Your email password stayed with you. There’s no box to type it into. You signed in on your provider’s own page, and the connection was made there. What Point came away holding is the permission rather than the secret.
That’s the sixth question answered in a line, and it’s the least useful line on this page. The reassurance is real, and it’s narrow. It settles something about a company. What you’re asking about is people. Who else can get in. The five chapters behind you asked what the software does with the mail. This one asks who: which person, on which evening, could reach eleven years of client correspondence. And what they could do once they were in there.
This question stands apart from the other five. It was already live before you opened the tab. It stays live if you close the tab for good. And it asks about an arrangement you’ve kept for a decade. Today is the first time you’ve looked at it.
The question that was never about software
Everything so far has been a question about behavior. What gets read. What leaves. What’s written down. How far Point goes. Where the line between two businesses falls. Each one asks about something that acts, and each one is answerable by holding a supplier to a document.
This one is about a door, and the door is older than the subject. Your mailbox has been reachable since the day it existed. Something has stood in front of it the whole time. You’ve left that something alone, because as far as you could see it has always held.
So the honest framing is an audit. You already keep this route. Connecting Point adds a new thing at one end of it. The first chapter named the most common error in this subject: weighing a new thing against zero. Here it does the most damage.
It gets asked last because it feels like the plumbing question, sitting underneath the interesting ones. It’s the question the other five stand on. If somebody can be you, the dial you set is theirs. The record becomes a record of them working. The line you drew between the practice and the other venture is drawn around them too. Every answer in this series rests on the person at the keyboard being who they claim to be.
A key nobody can count
Start with what’s guarding your mailbox now, and be honest about it.
The password on your mailbox is probably older than the practice’s current filing software. It’s been typed into a phone, and into the phone before that phone. It sits in a browser at the office, and probably in one at home. It went to the person who covered January the year everyone was ill. Some version of it sits on three other services you signed up to and forgot. Close enough that guessing the difference is easy.
Strength is beside the point here. Plenty of those passwords are strong. The defect is the counting. A password is the one kind of key that gets duplicated by being read. Making a copy is a silent act. No event, no record, no notice, no moment. So the number of copies is unknown, to you as much as to anyone. Taking it back means changing it, and the change reaches every holder at once, including you. Which is why it keeps getting put off, and why the copies pile up for years.
Sit with the shape of that, because this series has been circling it from the start. It’s the quiet failure, the kind that goes unannounced. Something stops happening, and the silence is all you get. You’ve met it in a blind spot that quietly stops ranking a message, and in a setting left too low for a year. Here it is again, inside the arrangement you were treating as the safe baseline.
What Point holds is an item on a list. It’s a named, bounded authorization, issued to one company. It sits somewhere you can see it and end it. That’s a claim about what kind of object the thing is, more than a claim about how careful Point is. The difference is the one the record turned on: something you can count is something you can check, and something invisible is something you take on faith. The anatomy of that authorization, where it’s kept and what it covers, is set out properly in where your email credentials are kept. What matters here is that the way in became countable.
Your mailbox was always the master key
Now the part that reframes the worry. It’s why this chapter exists, instead of a paragraph pointing at the reference page.
Point has no password of its own either. You get in through your email address, which is one fewer secret for anybody on the team to invent, reuse or mislay. That reads as a convenience. Underneath it is a statement about where the lock actually sits. Whoever can read your mail can get into Point.
Which sounds like a weakness, until you notice it’s been true of nearly everything you own for years.
Think about what your mailbox already is. The filing portal will send a reset there. So will the bank, the practice management system, the payroll software, the company registry login, and the insurer. Every one of them treats an email address as proof of identity, and honors it on that alone. So your mailbox is the account that reissues the others. It has held that position quietly since long before anybody was worried about AI.
So “who else can get in” has had one important answer the whole time, and it sits with the provider account underneath your email.
That hands you the most valuable move in this chapter, and it points away from the product. Turn on two-step verification at your provider, if it’s off. Then learn which people can reach that account. It costs an afternoon at most, and it improves every one of those services at once. It has been waiting three years precisely because the thing it protects has gone right every day so far. Connecting anything to a mailbox is a good occasion to do it. Do it because the tool is the first thing in a decade to make you look squarely at an account you’ve been betting the practice on.
What somebody else would inherit
Be exact about the new door. The comforting sentence and the complete sentence differ here.
