Security at Barvol

Barvol is an early-stage startup. We have not completed SOC 2, ISO 27001, or any other formal third-party security certification. We do not claim those credentials, and we will not earn them until we have actually done the work.

What this page describes are the security measures we have actually implemented. We believe transparency is more useful than a badge.

All data in transit between your browser and Barvol is encrypted using HTTPS (TLS). Vercel, our hosting provider, enforces HTTPS across all routes — there is no unencrypted HTTP path to the application.

All data at rest — workspace content, integration data, and OAuth tokens — is stored in Google Firestore (Google Cloud). Google encrypts Firestore data at rest using Google’s platform-level encryption. Barvol does not manage encryption keys directly; this is handled by Google Cloud’s infrastructure.

Barvol uses Firebase Authentication for user identity. Passwords are never stored in plain text — Firebase Auth handles password hashing using industry-standard methods. Barvol never receives or stores your raw password.

Sessions are managed via a secure, HTTP-only cookie. Session validation is performed server-side on every authenticated request.

When you connect a Google service, Barvol uses Google’s OAuth 2.0 authorization flow. We request only read-only scopes — we never request permission to write, send, modify, or delete data in your connected accounts. The scopes we request are:

• gmail.readonly — email headers only (subject and sender).
• calendar.readonly — upcoming calendar events.
• analytics.readonly — aggregate website metrics.
• webmasters.readonly — aggregate search performance metrics.

OAuth access tokens and refresh tokens are stored in restricted Firestore subcollections. These subcollections are protected by Firestore security rules that prevent any client-side access — only server-side application code can read them. Tokens are refreshed server-side when they expire and are never exposed to the browser.

Barvol complies with the Google API Services User Data Policy, including the Limited Use requirements. See our Privacy Policy for the full Limited Use statement and per-scope data details.

Server-side data access in Barvol is enforced through two layers:

• Route-level authentication: all authenticated routes validate the session cookie on every request before returning any data. An invalid or missing session receives an error response.
• Workspace isolation: every data operation includes the authenticated user’s workspace identifier. Users can only access their own workspace data — there is no mechanism for one user to request another user’s data through the application layer.

Barvol team access to production data is limited and used only for operational and support purposes. We do not browse user workspace content or connected integration data as part of routine operations.

All API keys, OAuth client credentials, and webhook secrets are stored as environment variables in Vercel’s encrypted environment configuration. No credentials are hardcoded in the codebase. Secrets are not logged.

Barvol uses Groq as its AI provider for product features. Groq’s terms of service prohibit training their models on API inputs. Specifically:

• Gmail summaries: email subject lines and sender names (no body content) are sent to Groq to classify which emails may warrant a founder’s attention. Only the classification result is stored — the raw header list is not persisted.
• Other AI features: journal entries and workspace content you submit for analysis are processed by Groq to generate responses within your workspace. This data is not retained by Groq under their API terms.

Barvol does not use your data to train its own AI models. There are no Barvol-trained models derived from user content.

Barvol runs on the following infrastructure:

• Vercel: application hosting and edge delivery. Vercel applies platform-level DDoS protection and manages TLS termination.
• Google Cloud (Firestore, Firebase Auth): database and authentication. Google Cloud operates with its own extensive security controls, certifications, and compliance programmes.

Barvol inherits the security controls of these providers at the infrastructure level. This does not mean Barvol itself holds their certifications — we rely on their underlying security rather than operating our own data centres.

Barvol does not currently hold formal third-party security certifications. We are an early-stage startup and have not completed:

• SOC 2 (Type I or Type II)
• ISO 27001
• ISO 27701
• Independent penetration test certification

We are designed to respect applicable data protection principles and handle user data responsibly. Formal audits and certifications are part of our roadmap as the product and team grow.

Our infrastructure providers (Google Cloud, Vercel) hold their own extensive certifications, which you can review on their respective security and compliance pages.

Barvol does not currently have an in-product account deletion flow. To request deletion of your account, workspace data, or specific integration data (including data synced from Google services), email privacy@barvol.online. We process deletion requests within 30 days.

Disconnecting a Google integration from Settings stops future syncing but does not automatically delete previously synced data. Contact us to request immediate deletion of previously synced data.

If you discover a security vulnerability in Barvol, please report it responsibly. We ask that you:

• Email your findings to security@barvol.online.
• Include a clear description of the vulnerability, steps to reproduce, and potential impact.
• Give us reasonable time to respond and address the issue before public disclosure.
• Do not access, modify, or exfiltrate data belonging to other users as part of your research.

Barvol does not currently operate a paid bug bounty programme. We will acknowledge responsible disclosures and credit researchers where permitted.

For security-related questions or vulnerability reports:

• Security reports: security@barvol.online
• Privacy requests: privacy@barvol.online
• General contact: barvol.online/contact