What the app can reach
Signifier asks for the smallest set of Google permissions that lets it do its job, and nothing else. A Google Workspace administrator grants them once, for the organization; individual employees are never asked to install or approve anything.
| Can reach | Cannot reach |
|---|---|
| Directory profiles (names, titles, departments, phones, photos, OUs, groups), read only | The content of anyone’s email, sent or received |
| Gmail signature settings, read and write | Calendar, Drive, Contacts, Chat, Meet |
| Send-as aliases, to set their signatures | Passwords, 2-step verification, or any admin setting |
The exact OAuth scopes are listed on the consent screen when you connect, and in our privacy policy.
Google verification
Apps that use restricted Gmail scopes must pass Google’s OAuth verification and an independent security assessment (CASA) before they can be used widely. Signifier’s status: [VERIFICATION STATUS, e.g. “Verification submitted on DATE; until it completes, the consent screen shows an unverified-app warning and the app is limited to 100 users”]. We will update this line as it changes.
Revoking access
An admin can disconnect Signifier at any time, in two places: from the Connections page in the app, or from the Google Admin console under Security → API controls → Manage third-party app access. Either one stops all access immediately. Signatures already written into Gmail stay as they are until someone changes them. We delete the directory data we hold within [NUMBER OF DAYS] days.
How data is stored and protected
- In transit: every connection to the website, the app and Google uses TLS 1.2 or newer. Plain HTTP is not served.
- At rest: data is encrypted at rest by our storage provider, [DATABASE AND STORAGE PROVIDER], in [REGION].
- Google tokens: stored encrypted with a key kept apart from the database, never shown in the app or in logs, and deleted when you disconnect.
- What we keep: the directory fields the signature needs, your templates, click counts and the audit log. We do not keep copies of anyone’s email.
- Backups: encrypted, and purged of deleted data within [NUMBER OF DAYS] days.
Who at Signifier can see your data
Production access is limited to the engineers who run the service, uses individual accounts with two-step verification, and is logged. Nobody reads customer data unless a support request or a security investigation requires it, and then only as much as that needs. Staff with access are bound by confidentiality obligations.
Inside the app
- Roles: admins, editors and viewers. Only admins can connect or disconnect Google Workspace, change locked parts of a template, or publish to everyone.
- Audit log: every change that affects signatures is recorded with who made it and when, and admins can read it.
- Sign-in: with Google, or with email and a password that is hashed and never stored in plain text.
- Click links: counted through a Signifier address that records the click and passes the recipient on. No cookie is set on recipients.
Hosting and providers
The website and the app run on Cloudflare, which also provides DDoS protection and a web application firewall. Our other providers, and what each is used for, are listed in the privacy policy. We review each provider’s security documentation before using it.
Certifications
Signifier does not yet hold SOC 2 or ISO 27001 certification. We will say so here the day we do, and not before. Our hosting provider publishes its own certifications on its trust site.
Incidents
If we learn of a security incident that affects your data, we will tell your admins without undue delay and within 72 hours of confirming it, with what happened, what data was involved, and what we are doing about it.
Reporting a vulnerability
If you find a security problem in Signifier, please tell us at [SECURITY EMAIL] before you tell anyone else. We will acknowledge within two working days, keep you informed, and will not take legal action against good-faith research that avoids customer data and service disruption. We publish a security.txt file with the same contact.