Built by a security engineer.

• Tokens encrypted at rest

  Your Google OAuth token is encrypted with Fernet and stored as ciphertext, never in plain text. A key-version column is in place so keys can be rotated.

• Encrypted in transit

  Every request is served over HTTPS, with HSTS and strict security headers (CSP, no framing, nosniff) set in production.

• Least-privilege OAuth

  We request only the gmail.metadata scope: headers and labels, never message bodies. No send, no draft, no contacts during discovery.

• Consent and audit by design

  Nothing irreversible happens without an explicit, timestamped yes from you, and every agent action is written to an append-only audit log.

Found something? Reach out via the contact form.