01Encrypted at rest
A database leak is not a mailbox key.
Google refresh tokens are encrypted with AES-256-GCM before storage. The encryption key lives separately in the runtime environment.
Security is part of the workflow
Trust should be inspectable, not implied.
Bump asks for sensitive Gmail access because it has a sensitive job. Here is the boundary around that access, the data that persists, and the controls that remove it.
Google access boundary
Two Gmail scopes. Nothing broader.
Read recent sent threads
gmail.readonlyFind unanswered conversations and check for a reply. Cannot delete, archive, label, or edit mail.
Send the draft you approve
gmail.sendDeliver one reviewed follow-up in the original thread. No background or bulk sending.
AES-256-GCM
Token encryption
0
Automatic sends
Self-serve
Disconnect & delete
The operating rules
Four promises the architecture has to keep.
02Tenant isolated
Every protected query belongs to one tenant.
Customer records carry a user ID, service calls scope every query to it, and database cascades erase the full tenant when an account is deleted.
03Human approval
A draft is never permission to send.
Automatic scans can prepare a queue. They cannot send it. Bump checks the Gmail thread again immediately before an approved send.
04Self service
Leaving is a product feature.
Settings includes portable JSON export, Gmail disconnect, notification controls, and permanent account deletion without a support ticket.
Processing, minimised
What leaves the product boundary?
Relevant thread text is sent to Anthropic to generate and verify drafts. Google credentials are never included. Stripe receives billing data only when you purchase Pro. Resend receives your account email, first name, and content-free counts only when enabled notifications are delivered.