes. One mailbox handles it, and at solo-to-five scale it handles it better. Every extra mailbox is another set of credentials, another second factor, another archive to search. It’s another place mail can arrive unwatched. The account you check least often is the one that gets used against you, and it’s also the one holding the message you needed in a dispute.
One mailbox on your own domain, with the separation done inside it, is the arrangement that holds up. Three habits do the work. Each engagement gets a recognizable subject convention. Each workstream keeps one thread instead of a new one per question. And the client name appears the same way every time.
The genuine exception is a conflict wall. If you advise two firms that compete, keeping their material apart becomes an obligation, and email is where it breaks. The failure is nearly always the same one. Autocomplete offers the wrong Dave, and a positioning deck goes to the competitor. Distinct display names help. An external recipient warning helps more. A short delay before anything leaves helps most, because almost every one of these is caught within ten seconds of sending. Where two engagements really can’t touch, separate accounts are worth the overhead. Make that call on the two that conflict, and leave the rest as they are.
Bringing in an associate for one engagement raises the same question in reverse. They need this client, and your archive holds three others, so the mailbox stays yours. Route the engagement through a shared address or a delegated thread. Date their access from the start, and remove it on the last day. Covering for each other works through what a second person actually needs to see.
And if you’re the only person in the business, decide now how someone else gets in when you can’t. A solo consultant’s mailbox is a single point of failure for every client at once. The fix is a documented recovery path, held by someone you trust. Running a one-person business is where the rest of that argument lives.
Sending the deliverable
Consulting is one of the few businesses where the product itself goes out by email. The size limits shape that more than anyone expects.
Gmail’s ceiling for personal accounts is 25 MB, and past it “Gmail automatically removes the attachment and adds it as a Google Drive link in the email” (Gmail help, checked September 6, 2026). Microsoft’s default is a little higher: “The default maximum message size for Microsoft mailboxes is 35 MB for sending and 36 MB for receiving. Microsoft administrators can specify a custom limit between 1 MB and 150 MB” (Exchange Online limits, checked September 6, 2026). A sixty-page deck with screenshots in it clears none of those reliably, and the limit that decides is the receiving side’s, which sits out of your view.
So the deliverable travels as a link, and the link is now the access control. Three questions come with that, and they’re worth answering the same way every time. Who can open it, which is a real decision to make. For how long, because a link with no expiry is a copy of your work sitting in an ex-client’s bookmarks. And whether it keeps updating after you send it. A live link shows the client your 11pm edits. A copy shows them what you sent.
That last question is the version problem in disguise. Send a static copy for anything that’s a deliverable of record. Keep the live link for things still moving. Say in the message which one you sent. A one-line transmittal that names the version and the date makes the archive worth having, and it makes the milestone invoice easy to support.
A short, specific list stays out of email in both directions: their customer records, their employee data, the model with real names and real salaries in it. Where their systems can hold it, use theirs. It’s their data, their tenant is where it’s already protected, and every copy that lands in your mailbox is a copy you account for at the end.
Then the part that’s about getting paid. A deliverable sent into silence is one you can’t prove landed, and on milestone billing that’s a month of cashflow. Ask for the acknowledgment in the message that carries the work, and keep the reply. Following up when nobody has answered is the craft of doing that without becoming the person who chases.
The pipeline shares the inbox
Delivery and business development arrive at the same address. That’s convenient, and it’s slightly dangerous, because the two halves are judged differently. A client’s question is a reputation matter measured in hours. A proposal that goes quiet is revenue measured in weeks. They need different responses, and they look identical in an unsorted list.
The half most consultants get wrong is the legal status of outreach. A one-to-one introduction to a stranger is a commercial email when its primary purpose is promoting your services, and the FTC’s line between content types is the test: commercial content “advertises or promotes a commercial product or service,” while transactional or relationship content “facilitates an already agreed-upon transaction or updates a customer about an ongoing transaction” (FTC CAN-SPAM compliance guide, checked September 6, 2026). A note to a live client about their project is out. A cold approach to a VP you met once at a conference is in, and writing it by hand keeps it in.
Three requirements follow, and all three are easy. Your message must include a valid physical postal address, and the guide is explicit that this “can be your current street address, a post office box you’ve registered with the U.S. Postal Service, or a private mailbox you’ve registered with a commercial mail receiving agency.” Any opt-out mechanism “must be able to process opt-out requests for at least 30 days after you send your message,” and you “must honor a recipient’s opt-out request within 10 business days.” The penalty runs per message rather than per campaign: “Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088” (checked September 6, 2026).
