Infrastructure Security
Data Security & Encryption Policy
Last updated: November 01, 2026
Security and privacy are the core pillars of the Gmail Automation Engine. We implement industry-leading technical and operational safeguards to protect your communications.
1. Tokenized Google OAuth 2.0 Security
We never see, ask for, or store your Gmail password. Authentication is performed directly via Google's secure OAuth 2.0 dialog.
- Tokens are encrypted and stored in private databases behind firewalls.
- Tokens can be revoked with a single click at any time.
2. Data in Transit and at Rest
- In Transit: All HTTP communications are encrypted using high-grade TLS/HTTPS (256-bit SSL).
- At Rest: Sensitive access credentials and webhook secrets are stored with cryptographic hashing and encryption.
3. Server-Side Protection
- CSRF Protection: Every state-changing request is guarded by cryptographic Anti-CSRF verification tokens.
- XSS & Injection Defense: All user inputs are sanitized and rendered using secure HTML entity escaping and parameterized SQL statements.
- Isolated Queue Workers: Background dispatch jobs run in segregated server processes with strict memory and execution limits.