Harbor reads mail the way a mail client does: over IMAP, from your box, with a password you issued it. Two ways to set it up, and the trade each one makes.
On this page
Harbor connects from your server to your email provider over IMAP. You provide mailbox credentials rather than signing in through OAuth. Choose a dedicated forwarding mailbox or connect an existing inbox; each connection can use a different approach.
A forwarding mailbox#
A dedicated address, vault@ something, that you forward paperwork to. Harbor holds a credential to that dedicated mailbox and nothing else. This avoids giving Harbor credentials to your primary inbox. It also works for documents sent from a phone scanner or forwarded from a provider Harbor cannot connect to directly. You forward each document yourself. Mail Harbor has processed is removed from this mailbox after thirty days.
A connected inbox#
Point Harbor at a mailbox you already use. It first scans the last two months, read only, and shows the result grouped by sender: "142 candidates from 23 senders." You approve senders in bulk, and each approval becomes a standing rule, so the next bill from your electricity company can be filed automatically under that rule. Rules are visible and editable; nothing is learned invisibly.
Mail from anyone you did not approve is held for you to look at, never dropped and never filed on its own. Held mail and candidates are visible only to the person who connected the mailbox, until they file something. See The household.
Providers#
Setup asks for an email address and works out the server from it. Each known provider gets a direct link to its app-password page and one line on where it hides.
| Provider | Works with |
|---|---|
| Gmail and Google Workspace | An app password. Requires 2-Step Verification to be on first. |
| iCloud, Fastmail, Yahoo, Zoho, Posteo, mailbox.org | An app password. |
| Proton | An app password against Proton Bridge on your network. |
| A self-hosted server | A plain IMAP credential. A private CA can be supplied. |
| Outlook.com and Microsoft 365 | Not supported. Microsoft retired password IMAP. Use a forwarding mailbox and a rule on their side. |
Plaintext IMAP is refused, with no override.
What Harbor never does to your mailbox#
For connected inboxes, Harbor does not mark mail read, move it, or delete it unless you enable that behavior for the connection. Mail is deleted after thirty days only from a forwarding mailbox the vault owns. Held mail is not copied into the vault or its backups; Harbor keeps the envelope and fetches the body when you open it.
Invoices with no attachment#
Many invoices are the email body itself. Those are rendered to a PDF and filed like any other document. "Your invoice is ready, log in to view" has no document in it at all; in this version those are set aside for you to fetch by hand.
Limits#
25 MB per attachment, ten attachments per message, 200 messages per sync. Anything over a limit is held, never dropped, and the held item says which limit it hit. New mail is picked up on an interval, five minutes by default.