Glossary
Last reviewed 16 October 2026
Plain-language definitions of the words Ascripto and these pages use. Where a word has a vendor’s own meaning, that is given too.
Ascripto’s own words
| Term | Meaning |
|---|---|
| Workspace | Your company’s place in Ascripto, named after its domain. It belongs to the company, not to the person who created it. |
| Owner | The person who created the workspace. Chooses and pays for the plan; cannot be removed. |
| Administrator | Anyone invited to manage the workspace: signatures, People, other administrators. Invited in Settings → Team. |
| People | Everyone in your directory. They never log in to Ascripto; administrators manage their signatures. |
| Directory | The list of people your company keeps in Google Workspace or Microsoft 365, with names, titles, departments and phone numbers. Ascripto reads it; it never writes to it. |
| Signature | A design that produces each person’s signature from their directory record. “Jane’s signature” is what one person gets. |
| Default | The signature that reaches Everyone else: whoever no other signature’s rule matches. Always last. |
| Rule | The condition deciding who gets a signature or campaign: one or more lines, all of which must be true. Checked top to bottom, first match wins. |
| Coverage | Who gets what: the bar on Signatures showing how many people each signature reaches. |
| Field | A value a signature can show with @ and a rule can test: name, job title, phone, department, or one you define. |
| Override | A value set for one person by an administrator, which the directory cannot overwrite. |
| Brand kit | Your logos, font, colours and company profile links, referenced by every signature that does not set its own. |
| Library | Every image uploaded, with what it became after compression. |
| Slot | What an image is for (horizontal logo, square logo, badge, campaign banner). It fixes the size the image is shown at. |
| Block | One part of a signature in the block constructor: Name and title, Logo, Contact details, Social links, Text, Divider, Space, Badges, Disclaimer, Campaign, Attribution, Custom HTML. |
| Draft / version | The design as you edit it, saved by itself; publishing turns the draft into a numbered version. |
| Publish | Record a design as a version. Does not touch any mailbox. |
| Deploy | Write signatures into people’s Gmail (Google Workspace). On Microsoft 365 the relay applies the published design to outgoing mail instead. |
| Audit | Reading everyone’s Gmail signature and comparing it with the directory: who is off-brand and why. Home is the audit. Free. |
| Off-brand | A signature that does not carry what it should: missing, or without the name, title, work phone or logo. |
| Finding | One cause of being off-brand, as a row on Home. |
| Campaign | A banner in the campaign block of people’s signatures for a period, optionally linked and tracked. Business plan. |
| Campaign slot | The Campaign block in a signature. A campaign targeting people whose signature has no slot shows them nothing, and says so. |
| Attribution | The optional “Signature by Ascripto” line. Off by default, paid plans only. |
| Seat | A person whose signature Ascripto delivered in a month. What you pay per. |
| Trial | 14 days of Business, no card, once per workspace. |
| Relay | Ascripto’s mail server that adds signatures to Microsoft 365 mail on its way out and hands it straight back to Exchange Online. |
| Message log | Every message through the relay for the last 10 days: who, to whom, when, signed or not, delivered or not. Never the subject or content. |
| Fail-open / fail-closed | What the relay does when it cannot sign: send the message on without a signature (open, the default), or hold it for Exchange Online to retry (closed, on request). |
| Recycle bin | Where a person removed from the directory is kept (7 days by default) so they come back as they were if re-added. |
| Support grant | The only way Ascripto staff can see your data: time-limited, with a reason, recorded, visible to you. |
| Notice | A message at the top of the app about a condition that applies to your workspace, such as a suspension. It goes when the condition does. |
Google’s words
| Term | Meaning |
|---|---|
| Google Workspace | Google’s business suite: Gmail, the Admin console, the directory. |
| Admin console | admin.google.com, where administrators manage Google Workspace. |
| Administrator | A Google Workspace user with an admin role. Can consent to Ascripto reading the directory. |
| Super admin | The highest Google Workspace admin role. Only a super admin can grant domain-wide delegation. |
| Domain-wide delegation | A super admin allowing a service account to act on every user’s behalf for named scopes, under Security → Access and data control → API controls → Manage Domain Wide Delegation. How Ascripto reads and writes signatures. |
| Service account | A Google identity for software rather than a person. Ascripto’s has a client ID, shown on the page where it is needed. |
| Client ID | The number identifying Ascripto’s service account to Google. Pasted once by a super admin. |
| OAuth scope | The exact permission being granted, as an address. For signatures: www.googleapis.com/auth/gmail.settings.basic. |
