Your mailbox password stays with your provider. Point holds a grant instead, made at your provider’s own sign-in page. That grant carries Point’s name, covers the things you allowed, and sits in a guarded store. You can cancel it from your provider account, on your own, without signing into Point at all.
- You connect a mailbox by authorizing it at your provider. That’s the whole of the step.
- The grant has three parts: a name, a list of what it covers, and an end. Those three are the subject of this page.
- This is the one control in this collection whose off switch sits outside Point, in a provider account you’ve had all along.
- Canceling stops everything from that moment on. What happened before it is a separate question, with a separate answer.
The password nobody asked you for
When people ask where their credentials are kept, they’re picturing a password in a file, on a server, at a company they met last month. That’s a fair thing to wonder about. Here’s what happens instead when you connect a mailbox.
You sign in at your provider’s own page, the one you’ve seen a thousand times. Your password goes where it always goes. What comes back to Point is a different object: an authorization your provider issued because you asked for one.
That difference earns its place, because of what a password is. A password is a universal key. Anything holding it looks exactly like you. It covers everything the account can do, rather than the part you meant. And it lasts until you change it, so taking it back breaks your phone, your accountant’s portal and everything else that had it, all in the same afternoon. Hand one to a piece of software and you hand over all three of those properties at once.
So here’s a test worth carrying around, and it costs nothing to apply. A product that wants your mailbox password typed into a form of its own is asking for the universal key. It’s asking for it to do a job a grant does more narrowly. You come out behind on that trade every time.
It also explains a message that sends a lot of people looking for this page in the first place. When something tells you the correct credentials are needed for your email, a forgotten password is rarely the trouble. A lapsed grant almost always is, and the answer is to authorize again.
What a grant actually says
Three things. A name, a list, and an end.
A name. Your provider issues the authorization to Point specifically. Your provider knows which of its keys is which, and so do you, because your account lists them by the company they were issued to. That named quality is also why a separate account of what your assistant did is possible at all. Which record answers which question belongs to the activity log behind every action, rather than here.
A list. A grant covers named things. Reading your mail, writing to it, seeing your calendar, sending on your behalf. The list is the boundary, and good intentions are a separate matter entirely. You see that list at the moment of connecting, and that screen is the one point in this whole arrangement where you set a boundary rather than read about one afterwards. Most people click straight past it. It’s the shortest piece of reading with the largest reach in the entire setup.
An end. A grant can lapse on its own, and you can withdraw it while everything else you own carries on as before. Your password stays as it is. Your other apps keep working. The grant simply stops, for one company, on purpose.
This is the largest permission anywhere in this collection, and it’s the first one you gave. Every dial position, every held action and every row in the record works inside it. The grant draws the outer edge of what’s possible. The settings decide how much of that edge gets used. People merge those two on this subject more than any other, in both directions at once: some expect the connection by itself to hold Point back, and others expect it to have handed everything over already.
Where the key is held
On Point’s side, in a store built for the purpose rather than in a configuration file somebody forgot about. Point’s own description of it is that the connections to your email are kept under lock, not left lying around where they could leak. The security section of the privacy policy names the measures around them:
- encryption in transit and at rest where supported
- least privilege
- access controls
- credential and token handling controls
- limits on which humans can reach anything at all
One figure there is load-bearing and worth reading closely. Point’s privacy policy, checked August 19, 2026, puts the retention of connected-account tokens at until the account is disconnected, the authorization expires, the account is deleted, or security or law requires otherwise. What that is evidence of is more useful than the sentence itself. The life of the key is pinned to the life of the connection. Ending the connection is the same act as ending the reason to keep it.
Past that, the honest answer is that “where” stops being something you can read off a screen. Which region, and whose cloud. Who inside the company could reach the store on a bad day. What you’d be told, and when, if any of it went wrong. Those are questions for a supplier rather than for a settings page. They deserve asking in as many words, and questions to ask any AI tool about your data is the list to put to them, along with what to accept as an answer.
Here’s why that open part can leave you where you are, and it’s the argument this page exists to make. You hold the control whether or not the storage question is ever settled for you. The control sits outside the store.
The one switch that is not in Point
Look at the rest of this collection and notice what every control has in common. The dial. The queue of things waiting on your yes. The record of what happened. The line between two businesses. The button that puts something back. Every one of those is a Point surface. Each works because Point works, and each is yours on the condition that you can sign in and the company is having a normal day.
The grant sits somewhere else. It lives in the provider account you had before Point existed. Your account lists it beside every other key you’ve ever issued, and you can cancel it right there. You do that yourself, at your provider, on your own authority, while the company whose access you’re ending stands outside the transaction. The same job can be done from inside Point by disconnecting the account, which is often the more convenient handle. The useful part is that there are two handles, and one of them belongs to you alone.
That asymmetry is the whole reason to understand this rather than merely to be reassured about it. A control you can only use with a company’s cooperation is a promise, and a promise is worth precisely what the company is worth. A control you hold from outside is a fact, and it stays a fact on the day you have stopped believing the promise. Everything else on this page is Point describing Point’s own behavior, which you’re entitled to weigh exactly as skeptically as you weigh any vendor describing itself. This one you can go and look at today, in an account of your own, and see the entry with Point’s name on it sitting there.
