Security Overview

Access Model

• Google account access is granted through OAuth 2.0 by the user.
• The app requests only the scopes required for Gmail invoice collection, Drive storage, and account identification.
• Connected accounts can be revoked by the user from Google Account permissions at any time.

Token Handling

• Access tokens and refresh tokens are stored server-side so the app can continue processing without forcing repeated sign-in prompts.
• Access tokens are refreshed automatically when they approach expiry.
• If Google rejects a refresh token, the app marks the account for re-authentication instead of continuing with invalid credentials.

Data Handling

• The app searches Gmail using user-defined invoice rules.
• Matching messages and attachments are processed to extract invoice files.
• Files are uploaded to a single app-managed Invoice Collector folder at the root of the user's Google Drive, organized into YEAR/MM subfolders.
• The app stores operational metadata (including the Google Drive ID of the app-managed folder and per-invoice identifiers) so it can avoid duplicate uploads and show saved file links back to the user.

Transport and Service Communication

• Google API communication uses HTTPS.
• The production deployment for this app uses HTTPS callback URLs hosted on pay4.us.
• OAuth callbacks are handled only on the configured production endpoints.

Operational Notes

• The app writes to Google Drive using the non-sensitive drive.file scope, which limits write access to files the app has created itself inside a single Invoice Collector root folder.
• The app also holds the restricted drive.readonly scope, used by the "Send to Rivhit" feature to read and download a month's documents (including files added manually) so they can be emailed to the user's accountant. It is read-only and never modifies or deletes files outside the app's own subtree.
• The app uses Gmail read-only access (gmail.readonly) for invoice discovery and attachment download, and never sends, modifies, or deletes email.
• gmail.readonly and drive.readonly are restricted scopes. This deployment uses them without a CASA Tier 2 assessment by remaining in Testing publishing status with the operator's own account as a test user; publishing to production would require verification and the assessment.

OAuth Submission Reference

The exact scope set, Cloud Console field values, scope justifications, and reviewer walkthrough used for this app's Google OAuth verification submission are maintained alongside the code and kept in sync with the production deployment. Summary:

• Production domain: pay4.us
• Authorized redirect URI: https://pay4.us/auth/callback
• Publishing status: Testing (operator's own account as test user). Testing-mode refresh tokens expire after ~7 days, so periodic Drive reconnect is expected. Production publishing is only needed to distribute the app to other users.
• Declared scopes: gmail.readonly (restricted), drive.file (non-sensitive), drive.readonly (restricted), userinfo.email (non-sensitive).
• Reviewer pages: Privacy Policy, Terms of Service, Google Access Explanation, Data Processing Agreement.
• Verification path: publishing to production would require restricted-scope review for Gmail and Drive read-only plus a CASA Tier 2 security assessment; avoided by staying in Testing mode.

Contact

Security, privacy, and OAuth review questions can be sent to nir.ashkenazi88@gmail.com.

Related pages:

• Privacy Policy
• Terms of Service
• Google Access Explanation