| Org unit (organizational unit, OU) | Google Workspace’s tree of users, used for settings. A rule line Org unit is under /Sales targets it. |
| Append footer | Google’s native org-wide footer, added below whatever signature a user has. The usual cause of double signatures. |
| Mobile signature | A signature set inside the Gmail app on a phone, which overrides the account signature on that device and which no app can see. |
| Send-as address | An address a Gmail account can send from; the signature is a property of it. Ascripto manages the primary address’s. |
Microsoft’s words
| Term | Meaning |
|---|---|
| Microsoft 365 | Microsoft’s business suite: Exchange Online, Outlook, Entra. |
| Microsoft Entra ID | Microsoft’s directory (formerly Azure AD): the users behind every Microsoft 365 tenant. |
| Tenant | Microsoft’s word for one organisation’s Microsoft 365. Ascripto says your company or your organisation. |
| Global Administrator | The highest Microsoft 365 admin role. Can consent to Ascripto and set up mail flow. |
| Privileged Role Administrator | A role that can also consent to applications. Accepted for connecting the directory. |
| Exchange Administrator | The role that manages Exchange Online. Accepted for Set it up for me. |
| Admin consent | An administrator accepting an application’s permissions for the whole organisation, on Microsoft’s consent screen. |
| Enterprise application | How a consented app appears in the Microsoft Entra admin center, where its permissions can be reviewed and revoked. |
| Microsoft Graph | Microsoft’s API. Reads the directory well; cannot manage Outlook signatures. |
| Exchange Online | Microsoft 365’s mail service. |
| Exchange Online Protection (EOP) | Exchange Online’s mail gateway, which receives mail back from the relay and delivers it. |
| Connector | An instruction in Exchange Online for mail flow to or from another system. Ascripto’s setup makes one outbound (to the relay) and one inbound (from the relay, identified by certificate). |
| Mail flow rule (transport rule) | A rule Exchange Online applies to messages. Ascripto’s sends your domains' outgoing mail through the outbound connector once. |
| PowerShell | Microsoft’s command-line tool, on every Windows computer as Windows PowerShell. The setup script is pasted into it. |
| Exchange Online PowerShell module | ExchangeOnlineManagement, which the script installs the first time so it can talk to Exchange Online. |
| Verified domain | A domain Microsoft 365 has confirmed is your organisation’s. Only verified domains can be routed through Ascripto. |
| EWS (Exchange Web Services) | An older Microsoft interface some signature tools used. Being disabled in phases from October 2026 to April 2027. |
| Sent Items | The folder holding copies of sent mail. A relay-inserted signature is not in that copy, because it is added after Send. |
| winmail.dat (TNEF) | A format classic Outlook sometimes sends rich-text mail in. The relay leaves such messages unsigned rather than risk damaging them. |
| Message-ID | The unique identifier every email carries in its headers. What to search the message log by. |
Mail authentication
| Term | Meaning |
|---|---|
| MX record | The DNS record saying where a domain’s incoming mail goes. Ascripto never changes it. |
| SPF | A DNS record listing which servers may send mail for a domain. Unchanged by Ascripto, because Exchange Online still sends the final message. |
| DKIM | A cryptographic signature on a message proving it was not altered since signing. Exchange Online does not DKIM-sign mail returned through a connector; DKIM signing on the relay, by delegating two CNAME records, is coming. |
| DMARC | A policy that passes if SPF or DKIM aligns with the From address. Passes on SPF for relayed mail. |
| TLS | Encryption between mail servers. Required on both legs between Exchange Online and the relay. |
| S/MIME | End-to-end encryption or digital signing of a message. Such mail is never modified by the relay. |
Accounts and security
| Term | Meaning |
|---|---|
| 2-step verification (MFA) | A second proof at sign-in beyond the password. Handled by Google or Microsoft for those sign-ins; offered for password accounts as an authenticator app or an emailed code. |
| Authenticator app | An app producing six-digit codes (Google Authenticator, Microsoft Authenticator and others). The recommended second step for a password account. |
| Recovery code | A single-use code shown once when 2-step is set up, for when the phone is gone. |
| Session | One signed-in browser or device. Listed, and endable, under Account & security. |
| Linking | Adding another way to sign in to the same account (Google, Microsoft, password). Done while signed in; never by matching an email address. |
| DPA | Data Processing Agreement: the GDPR Article 28 contract under which Ascripto processes your directory and signatures for you. Part of the terms. |
| Sub-processor | A company Ascripto uses to provide the service and that may touch your data: Microsoft Azure (hosting). Stripe, which handles payments, only receives a seat count and is not one. Listed in the DPA. |