Email to Extract

Your organisation's address

Every organisation has its own inbound address, shown on the Email page under Top nav → More → Email: {your-org-name}@inbound.dataextractor.io. Anyone who knows the address can technically send to it, so an incoming email is only processed when the sender is a teammate in your organisation, or a sender you have explicitly allowed.

An org admin or owner can change the local part (the {your-org-name} portion) once from the Email page, and can add or remove allowed senders there — either a single address such as ap@supplier.com, or a whole domain such as @supplier.com to allow anyone at that company.

Mail from anyone else is held as unmatched: the headers are kept but nothing is extracted and no attachment is stored. An admin can review an unmatched email on the Email page and click Allow sender to add it to the allowlist and re-run extraction on that same email, so nothing is lost while you wait to approve a new supplier.

Sender authentication (SPF/DKIM/DMARC)

The From address on an email is easy to fake, so a message that merely looks like it came from an allowed sender is not enough on its own. Every message to the org address is also checked against the authentication headers the receiving mail system stamped onto it: SPF, DKIM, and DMARC.

If a message's domain fails that check, it is held as unmatched with the reason 'failed sender authentication' — even if the From address matches a teammate or an allowed sender exactly. Allowing that sender does not help and does not re-run extraction, because the problem is the message's authentication, not the allowlist. The fix has to happen on the sender's side: ask them to resend from their normal, authenticated mailbox rather than a forwarding service or a tool that rewrites the From header.

The private forwarding address

Alongside the org address, every user also has a private forwarding address — a long, unguessable string at the same @inbound.dataextractor.io domain. Because it can't be found by guessing (unlike the org address, which is derived from your org's name), anything sent to it is processed with no sender check at all: no allowlist, no authentication requirement.

Treat this address like a password. It's meant for your own mail rules — for example, an inbox rule that auto-forwards anything from a specific vendor — not for sharing with a team. If you ever suspect it has leaked, regenerate it from the Email page; the old address stops working immediately and a new one takes its place.

What gets extracted

One inbound email can produce several extraction results, one per source: every supported attachment runs through extraction on its own, and so does the email body itself, when it looks like it holds an invoice.

Supported attachment types: PDF, Excel (.xlsx, .xls), CSV, JPEG/PNG/TIFF images, and nested email files (.eml, and Outlook's .msg format). An attachment in an unsupported format is listed on the Email page as skipped, with the reason shown.

The email body becomes its own extraction source when it contains an HTML table with money-like values (an invoice laid out directly in the email rather than attached as a file), or — when there is no supported attachment at all — when the body text itself is long enough to plausibly be a document. A short reply like 'see attached' is not treated as a document on its own.

Inline images inside the body (screenshots of a table pasted into the email, for example) are sent to the model alongside the body text so a line-items table that only exists as a picture is still read. A small inline image — narrower than 300px or shorter than 150px — is treated as a signature logo, a social icon, or a tracking pixel and is skipped automatically, never sent to the model and never listed as a source.

Statuses, and what to do for each

Each email on the Email page shows one overall status:

received — accepted and queued; extraction has not started yet. No action needed.

processing — extraction is running on one or more of its sources right now. No action needed; refresh in a moment.

completed — every source finished extracting. Open any source's link to review the values in the extractor.

partial — some sources finished and some failed (for example, one attachment extracted fine but another timed out). Expand the row to see which source failed and why, then use Retry failed sources — it only re-runs the ones that failed, leaving the completed ones untouched.

failed — every source failed, or there was nothing the pipeline could process. Expand the row for the error, fix the underlying issue if it's something on your end (an unsupported format, a corrupted file), and retry.

unmatched — held for a sender/recipient reason rather than a processing one; see the two sections above for what each reason means and what, if anything, you can do about it.

Limits

The inbound mail service accepts a message up to 40 MB in total, attachments included. A message over that size is rejected before it ever reaches the extraction pipeline — split a very large bundle into more than one email.

Supported attachment extensions: .pdf, .xlsx, .xls, .csv, .jpg, .jpeg, .png, .tif, .tiff, .eml, .msg. Anything else is skipped as unsupported.

Inline images have two separate budgets. Up to 8 inline images per email are sent to the extraction model, downscaled, with a combined budget of 10 MB after re-encoding — beyond either limit, additional images are dropped (largest-content-first is not guaranteed; images are kept in the order they appear in the email). Separately, the email viewer itself embeds up to 8 MB of inline images total (2 MB per single image) when rendering the body for you to look at — a part beyond that cap is shown as a placeholder in the viewer, not as a broken image, and does not affect what was sent to the model for extraction.

Troubleshooting

Nothing arrived at all. Check the address is exactly right — a typo in the local part or the @inbound.dataextractor.io domain both fail silently from the sender's point of view (mail servers don't always bounce a misdirected message quickly). Confirm you're sending from a teammate's mailbox or an address on the allowlist.

Stuck as unmatched with 'not a teammate or an allowed sender'. Add the sender's exact address, or their whole domain, to Allowed senders on the Email page, then use Allow sender on that email to also retry it immediately.

Stuck as unmatched with the authentication reason. This is not fixed by allowing the sender — see the Sender authentication section above. Ask the sender to resend from their normal, authenticated mailbox.

An attachment is missing from the results. Check it's a supported extension (see Limits above); an unsupported attachment is listed as skipped with the reason, not silently dropped.

A source keeps failing on retry. Open it and read the error under the failed source — a repeatedly corrupted or password-protected file needs a fixed copy resent as a new email, since retrying re-runs the same original attachment.