How We Protect Your Data

1. AES-256 Encryption (Industry Standard)

We encrypt all sensitive data using AES-256-GCM, one of the strongest encryption algorithms available today. This includes:

• OAuth access tokens and refresh tokens
• API credentials from connected tools (Gmail, Drive, Outlook, WhatsApp, etc.)
• Any other sensitive connector data

AES-256 is widely used by governments, financial institutions, and leading technology companies.

2. Envelope Encryption with Google Cloud KMS

We don't just use a static encryption key. Instead, we use envelope encryption powered by Google Cloud Key Management Service (KMS):

• A unique Data Encryption Key (DEK) is generated for each sensitive record.
• This DEK is used to encrypt your data using AES-256-GCM.
• The DEK itself is then encrypted using a Key Encryption Key managed securely in Google Cloud KMS.
• Only the encrypted DEK and encrypted data are stored in our database.

This means even if someone gains access to our database, they cannot decrypt your data without access to our KMS keys.

3. Data Never Stored in Plaintext

We never store sensitive information (like access tokens) in readable form. All sensitive fields are encrypted before being written to Firestore.

4. Secure Key Management

• Encryption keys are managed exclusively through Google Cloud KMS.
• Access to these keys is strictly controlled using IAM policies.
• We follow the principle of least privilege — only necessary services can decrypt data.

5. Additional Security Measures

• All data is encrypted in transit (TLS 1.3) and at rest.
• We use short-lived credentials and regularly rotate secrets.
• Our infrastructure runs on Google Cloud with strict network controls and monitoring.
• We never train AI models on your private operational data.