Security

Data and access

Where mailbox data lives, how to turn the connection off, and how to request the documents your security team needs.

The connection reviews are Google Workspace and Outlook.

Google Workspace. A super admin grants the service account for the domain. People on the domain are not shown a consent screen. Details and the permission list are on Google Workspace.
One Google calendar. That person consents on Google’s screen. The grant is only their calendar, not the domain and not Gmail.
Outlook. Consent is per user. Tenant-wide admin consent is only required when your own Entra policy demands it.
Mailbox content is used to run and stop that lead’s follow-up sequence. It is not used to train KALI’s own models.

Revoke access

Google, the whole domain. In the Admin console, delete client ID 105974321967114898365 from Domain-wide delegation. Every mailbox on that domain stops. Those mailboxes have no refresh token to delete.
Google, one calendar. Remove the connection in KALI, then revoke it at myaccount.google.com/permissions.
Outlook, in KALI. Show-Up Sequences, Sending inbox, remove the mailbox. That deletes the stored tokens and the Inbox subscription. Sends stop.
Outlook, in Microsoft. Removing it in KALI does not delete the Entra grant. The signed-in user can revoke it at myaccount.microsoft.com/permissions. An admin can remove the enterprise application for client ID 03477409-6ad4-44b8-a91c-4b1a6217c82e.

Request the DPA and current security reports from your KALI contact. They are shared with your security team and are not posted here.

Domains to allow are listed on Google setup and Outlook setup. KALI does not publish a static IP list.