Security & data practices
This page is written for users and for Google's restricted-scope verification reviewers. It describes how Owed handles mailbox data.
Limited Use (Google)
The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is not used for ads, is not sold, is not used to train generalized models, and is not read by humans except as described in the Privacy Policy.
Encryption and tokens
- TLS 1.2+ in transit; AES-256 at rest for evidence excerpts, with per-user keys.
- OAuth refresh tokens are envelope-encrypted. Access tokens live in memory / short-lived cache only.
- Secrets live in a secrets manager. Tokens are never written to logs.
Minimization
Stage A filtering discards the majority of messages using metadata only. We persist extracted fields and short evidence excerpts, not full mailboxes. Raw candidate MIME may be cached up to 30 days for reprocessing, then deleted. Provider message IDs are kept so we can re-fetch while the connection is live.
AI processing
When an email needs language-model extraction, content is sent only to a zero-retention, no-training API. Email bodies are wrapped as untrusted data; instruction-like content is neutralized; outputs are schema-validated. Extracted strings are never executed or used as URLs to visit automatically.
Subprocessors (current engineering list)
- Cloud hosting (application, Postgres, object storage, KMS)
- Stripe (payments)
- Transactional email (Postmark or Amazon SES)
- ZDR LLM provider (Anthropic and/or OpenAI API with zero data retention)
Incidents
We maintain an incident-response runbook, including the FTC's 30-day breach notification path where it applies. Report issues to hello@owedagent.com.