Security
How Selyf actually protects your Gmail access and account data: read-only OAuth scope, encrypted token storage, CSRF/CORS/session controls, and how AI calls are isolated from your credentials.
This page describes real, implemented controls — not aspirational claims. No system is risk-free, and we won't claim otherwise.
Gmail access
Read-only Gmail scope
Selyf requests exactly one Gmail OAuth scope: gmail.readonly. There is no code path anywhere in this product that can send, delete, or modify a Gmail message — not a missing feature, an absent permission.
Separate trust domains
The Google OAuth client (what lets you sign in) and the GCP service account (what receives Gmail’s push notifications) are two distinct credentials with distinct, narrow permissions — neither can be used to do the other’s job.
Encrypted token storage
Your OAuth refresh token is encrypted at rest with AES-256-GCM (a random IV per encryption) before it ever touches the database.
Application security
CSRF protection
State-changing actions (disconnecting Google, deleting your account) require a session-bound CSRF token, checked with a timing-safe comparison, on top of an independent Origin check.
Locked-down CORS
The API only accepts cross-origin requests from an exact, configured origin allowlist — no wildcards.
IDOR-safe data access
Every query for a thread, message, or analysis result is scoped to the requesting session’s own user id at the database layer — there is no request shape that can address another user’s data.
Rate limiting
Global and per-route rate limits apply across the API, with stricter limits on the Google-facing OAuth routes specifically.
No leaked internals in errors
API errors are mapped to a closed, documented set of error codes with generic messages — stack traces and internal detail never reach the client, and logs are redacted (both by key name and by value pattern) before anything is written.
AI request handling
Prompt-injection resistant by construction
Email content is only ever placed inside an escaped, delimited data block in the AI request — never concatenated into the system prompt, never treated as an instruction. This is covered by an automated test file, not just a design intention.
AI has no authorization authority
An AI analysis result is a suggestion. It cannot trigger a send, a delete, or any other action on your behalf — there is no code path that lets a model’s output cause a side effect beyond being displayed to you.
Independently validated output
Every AI response is checked against a strict schema on this server, separately from whatever validation the AI provider’s own SDK does — a malformed or unexpected response is rejected, not passed through.
No public webhook to spoof
Gmail push notifications are received by pulling from a Google Cloud Pub/Sub subscription, not by exposing an inbound webhook URL — there is no unauthenticated endpoint an attacker could send a forged notification to.
Managing your own account
You can disconnect your Google account or permanently delete your Selyf account and all associated data at any time from the Security page in your dashboard. Deleting your account is immediate — you don't have to wait for a retention window to run out.