The postal address is the one that stops solo consultants, because the only address they have is where they live. That’s why the FTC names the two alternatives. Register a box, put it in the footer of anything promotional, and it’s settled.
There’s a quieter cost to running outreach from the same domain as delivery. Complaints and spam reports attach to the domain, and a bad month of prospecting is paid for by the client email you actually needed delivered. If your outreach runs at any volume, a separate sending domain keeps the two reputations apart. The authentication records that make either domain trustworthy are a subject of their own, and the accountants’ setup covers what to publish and why.
Closing an engagement without losing the record
Read the return-or-destroy clause before you sign it. A mailbox is the hardest place in your business to comply with one. Delete the thread and the attachment lives on in their copy, in your backup, and in the export you made in month three. A clause written for a data room, applied literally to email, is a promise you’ll quietly break.
It’s usually negotiable. The version most clients accept is narrow: return or destroy on request, except for one archival copy retained under the same confidentiality obligations for a stated number of years. Ask for it at signature. Asking on the last day looks like you have something to keep.
You want that carve-out for two reasons. The first is that your mail is reachable by other people’s disputes. A subpoena can command a person to “produce designated documents, electronically stored information, or tangible things in that person’s possession, custody, or control” (Federal Rule of Civil Procedure 45(a)(1)(A)(iii), checked September 6, 2026), and a consultant’s correspondence about a decision is exactly the material a party goes looking for. Being able to produce it is a bad afternoon. Having destroyed it under a clause you agreed to is a longer conversation.
The second is your own defense. When a client says eighteen months later that the third phase was always in scope, the thread where they approved the change order is the entire case. You have it because you kept it.
So the retention decision has two halves, and both get written down. How long you keep engagement mail. Whether the contracts you sign let you keep it that long. Pick the number from your longest exposure, which for most consultants is the limitation period on a contract claim in your state, and apply it to mail and files together.
Then the closing routine itself, which takes twenty minutes and is worth doing the same way every time. Ask for an export of the client-issued mailbox while the account is still live, because then it’s a request. Once it’s disabled, it’s a favor. Move anything that belongs to the record over to your own address. Confirm in writing what you’ve kept and under which clause. Take yourself off their shared drives and their chat and ask them to confirm it’s done, so their next access review finds your name already gone. Then write the reference request and the check-in date while the work is still fresh, because the engagement that comes back is nearly always the one somebody remembered to ask about.
Putting Point on top of it
Everything above is yours, and it holds whatever you run on it. Point is a layer you add afterward, and the fair test is whether it inherits your setup or asks you to rebuild it.
Point is an AI email client that runs on the Gmail or Microsoft 365 account you already have. Your domain, your addresses and your archive stay exactly where they are. You keep your address, your clients keep writing to it, and the record stays in the mailbox it has always been in.
What changes is the state of the inbox when you open it. Point weighs messages before you see them, on what being late costs you and how much they actually matter. The client waiting on a decision sits above a webinar invitation, and how that weighing works is a subject of its own. Each engagement keeps its own lane, so one client’s context stays in that client’s thread. Deep in a deliverable and want none of it? One tap puts the inbox back to newest first.
The parts that fit consulting specifically are the ones about commitments and stakeholders. Say you’ll send the revised scope by Friday, and Friday gets recorded with the promise attached to it. A proposal that’s gone quiet resurfaces while it’s still worth chasing. Tasks from every engagement gather into one list. Finding a slot that a client’s CFO, COO and two directors can all make stops being a week of reply-all, and arranging a meeting without the chain is where that’s worked through. A long thread between five stakeholders arrives with the decisions in it separated from the argument that produced them. You re-read the engagement instead of reopening it.
The controls are the part to look at if your clients ask about subprocessors. Every kind of action has its own place on an autonomy dial, from suggest-only to review to fully handled, and out of the box they all sit at review. Move one up and Point handles that thing without coming back to you first, which is the only reason anyone moves it. Whatever Point does gets written to a log with a time on it, and most of it can be walked back from there. Once a message reaches someone else’s server, it’s past what any software can reach. For the material an engagement genuinely turns on, there’s a channel locked end to end, and the trade is worth knowing in advance: nothing sent that way gets ranked, summarized or turned into a task. Point has no more access to it than anyone else does. If you run a second business alongside the consultancy, the two stay isolated from one another. Be precise about what that covers: the wall is drawn around a business you operate, not around each client sitting inside one.
