Ascripto FAQ
Last reviewed 19 October 2026
Plain answers first. Where an administrator will want the mechanism, a Technical line follows.
Sections: General · Pricing and billing · The audit · Google Workspace · Microsoft 365 · Signatures and the editor · People and your directory · Campaigns · Security and privacy · Your account · Troubleshooting
General
What does Ascripto do?
It keeps your company’s email signatures consistent. It reads the signatures your people actually send, shows you who is off-brand and why, lets you design the signature everyone should have, and puts it in place: into Gmail on Google Workspace, and into each outgoing message on Microsoft 365.
Which platforms?
Google Workspace and Microsoft 365. Both can be in one workspace if your company uses both, each connected from its own sign-in.
Who is it for?
Companies of any size, including very small ones; there is no seat minimum. The person running it is usually an owner, office manager or marketer. IT is needed for two one-off steps: allowing access, and, on Microsoft 365, the mail flow setup, which an owner can also do with a script.
How long does it take to set up?
Google Workspace: about ten minutes to the first audit. Microsoft 365: about fifteen minutes to the first signed message, once an administrator is at hand.
Do I have to install anything?
No. Nothing on computers, nothing on phones, no browser extension, no Outlook add-in.
What is free?
The audit on Google Workspace, the signature builder, mailbox import, the Brand kit and every preview, for any number of people, for as long as you like. Paying is what puts signatures into mail.
We are an IT provider (MSP) with several clients. Can we manage them in one place?
Not yet in one place. Each client is a workspace of its own today; the switcher between workspaces for one account is planned. Write to sales@ascripto.com for partner pricing (25% off list and one bill across your clients' workspaces).
Can we have our own deployment, in a particular region?
Yes, as Enterprise: dedicated virtual servers, database and storage in the Azure region your data has to stay in, with the Microsoft 365 relay or without it, and invoices by bank transfer. Quoted, not listed: sales@ascripto.com.
Pricing and billing
Is there a seat minimum?
No. The smallest bill is €9 or $9 a month, which covers up to nine seats on Team or five on Business. Full prices at ascripto.com/pricing/.
What is a seat?
A person whose signature Ascripto delivered in the month, counted once however their mail is signed. On Microsoft 365: anyone the relay signed at least one message for. On Google Workspace: anyone whose Gmail carried your current signature at some point in the month. The month’s count so far is in Settings → Billing all month.
Do leavers, shared mailboxes or people we never deployed to cost anything?
No. Only people whose mail carried a signature that month count.
Do I need a card for the trial?
No. The 14-day Business trial starts without one, once per workspace. If no payment method is added by its end, the workspace goes back to the free audit and nothing is charged.
What happens to signatures when the trial ends or we cancel?
Ascripto stops writing them and, on Microsoft 365, stops inserting them. On Google Workspace what is already in people’s Gmail stays as it is until somebody changes it.
How and when am I billed?
Monthly, at the end of each month for that month’s seats, by card (Apple Pay, Google Pay and Link included) or SEPA Direct Debit in euros, through Stripe. Invoices are emailed and kept in the billing portal (Settings → Billing → Manage billing). Euros in the EU and EEA, US dollars elsewhere, fixed by the billing country before the first payment.
VAT?
A business in another EU country with a valid VAT ID is reverse-charged. In Poland, and for an EU business without a VAT ID, 23% Polish VAT is added. Outside the EU none is added. Prices are shown before VAT.
Can we change plan or cancel?
Any time, in Settings → Billing. Moving up to Business applies at once, prorated; moving down to Team applies at the end of the month. Cancelling runs the plan to the end of the month, which is billed as usual, then returns the workspace to the free audit.
Refunds?
You pay after the month, so leaving never leaves a prepaid period. A charge made in error is refunded in full; tell us within 30 days. If a feature you pay for is removed, the terms give you a refund for the unused part of the month.
What if a payment fails?
It is retried for 14 days and you are told. If still unpaid, the workspace is suspended until it is paid; nothing is deleted. On Microsoft 365, mail routed through Ascripto is passed on without signatures for 7 days and after that refused temporarily, so remove the routing if the suspension will last.
Can we pay by invoice and bank transfer?
On Enterprise.
The audit
What does the audit check?
Each person’s Gmail signature for new messages, against your directory: whether there is a signature at all, whether it carries their name, the job title and work phone the directory has, and a logo. Each cause row on Home links to exactly those people.
What can’t it see?
The separate signature a person may have chosen in Gmail for replies and forwards; a “Mobile signature” set inside the Gmail app on a phone; fonts, sizes and colours; and anything a person adds beyond your content. Here’s exactly what we watch, and what we can’t on Home says the same in full, and it is deliberately not hedged.
