Security

AES-256-GCM encryption for stored credentials

OAuth tokens (Gmail access and refresh tokens) are encrypted with AES-256-GCM before being written to our database. Each token gets a unique 96-bit random IV and is authenticated with a GCM tag. The encryption key is stored separately in a secrets manager and never in source code or version control.

TLS everywhere

All data in transit between your browser, our servers, Google's APIs, and our database is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints with HSTS headers.

OAuth 2.0 — we never see your Gmail password

Myra connects to Gmail exclusively via Google's OAuth 2.0 flow. We never ask for or store your Gmail password. You authenticate directly with Google, and Google issues us a time-limited access token on your behalf.

Read-only access by default

Myra requests the minimum Gmail permissions needed: read access for fetching and summarizing email, and send access only for features you explicitly use (Reply, Unsubscribe). We do not request write or delete access to your inbox.

Tokens are never logged or exposed

OAuth tokens are decrypted only in-memory at the moment of a Gmail API call. They are never written to application logs, error tracking systems, or exposed in API responses. Tokens are stripped from all client-side state.

Raw email content is never stored

Email bodies and metadata are processed entirely in-memory during active requests. Only Only Myra's summaries are persisted, and those are auto-deleted after 30 days.

User-controlled access log

Every time Myra accesses your Gmail, the action is recorded in an audit log visible to you in Settings. You can see exactly what Myra did, when, and how many emails were involved.

Instant disconnection

You can revoke Myra's Gmail access at any time from Settings. Disconnecting immediately clears all stored tokens. You can also revoke access directly from your Google Account security settings at myaccount.google.com.

Regular security reviews planned

We conduct periodic reviews of our authentication flows, access controls, and data handling practices. We are working toward a formal third-party security audit.