What we can access, what we store, and how it's protected.
A permission auditor should hold itself to the standard it audits by. This page is the plain-language version of how Drive Auditor handles your account and your data.
Google access scopes
Drive Auditor requests the minimum scope for what you're doing, in two stages:
| When | Scope | What it allows |
|---|---|---|
| At sign-in | drive.readonly + basic profile |
Reading file metadata and sharing information. Scanning uses only this scope, which cannot modify anything. |
| Only if you revoke | drive |
Removing (and restoring) permissions. Google shows a separate consent screen at that moment; if you never unshare, the app never asks for it. |
You can withdraw Drive Auditor's access entirely at any time from your Google account's third-party connections page.
How your credentials are handled
- OAuth tokens are encrypted at rest (Fernet symmetric encryption) before they're stored, and are decrypted only inside backend functions at the moment a Drive call is made. They are never sent to your browser and never logged.
- Your session is a signed token in an HttpOnly cookie. JavaScript can't read it, and the backend rejects it if anyone tampers with it.
- Sign-in uses OAuth state and PKCE to prevent cross-site-request forgery and code-interception attacks during the Google handshake.
What we store
- Your Google identity (name, email, avatar), used to show you your own scans and nothing else.
- Your encrypted Drive token.
- Your scan results: the folder tree structure and its sharing metadata (who holds which role on which file), plus scan status and history.
We never store file contents. A scan reads names, folder structure, and permissions, not what's inside your files.
Deleting a scan from your dashboard removes its report data from storage. Storage runs on Supabase (Postgres) with row-level security enabled; all access goes through the backend, and every query is scoped to the signed-in user.
Careful actions
- Every permission's original role is captured when you scan, before you ever revoke anything, so restoring it later is always possible. The restore is silent; the affected person gets no email.
- Bulk unshares get validated before they start, then run in the background with progress you can watch.
- Scanning is rate-limited per account to keep behavior predictable; rescans and retries are free.
Browser-side protections
HTTPS is enforced everywhere, and a strict content policy means no third-party scripts run on this site, not even for fonts. Nothing calls home just because you loaded a page.
Questions
If you see something that looks wrong, or want more detail than this page gives, ask. People who ask hard security questions are exactly who this product is for.