How often does it run?
Once a day by itself, and whenever you click Check again. Last checked always shows the age of the numbers.
Why does it say some mailboxes “couldn’t be read”?
Google refused to open them, usually because signature access was not applied yet or was withdrawn, or because the account is suspended. They are counted apart, not as off-brand.
Why does everyone show “no logo”?
Because no logo has been uploaded yet, or the signature has no Logo block. Upload one in Assets → Brand kit; the gallery designs and the Default show it.
Someone kept our signature and added their own mobile number. Is that off-brand?
No. Added lines are mentioned, not flagged.
Is there an audit for Microsoft 365?
Not yet. Microsoft offers no way for an app to read the signature someone set in Outlook. On Microsoft 365 the relay signs every message regardless, so there is nothing to drift. An Outlook add-in that reads them is planned.
Google Workspace
Why does a super admin have to add a client ID and a scope by hand?
Because reading or writing a signature on someone else’s mailbox is only possible for a service account that a super admin has allowed for the whole domain. This is Google’s domain-wide delegation, and no consent screen can replace it. Technical: users.settings.sendAs on another user requires a service-account client with domain-wide authority; the scope is gmail.settings.basic.
Why isn’t the permission read-only, if the audit only reads?
Google has no read-only version of that scope. The audit reads; nothing is written until you deploy, and the same grant is what deploy uses later.
Is Ascripto verified by Google?
Yes. Google verified Ascripto’s OAuth app on 2026-10-17, so its consent screen shows no “unverified app” warning. The permissions asked for are listed in the admin guide.
Does the signature reach phones?
Yes. A Gmail signature is a property of the account, not of a device, so the Gmail app uses it unless a person has set a “Mobile signature” inside the app on that device. That setting is device-local and nothing outside the phone can see it.
Can people edit the signature back?
Yes. On Google Workspace, Ascripto writes the same field a person can edit, so client-side deployment is not enforcement. The difference is that the audit tells you when it happens, and Fix these puts it right. If enforcement is the requirement, the relay on Microsoft 365 is the model; a server-side option for Google is not offered today.
Our people get two signatures. Why?
Google’s Admin console Append footer adds its text below whatever the user has, including the signature Ascripto wrote. Turn the footer off (Apps → Google Workspace → Gmail → Compliance) at every org unit where it is set, once your legal text is in the Ascripto signature.
How fast is a deploy?
Signatures go live as each is written, roughly twenty a second: under a minute for most companies.
Can we have different signatures for new mail and replies?
Not in Ascripto today. Gmail lets each person choose a different saved signature for replies and forwards; that choice stays theirs.
Microsoft 365
Why route mail through Ascripto rather than install something in Outlook?
Because Microsoft gives no server-side way to manage Outlook signatures: Microsoft Graph cannot do it, Exchange Web Services is being switched off between October 2026 and April 2027, and transport-rule disclaimers cannot carry images or sit under the latest reply. Signing mail on its way out covers every client, including phones, with nothing installed.
What exactly changes in our Microsoft 365?
Three things in Exchange Online: an inbound connector, an outbound connector, and one mail flow rule that sends your domains' outgoing mail through Ascripto once. Your MX records, incoming mail and SPF record do not change. The full description is in the admin guide.
Does our mail leave Microsoft?
Each outgoing message goes to the Ascripto relay, gets its signature, and comes straight back to Exchange Online, which delivers it as it does today. The relay runs on Microsoft Azure in Frankfurt. Message content is handled in transit and not stored.
Who needs to do the setup?
Whoever set up your Microsoft 365, or anyone who is a Global Administrator there (or an Exchange Administrator). Two ways: Set it up for me, where they sign in once and allow Ascripto to make the three objects, or the script, pasted into Windows PowerShell on any Windows computer.
Is “Set it up for me” safe?
It asks Microsoft for one delegated permission, Manage Exchange As Signed-in User, for that one occasion. The token lives in memory for about an hour and is never stored. Nothing else is read or changed, and nothing happens if consent is declined.
Microsoft says the app is “unverified”. Why?
Our publisher verification with Microsoft is in progress (started 2026-10-15). Until then the consent screen says so, and a non-administrator cannot sign in to a new app without an administrator’s approval, which is why the first sign-in from your company should be an administrator’s.
Will people see the signature while writing, or in Sent Items?
No. It is added after Send, so it is not in the compose window or the Sent Items copy. This is true of every server-side product. Tell your people once.
Are replies and forwards signed? Phones?
