Read-only Gmail scope
Sweep Tax requests exactly one Gmail scope: https://www.googleapis.com/auth/gmail.readonly. That scope can list and read messages and attachments. It cannot send mail, delete or trash messages, add or remove labels, change settings, or act as you in any other way. Sign-in with Google uses only the basic profile and email scopes.
A scan lists messages in the financial year you pick, runs a rule-based prefilter over sender, subject, attachment types and amounts, and fetches the full content only for messages that pass. Typically that is a small fraction of the mailbox.
Tokens and encryption
- Refresh tokens are encrypted at rest with AES-256-GCM using a key held only in the application's environment, never in the database or object store. Access tokens are short-lived and kept in memory for the duration of a scan.
- All traffic is over TLS — between your browser and us, and between us and Google, Anthropic, Stripe and storage.
- Sign-in is by emailed magic link or Google sign-in. We do not store passwords. Sessions are HTTP-only, secure cookies.
- Disconnecting a mailbox deletes its refresh token immediately.
Tenant isolation
Every business is a separate tenant. Every database query is scoped to the business you are a member of, and every API request re-checks your session and membership before touching a row. Members of one business cannot see another business's mailboxes, records or files, even if the same person owns both — they switch explicitly. Plan caps are enforced per account, not per business, so they cannot be worked around by creating businesses.
File storage
Source documents — PDFs, images and rendered email bodies — are stored in a private object-storage bucket with no public access. Files are served only through the app, to signed-in members of the owning business. Keys are namespaced by business so a file cannot be addressed from another tenant.
AI processing
Content that passes the prefilter is sent to Anthropic's Claude API for two narrow tasks: confirming a message is a receipt and extracting its fields. We send the text excerpt and attachment, not your identity. Under Anthropic's commercial API terms this content is not used to train models. Concurrency is limited per tenant and globally so a single large mailbox cannot starve others.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Anthropic | Receipt classification and extraction (Claude API) | United States |
| Gmail API and Google sign-in | Global | |
| Stripe | Payments, subscriptions and invoices | United States / Australia |
| Resend | Sign-in and transactional email | United States |
| Hosting and object storage | Application servers, Postgres database, receipt files | Per deployment — see below |
This deployment: the hosting region and object-storage provider for the instance you are using are stated by the operator on this page before the service is opened to customers. (Placeholder: application and database in Sydney, Australia; files in Cloudflare R2 with an Oceania location hint. The hint is best effort, so files are not guaranteed to stay in Australia.)
We will update this list before adding a sub-processor that handles Gmail content, and email account owners about the change.
Google verification and CASA status
gmail.readonly is a Google "restricted" scope. Apps that use it in production must pass Google's OAuth verification, including an annual independent security assessment (CASA Tier 2) and a review of how the app uses the data.
Status: Verification in progress — placeholder to be replaced by the operator with "Verified, CASA Tier 2 assessment completed on [date] by [lab]". Until verification is complete Google shows an "unverified app" warning during sign-in; the technical controls on this page apply regardless.
Data deletion
- A record: open it and choose Delete. The database row and its files are removed immediately.
- A mailbox: Settings → Mailboxes → Disconnect. The refresh token is deleted immediately; records already extracted stay until you delete them.
- A business: Settings → Businesses → Delete. All its mailboxes, records, files and memberships go immediately.
- Your account: Settings → Account → Delete account. Everything above, plus your user record and sessions, goes immediately. Stripe keeps invoices as required by tax law.
- Encrypted database backups roll off within 30 days.
You can also revoke our access at myaccount.google.com/permissions at any time. Steps are on the Support page.
Responsible disclosure
If you believe you have found a security issue, please email security@sweeptax.com.au with enough detail to reproduce it. We will acknowledge within 2 business days, keep you informed, and credit you if you wish. Please do not access other customers' data or run automated scanners against the production service.