Someone signed in as you is inside Point, and inside Point is the exact extent of it. They see what Point sees. They work through Point’s own surfaces, on each kind of work, at whatever level that kind of work is set to today. The mailbox password stays out of their hands, because Point holds no copy of it to take.
“They can’t get my password” is true. “They couldn’t do anything” is a different sentence, and it’s false. A supplier who lets you hear the first as the second hasn’t been straight with you.
So here’s a second test for every row on the dial, and it takes about ten seconds. The last-but-two chapter gave you the first one: the safe position is the one you’ll still be keeping properly in November, on a bad week, with a deadline on Thursday. Here’s the other. For this kind of work, at this setting, what could a stranger do in the hour before anybody noticed?
For filing and sorting, a mess inside your own account, and a mess you can put back. For the row covering what you say to clients, the answer is the one thing in this whole series with no way back, because a message that has reached somebody is past everything you administer. Two separate arguments now point at that same row and say move it slowly. The mailbox is a partial account of a relationship. And whoever holds the account inherits the setting you raised.
Raising a row is still a fair thing to do, and this exposure is older than the category. Somebody who gets into a plain mailbox this evening can write to every client in it immediately, and there’s no setting anywhere in the way. Ordinary email runs at one autonomy level, and it’s the top one, for anybody who arrives holding the key. What the dial changes is that the exposure has positions in it now, and you picked them. What the record changes is the question. It stops being what could have been done. It becomes what was done, at what time, to which thread. That’s the instrument built for a different purpose, doing the most useful work of its life on the worst morning you’ll have.
Letting somebody in, and letting them go
The other half of who else is a shorter subject than the intruder, and a far more likely one.
A colleague gets into a practice mailbox today because you tell them the password. That does the exact thing this chapter is about. It makes another copy that goes uncounted, held by somebody whose reason for holding it runs out. The seasonal preparer from three Januaries ago has it still. There was no moment to mark, so nothing marked it. Taking it back means changing it, which lands on everybody including you. So it waits.
Access to Point is a membership, and a membership has an end that belongs to one person. Somebody joins. Later somebody leaves, and the leaving is aimed at them alone. Everybody else’s day carries on. That’s the whole improvement. It’s unglamorous, and over a decade it’s worth more than most of the features anybody sells you.
Now the honest scoping, since this series has given you one every time. Removing somebody ends what they can do next. What they already read, they’ve read. And a workspace draws its line between businesses, while the people inside it stay inside it, which the chapter on two businesses worked through from the other direction. Point’s terms put the responsibility for admin roles, account access and authorization settings on the customer. They put the duty to tell Point promptly about suspected unauthorized access on you as well (terms, section 5, checked August 19, 2026). That’s the accurate division. They can build a door that opens for one named person, and only you know which people ought to be named.
What six questions were for
Six chapters ago there was a closed tab, and a feeling with no parts in it.
What you have now is six answers. Each one is attached to something a person can be held to, and each one is more than a mood. Trust in AI was never the thing on offer: a verdict that size carries the same defect as the doubt it replaces, with nothing inside it to revise. The first five have been totted up twice in these chapters already, and twice is enough. The sixth changes what the other five are worth. The way in is a list rather than a secret, and it rests on an account that was always the important one.
Notice what the last of the six did on its own. It sent you outside the product, to a job on your own provider account that no vendor gains from you doing. Take that as evidence about the questions themselves. A set of questions that only ever produces answers a supplier is glad to give is a set the supplier wrote.
And the floor stays where it always was. Point’s own terms say it in as many words: “No method of transmission, storage, or processing is completely secure. Point does not guarantee absolute security” (terms, section 14.5, checked August 19, 2026). Every serious supplier says a version of that, and a supplier who stays quiet about it is the one to worry about. Against zero, that sentence would land as a let-down at the end of a long argument. You were reading against what’s in the building already. One person, and one password of unknowable reach. No record of what was done. And everything sitting at the top of a dial that doesn’t exist.
Which is where the reading stops being the useful part. Six questions have taken the lump apart, and given each piece somewhere to be checked. What’s left arrives from two weeks of watching, rather than another page. Point is the thing to point at a mailbox. Once you have, the full inventory is what Point does. And your first two weeks is the doing rather than the deciding. If the professional question is what’s still holding you, rather than the personal one, questions to ask any AI tool about your data is the list to put to a supplier in writing.
You were right to stop at that screen. You were right that nobody had given you an argument. What was missing was never nerve.