Yes to both. The signature is placed under what was written, above the quoted earlier messages, and images are embedded once rather than piling up down a thread. Every client that sends through Exchange Online is covered.
Our people already have signatures set in Outlook. Will they get two?
Where the relay recognises Outlook’s own signature block in a message, it replaces it with the managed one. A signature somebody typed by hand, which it cannot recognise, stays, with the managed one placed after it, so it is worth asking people to clear their Outlook signature once routing is on.
What is left alone?
Encrypted or digitally signed mail, calendar invitations, bounces, mail from senders who are not people in your directory with a signature (a distribution list, a redirected message), and messages too large to sign. The message log says Not signed and why.
Does it affect SPF, DKIM or DMARC?
SPF and DMARC: no, because the last hop is Exchange Online’s own server. DKIM: Exchange Online does not DKIM-sign a message that came back through a connector, which is the same as other relay products; a copy later forwarded by a recipient may fail DMARC. DKIM signing by delegation (two CNAME records) is coming.
What if Ascripto is down?
The relay signs from a local copy of your signatures, so the web app being down does not stop signing. If signing itself cannot happen, the default is to pass the message on without a signature and log it; a workspace that needs the opposite (hold the message for Exchange to retry, because the signature carries a legally required disclaimer) can ask for that. Routing never guesses: an unknown domain is refused temporarily and Exchange retries.
Several domains?
Add each verified domain in Settings → Delivery and run the setup again; the rule names them all.
How do we stop?
Switch the rule off in Exchange first, then remove the domains in Ascripto, then delete the connectors and rule and revoke the app in Entra. The admin guide has the order and the commands.
Signatures and the editor
Block constructor or HTML editor?
The block constructor is for most people: pick blocks, type @ for fields, and Ascripto writes markup that renders in every mail client. The HTML editor (Business) is for people who have markup already or want full control; converting a signature to HTML is one-way, except by restoring an earlier version.
Why can’t I use our brand font?
Mail clients only show fonts installed on the recipient’s device, so the Brand kit offers the families every client has. Your logo carries the brand.
What is the size meter?
The weight of the signature with its images, against the limit mail clients handle comfortably. Amber warns; red blocks publishing and names the image to shrink. Ascripto compresses every image on upload and shows before and after.
Why can’t I upload my own social icons?
They come from a built-in set in three styles, which keeps them sharp, small and consistent; the addresses they link to are yours, from the Brand kit.
Does the signature look right in dark mode?
The editor’s canvas always stays light, because recipients' inboxes are not themed by you. A dark-mode preview is planned; meanwhile the Brand kit has logo slots for dark backgrounds.
Can the signature differ per person?
Yes: fields come from each person’s directory record, with per-person overrides on People, and a field that is empty for someone can leave its line out or show something else.
Where do legal disclaimers go?
Today: as text in the signature (a Disclaimer block, or a text block), targeted with a rule such as Email domain is yourcompany.de or Location is Berlin. Disclaimers as a separately targeted object, so three signatures and four countries do not need twelve designs, are coming.
Can I test a signature without deploying it?
Yes. The canvas is the real signature for a real person; Preview as shows it for anyone. Nothing reaches a mailbox until a deploy. A Send a test to me button is planned.
Publish versus deploy?
Publishing records a design as a version. Deploying writes signatures into Gmail. On Microsoft 365 a published design reaches the relay by itself.
People and your directory
Where do names, titles and phone numbers come from?
Your directory: Google Workspace or Microsoft 365. Ascripto picks up changes as they happen: Google Workspace reports each one, and Microsoft 365’s are read every minute. People do not log in to Ascripto; administrators fix a wrong value by overriding it on People, and the directory cannot overwrite an override.
Can I add a field the directory doesn’t have?
Yes: Settings → Fields → Add a field (pronouns, booking link, office). Custom attributes your directory already supplies are offered there too.
What happens when someone leaves?
Their record goes to a recycle bin (7 days by default, up to a year) and Ascripto stops touching their mailbox; nothing is cleared. If they come back within that time they return as they were. They cost nothing.
Why does a suspended person show?
Because the directory still lists them. They are not written to and not counted.
Campaigns
What is a campaign?
A banner in the campaign block of people’s signatures, for a while, with an optional link. Campaigns are on Business.
What size should the banner be?
600×100 as people see it. An animated GIF keeps moving, up to 200 KB; Outlook on Windows shows only its first frame.
What do the results count?
Clicks by people in browsers, largest; people reached; and banner loads as an estimate, never called “opens”. Clicks by security scanners and other software, and clicks after the campaign ended, are shown apart and never added in.
