We guard your Google account like our own.
OAuth scopes are minimal, tokens live encrypted in the Vault, every query passes row-level security, and we never train AI on your data.
§ The pillars
Six things we get right so you do not have to worry.
OAuth scopes are minimal and revocable
We request only business.manage plus basic profile info. You can revoke access from your Google account settings any time - we detect the revocation within 30 minutes and gracefully stop.
Tokens encrypted at rest in Supabase Vault
Access and refresh tokens are stored in Supabase Vault with AES-256 envelope encryption. No Maporio employee can read them directly.
Row-level security on every table
Your workspace data is isolated at the database level. Even if an API endpoint had a bug, RLS prevents cross-workspace reads. Audited on every deploy.
No data selling, no AI training on your content
Your reviews, posts, and profile data are yours. We do not sell data, we do not train models on customer data, we do not share with advertisers. Period.
Backups and incident response
Daily encrypted Postgres backups with 30-day retention. Security incidents are disclosed to affected customers within 72 hours, per GDPR.
Delete everything in one click
Cancel and request deletion from Settings. We wipe your workspace, tokens, and associated data within 30 days. A copy of backups is purged within 90.
§ Compliance
What we actually comply with, and what is on the roadmap.
GDPR
Full data subject rights - access, rectification, erasure, portability. Data processing agreement available on request.
CCPA
California residents can request disclosure and deletion any time. We do not 'sell' personal information.
Google API Services User Data Policy
We comply with the Limited Use requirements for Restricted Scopes. Your GBP data is used only to provide the features you see in the dashboard.
SOC 2 (roadmap)
We built on SOC-2-compliant infrastructure (Vercel, Supabase, Railway). Formal Type I report planned for 2026 Q4 when customer count and deal size justify it.
Questions or need a DPA? Email security@maporio.com and we'll get you what you need.