Security

Pesterly requests exactly two meaningful scopes: gmail.send and drive.file.

Send-only mail. We can send messages you approve. We cannot read your inbox, your sent mail, your contacts, or any message. Google enforces this, not our goodwill. There is no scope in our grant that permits reading email, and our verification with Google is for these scopes alone.

Only files we create. drive.file means Pesterly can see and touch only the folders and files it created: the “Pesterly” folder your client uploads land in. The rest of your Drive is invisible to us, again enforced by Google.

You can revoke the entire grant at any time from your Google account's third-party access page, without asking us.

Client uploads go straight into your own Google Drive. The bytes pass through our server's memory and are never written to our disk or database; we keep only a pointer (file name, size, Drive id). If you stop paying us, your documents are already where they belong.

The Gmail refresh token is encrypted at rest with AES-256-GCM using a key that lives only in the server environment, never in the database. It is never logged and never returned by any API. Deleting a mailbox deletes the stored token; deleting your account deletes everything.

Passwords are hashed with bcrypt. Password reset links are single-use, expire in an hour, and are stored hashed, so a database read never yields a usable link. Changing or resetting a password revokes every other active session.

The upload link contains an unguessable token (128+ bits) and is the only credential a client needs, deliberately, so it works forwarded and on any device. Links are never indexed (enforced via robots and noindex), uploads are rate-limited and size-capped, executable file types are refused, and a completed request's page stops showing its contents after 30 days.

No card numbers (Dodo Payments, our merchant of record, processes payment directly). No document contents in our database. No OCR, no parsing, no AI reading of anything a client uploads. No reading of any email, ever: that is a product refusal with a certification cost attached, not a roadmap item.

Transport is TLS everywhere. The application and database run on hardened cloud infrastructure with access limited to the founders. Every database query is scoped to your firm's id. Tenant isolation is enforced in the data layer, not the UI.

Security questions or vulnerability reports: email contact@onboardhive.com. We answer fast and we don't shoot messengers.