Why are per-person results off?
Because clicks per person can read as monitoring employees, which in Germany and elsewhere may need a works council’s agreement first. Any administrator can switch them on in Settings → Results with a reason that is kept.
Do tracked links keep working?
After a campaign ends, yes. If the workspace is deleted, no.
Security and privacy
Where is our data?
On Microsoft Azure in Germany West Central (Frankfurt), with credentials in Azure Key Vault in the same region. Transactional email is sent from Ascripto’s own mail server in the EU. Payments are Stripe’s. Brand images are served publicly from img.ascripto.com, because recipients' mail clients must load them.
Do you read our email?
No. On Google Workspace, Ascripto reads and writes signatures only, never mail. On Microsoft 365, message content passes through the relay in transit and is not stored; the message log keeps sender, recipients, Message-ID, time and outcome, never the subject or content.
Who at Ascripto can see our data?
Nobody browses it. Support can see a workspace’s data only through a support grant that is time-limited, carries a reason, is recorded and is visible to you. Every staff account uses multi-factor authentication.
Is there a DPA?
Yes, at ascripto.com/dpa/: Article 28 GDPR, part of the terms, no separate signature. Sub-processors (Microsoft Azure; Stripe only receives a seat count and is not one) and retention periods are listed there and in the privacy policy at ascripto.com/privacy/.
How long is data kept, and can we take it with us?
While the workspace exists, with periods per kind (message log 10 days, signature history 90 days, administrator audit 13 months). When you leave, your data is exportable for 30 days and then deleted. Backups are kept 30 days.
How are passwords stored?
As one-way hashes. Most accounts have no password at all: they sign in with Google or Microsoft, whose 2-step verification applies.
Your account
Which ways can I sign in?
Google, Microsoft, or an email address and password. Link several under Account & security; the last way in cannot be removed.
I lost my phone and the authenticator app.
On the 2-step screen, Use a recovery code instead. If the codes are gone too, write to hello@ascripto.com; a staff reset is audited and reason-required. Google and Microsoft sign-ins recover through those providers.
I forgot my password.
Forgot password on the sign-in page sends a link that works for a short while. The page says the same thing whether or not an account exists, on purpose.
Can I sign out of every device?
Account & security → Sign out everywhere. Changing a password does it too.
Can I change my email address or delete my account?
Not yet from the app; write to hello@ascripto.com. Most accounts take their address from Google or Microsoft. Removing an administrator from a workspace is in Settings → Team.
Troubleshooting
“Google refused to open the mailboxes. Signature access may have been withdrawn.”
The domain-wide delegation entry is missing. Settings → Connections shows the client ID and scope to re-add; the check runs again by itself.
Step 3 says “Not allowed yet” long after the super admin clicked Authorize.
Google can take minutes, occasionally longer. Check the client ID and the scope were pasted exactly, with nothing added. Check now forces a check.
“That Google account can’t read your directory” / “needs a Global Administrator”.
The account used is not an administrator of the right kind. Sign in to Google or Microsoft as one, or invite one from the same step; they get a link that works seven days.
“This Google Workspace is already connected to another Ascripto workspace.”
A colleague connected it. Ask them to invite you in Settings → Team.
The directory read failed.
Settings → Connections says why in words, and Reconnect appears when it is yours to fix (for example the consenting administrator left). Otherwise it retries by itself.
The deploy stopped before everyone was written.
The page shows how far it got and why: access withdrawn, the free plan, or an error on Ascripto’s side that retries. Run it again; mailboxes already current are left alone.
Microsoft 365: “No mail from it has reached Ascripto in N days.”
The rule is not sending that domain’s mail to Ascripto. Run the setup again, then Check the setup to see what differs.
The message log says “Not signed”.
The reason is beside it: the sender is not a person in your directory with a signature, the mail was encrypted or digitally signed, it was a bounce, or the relay did not have your signatures yet (a new workspace, before the first publish reaches the relay). Sent without a signature means signing did not answer in time; it should be rare, and the mail was delivered.
“Exchange doesn’t have everything the setup sets.”
The list names each difference. Run the setup again; it sets each item back without duplicating anything.
The setup page shows an AADSTS error.
Microsoft refused the sign-in or consent. The page says what was and was not changed (nothing, if it failed before the first step), and the script always works as the alternative.
My invitation link has expired.
Links work for seven days. Ask the person who invited you to send another; the old one stops working the moment a new one is made.
Still stuck: hello@ascripto.com, with your workspace’s domain and, for mail questions, the Message-ID or the time the message was sent.