Most of this article sits outside what Point does. You register your domain, you negotiate your return-or-destroy clause, you answer the security questionnaire, you choose your retention number, and access to a client tenant comes from the client. Point is an email client, so your data room and your project tool stay where they are. Connecting Point is a service provider decision under most consulting agreements, and some clients require notice before you add one. Work through the questions worth putting in writing first before anything is connected. Everything Point does is the full inventory, and Point for consultants reads it back through a practice like yours.
Common questions
Should I use the email address my client gave me?
Yes, for their internal traffic, which is what it’s for, and keep the record of the engagement at your own address. The reason is the clock on it. Google Workspace accounts can be restored for 20 days after deletion and Microsoft accounts for 30, and their IT starts and stops both timers. Anything you’d want in front of you two years from now should live somewhere the client’s offboarding ticket can’t reach.
Can I forward a client mailbox to my own address?
Usually not, and usually you’d rather not. Microsoft 365 disables automatic external forwarding by default for organizations that haven’t turned it on, so the attempt bounces with a 5.7.520 error. Where it does work, it almost always breaks the acceptable use policy attached to the account, which is a worse problem than the bounce. Ask instead for an export at the end of the engagement, while the account is still live.
Do I need a separate email address for each client?
No. At solo-to-five scale, extra mailboxes cost more than they buy. One address on your own domain with a consistent convention per engagement is enough. The real exception is a conflict wall between two clients who compete, where separate accounts are worth the overhead for those two specifically.
Is a personal email to one prospect really covered by CAN-SPAM?
If its primary purpose is promoting your services, yes, and writing it by hand keeps it covered. The FTC’s test is the content: commercial content advertises or promotes a product or service, while transactional or relationship content updates someone about a transaction already agreed. So the update to a live client sits outside it, and the introduction to a stranger sits inside it. That means a valid physical postal address, a working opt-out for at least 30 days, and honoring an opt-out within 10 business days.
A client sent a security questionnaire. What is the minimum I need?
It depends who they are, and the questionnaire itself usually tells you. A financial institution is under the Safeguards Rule’s duty to select and contractually bind its service providers, and that duty stays with them whatever you say. What actually gets asked about email is narrow and largely free. Multi-factor authentication on every account. A named answer to where client material is stored. A retention period you can state. And one page saying who you contact if the mailbox is compromised. Write the answers once and keep them, because the next client asks the same things in a different order.
Do I have to delete everything when an engagement ends?
Read the clause, because many say yes and mean it. Negotiate a carve-out for a single archival copy under continuing confidentiality obligations, and do it at signature rather than on the last day. You want it for two reasons. A subpoena can reach documents in your possession, custody or control in someone else’s dispute. And the thread where a client approved a change order is the only evidence you’ll have if the scope is questioned later.
Does connecting an AI email client need my client’s approval?
Check the contract, because some say so explicitly. Most consulting agreements treat any tool that touches confidential material as a service provider or subprocessor you’re adding, and a few require written notice or consent before you add one. That’s a five-minute read now, or an awkward disclosure later. What decides it is how large an action the tool can take after it reads the mail, and what an AI email client can and cannot see sorts that out properly.
The short version
- One address on your own domain carries the record of every engagement. Client-issued mailboxes carry their internal traffic, and everything you need later lives at yours.
- The account they gave you can be gone 20 or 30 days after your last day, on a ticket you never see. Ask for the export while the account is still live.
- No rule names consultants. Rules reach you through your clients instead. Healthcare brings a business associate agreement. A federal subcontract brings a FAR flowdown. A financial institution brings a service provider clause. And if their data is exposed in your mailbox, you tell your client immediately.
- The deliverable is too big to attach, so it goes as a link. Decide who can open it, for how long, and whether it keeps changing after you send it.
- Outreach is regulated even one message at a time. Physical postal address, working opt-out, honored within 10 business days.
- Negotiate the return-or-destroy clause at signature so you can keep one archival copy. It’s your only evidence when a scope argument arrives eighteen months late.
For the buying decision that comes after the setup, what an AI email client actually is marks out the categories. For the first two weeks of running one, connecting a mailbox is the practical start. Then there’s Point itself.