Security

LAST UPDATED: 16 JUNE 2026

We take the security of your data seriously. This page describes the practices we follow to protect your information and how you can manage your data and access. For security-related questions, contact us at gyurovik@gmail.com.

1. Encryption

In transit

All data transferred between your browser and Perpetuity's servers is encrypted using TLS 1.3. This applies to the web application, API calls, and any webhook communications.

At rest

Data stored in our database infrastructure is encrypted at rest using AES-256, provided by Supabase. OAuth tokens and other credentials are stored in encrypted form and are never exposed to other users or returned to the browser.

2. Google Workspace Data

We access your Google Workspace data (Gmail, Calendar, Drive, Contacts) to operate your intelligence workspace. Our commitments regarding this data:

• Read-only where possible: we request write access only for Gmail (to send replies you have explicitly approved) and no other service
• No selling: we do not sell your Google Workspace data or personal information to any third party
• No advertising: we do not use your data for advertising purposes of any kind
• No model training: we do not use your Gmail, Calendar, Drive, or Contacts data to train, fine-tune, or improve any generalised AI model — including large language models. All AI processing of your workspace data generates outputs solely for your own account
• No unauthorised human access: staff do not access your workspace data except where required for security investigations or to comply with law
• Minimum necessary access: we request only the scopes required to deliver each feature. See our Privacy Policy for the full scope list

3. Infrastructure

Perpetuity is built on the following infrastructure providers, each operating under their own security and compliance programmes:

• Vercel — hosts the web application (perpetuity.works and app.perpetuity.works). Vercel operates global edge infrastructure with SOC 2 Type II compliance
• Railway — hosts the API server. Railway runs on AWS infrastructure in the us-west region
• Supabase — provides the database and authentication infrastructure. Supabase operates on AWS in the eu-west-1 (Ireland) region and is SOC 2 Type II certified

Your account data and workspace content are stored in Supabase's EU region where applicable. We do not control the precise geographic routing of individual API requests through Railway and Vercel's edge infrastructure.

4. Authentication and Access Controls

Google OAuth

Perpetuity uses Google OAuth 2.0 for authentication, managed through Supabase Auth. We do not store passwords. Your credentials are handled entirely by Google and Supabase — we never see your Google account password.

Per-account isolation

All data in the database is scoped to your account using row-level security policies. Your workspace data is not accessible to other users or accounts.

Token storage

OAuth access and refresh tokens are stored encrypted in the database. They are used server-side to access your Google Workspace data and are never exposed in the browser or returned in API responses.

5. Revoking Access and Deleting Your Data

Disconnecting Google

You can revoke Perpetuity's access to your Google account at any time from two places:

• From your Perpetuity dashboard under Connections, click "Disconnect" next to Google Workspace
• From your Google Account permissions page, remove Perpetuity from the list of connected apps

Disconnecting revokes our access immediately. We delete the stored tokens and will not make further requests to Google APIs on your behalf.

Account and data deletion

To request full deletion of your Perpetuity account and all associated data, email gyurovik@gmail.com from the address linked to your account. We will confirm receipt and complete deletion within 30 days.

6. Reporting a Security Issue

If you believe you have discovered a security vulnerability or suspect unauthorised access to your account, please contact us immediately:

gyurovik@gmail.com

We take all reports seriously and will respond promptly. We do not have a formal bug bounty programme at this time, but we are grateful for responsible disclosure.

Perpetuity · perpetuity.works