Canceling ends the capability, cleanly, from that moment. The door closes, and the reading, sorting, drafting, scheduling and sending stop with it. Going backwards is a different instrument with its own limits, set out in undoing what Point did.
The other credential
Two keys are in play and they’re different objects, which is worth ten minutes now and saves a confused hour later.
One is the grant on your mailbox. The other is how you get into Point at all. That one is a link. It arrives at your address and lets you in, so there’s no second password for anyone on your team to manage, reuse or lose. Two doors. Your provider guards one, and a link to your own address opens the other.
The exact part matters more than the reassuring part. Someone who got into your Point account would be inside Point. They’d see what Point sees. They’d act through the surfaces Point offers, at whatever the settings for each kind of work happen to be. Your mailbox password isn’t there to take, and they couldn’t carry the connection off to use somewhere else, because a grant is issued to a company rather than typed into one. But “they can’t get my password” and “they couldn’t do anything” are two different sentences, and only the first one is true.
That shapes the response, if it ever happens. Cancel the grant from the provider side, where the switch works whatever state the compromised account is in. Then read what was done from the record. Both halves matter, and the second is the activity log behind every action.
Where a connection stops
Autonomy is a separate setting. A fully connected mailbox with every kind of work sitting at review is a mailbox where things get prepared and then wait for you. Out of the box, that’s where the settings are. Capability is one question and autonomy is another, and the second is setting how much your inbox does on its own.
It ends things going forward. Withdrawing access ends what happens next. The work already done stays done, and its record stays with it. Taking one action back is a narrower thing, and it runs out where a message has already reached somebody else’s server.
It’s one mailbox, in one business. A second business you operate connects its own mailbox under its own grant, and each stands on its own. The same line runs through every other control on this page, and it’s drawn in keeping one business isolated from another.
A grant speaks about permission. The record speaks about activity. Those are two instruments, and a live connection tells you what’s allowed rather than what was done.
The company answers for the company. Storage, regions, subprocessors, deletion, breach notice and what happens to any of it when you leave are answered by a supplier in writing. The connecting screen carries permissions, and those questions go elsewhere.
All of this describes the arrangement, and whether to connect anything stays yours to decide. If what brought you here is that putting a tool on your mailbox still feels like a step too far, why Point never needs your email password covers the same ground from the worried end rather than the reference end. What Point does once a mailbox is connected, feature by feature, sits on the benefits page.
Common questions
Does Point need my Gmail password?
No. You connect at Google’s own sign-in, where the password stays and where it has always stayed, and what returns to Point is a grant in Point’s name covering the things you allowed. The distinction is worth caring about rather than just taking as reassurance, because the two objects have different shapes. A password is one universal key. Anything holding it can do everything the account can do, for as long as it likes, and looks exactly like you while it does. A grant has a name, a list and an end, by design.
Something told me the correct credentials are needed for my email. What does that actually mean?
Almost always that a grant has lapsed rather than that a password is wrong, which is why trying to remember a password gets you nowhere. Authorizations expire, get withdrawn, or stop covering something they used to. The fix for all three is the same. You authorize again at your provider, a fresh grant is issued, and the password stays untouched throughout.
One caution follows from everything above. If a message of that kind arrives as an email carrying a link, treat the link as you would any other. A sentence about credentials needing attention is a phishing favorite, for exactly the reason this page opens with: most people picture a password, and they hurry.
Where exactly are my credentials stored?
In a guarded store on Point’s side, kept for as long as the connection lives. Point’s privacy policy, checked August 19, 2026, puts the retention of connected-account tokens at until the account is disconnected, the authorization expires, the account is deleted, or security or law requires it. The same policy names token handling controls, least privilege and encryption at rest where supported among the measures around them.
Past that, “exactly” becomes a question for the company rather than something visible to you. It can stay open while you connect, because the thing being stored is a bounded grant you can cancel from outside. A password would be the thing you’d have to change.
If I disconnect, does Point lose everything it already did?
No, and separating the two halves is the useful part. Withdrawing access ends the capability from that moment, so the reading, drafting and sending stop. What happened while the grant was live still happened, and the record of it is still the account of your inbox for that period. Putting one particular action back is a different instrument with a different reach, which is undoing what Point did. A message that already reached somebody else’s mail server stays there.
Do I have to connect each business separately?
Yes, and the second one is a decision you make rather than a gap somebody left in the design. A grant is made for one mailbox, and a mailbox sits inside one of the businesses you operate. So you authorize the second business deliberately, or it stays unauthorized. What you allowed in the practice stays inside the practice, and the property company is its own arrangement. That’s exactly what you’d want the day you sold one of them. Ending a grant on one side leaves the other side untouched, because they were never the same key.
The short version
The word credentials makes people picture a password, and the password is the one thing that stayed with your provider. What exists instead is a grant. It’s issued in Point’s name. It’s bounded by a list you were shown. It’s kept under lock while the connection lasts, and you can end it from either side. That grant sets the outer edge of what’s possible, and the settings inside Point decide how much of that edge gets used, which are two questions people routinely merge into one. Its best property is where the switch sits: in an account of your own. That makes this the one control here that rests on nobody’s word. Point is what you’d be connecting to.