This Privacy Policy explains how &Secure, Inc. ("&Secure," "we," "us") collects, uses, and protects information when you use our website and the &Secure security platform (the "Service"). By using the Service you agree to this Policy.
Account information. Your name, work email, organization, and password (stored hashed) when you create an account, and records of members you invite.
Google user data (with your authorization). When a Google Workspace administrator signs in with Google and connects their organization, &Secure accesses the data below through Google APIs. Scope names are shown without the https://www.googleapis.com/auth/ prefix. Write access is used only to carry out an action an administrator explicitly requests in &Secure; scanning itself never changes your Workspace.
| Google scope | Data accessed | Why &Secure uses it |
|---|---|---|
| openid, email, profile | Your name, email address and profile picture | Sign you in to &Secure and identify your account. |
| admin.directory.user / .user.readonly | Directory user accounts: names, emails, org unit, admin status, 2-Step Verification enrollment, last sign-in, suspension state | Find risky accounts (admins without 2SV, dormant or former employees). If you turn on remediation, apply fixes you approve, such as removing admin rights from suspended accounts. |
| admin.directory.user.security | The third-party OAuth apps each user has authorized, and the scopes those apps hold | Inventory and risk-score connected apps. Revoke an app's access only when an administrator chooses to. |
| admin.directory.group / .group.member / .group.readonly | Groups and their members | Show who is entitled to which apps. If you use app entitlement, create groups and add or remove members when an administrator asks. |
| admin.directory.domain.readonly, .orgunit.readonly, .rolemanagement.readonly | Domains, organizational units, and admin role assignments | Check domain and email-authentication configuration, and who holds which admin privileges. |
| admin.reports.audit.readonly, admin.reports.usage.readonly | Admin and login audit events and usage reports (metadata only) | Detect suspicious sign-ins, risky admin changes and inactive accounts. |
| cloud-identity.policies / .policies.readonly | Organization security policy settings (e.g. sharing, session length, password and DLP policies) | Evaluate settings against security benchmarks. If you turn on remediation, create a baseline policy you approve. |
| chrome.management.policy / .policy.readonly | Chrome browser and device policy settings | Evaluate browser security settings. If you turn on remediation, apply policy changes you approve. |
| apps.alerts | Google Workspace Alert Center alerts | Show security incidents Google detected so you can triage them. |
What we never access. &Secure does not request access to, and does not read, the content of anyone's Gmail messages, Drive files, Docs, Chat or Meet conversations, or calendar events. Our access is limited to the administrative metadata and settings listed above.
Payment information. Subscriptions are processed by Stripe. We do not store your full card number; Stripe handles card data and returns limited billing metadata (e.g., subscription status) to us.
Usage data. Standard log and device information (IP address, browser, pages visited) to operate, secure, and improve the Service.
To provide and operate the Service (run security scans, generate findings and reports, apply remediations you approve); to authenticate you and secure your account; to process billing; to provide support; to send service and, where permitted, product communications; and to comply with legal obligations.
How we use Google user data. We use Google user data only to provide and improve the user-facing security features of &Secure described above: assessing your organization's security posture, showing findings and evidence, alerting you to changes, and carrying out actions you request. We do not use Google user data for advertising, do not sell it, do not use it to determine credit-worthiness or for lending, and do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.
Limited Use. &Secure's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We transfer Google user data to others only as needed to provide the Service, to comply with applicable law, or as part of a merger or acquisition with notice to you. Our staff do not read Google user data unless you give us permission for a specific support request, it is necessary for security purposes such as investigating abuse, or it is required by law.
We do not sell your personal information. We share it only with service providers ("sub-processors") that help us run the Service, under contractual confidentiality and data-protection terms:
We may also disclose information if required by law or to protect the rights, safety, and security of &Secure, our customers, or the public, and in connection with a merger or acquisition (with notice).
We keep your data for as long as your account is active and as needed to provide the Service. Google user data is kept as scan results (findings, settings snapshots and the inventory needed to show changes over time); some screens, such as people and administrators, read Google live and are not stored.
Disconnecting Google. When you disconnect a Workspace in &Secure, its stored OAuth tokens are deleted immediately and we stop accessing Google. You can also revoke &Secure's access at any time from your Google Admin console (Security → API controls) or at myaccount.google.com/permissions.
Deletion. When you remove a workspace, its data is kept for 30 days so it can be recovered, then permanently deleted. You may ask us to delete your account and all associated data at any time by emailing privacy@andsecure.com; we complete deletion within 30 days, except where the law requires us to keep a record.
We encrypt OAuth tokens at rest, restrict access on a least-privilege basis, and transmit data over TLS. No method of storage or transmission is perfectly secure, but we work to protect your information using industry-standard safeguards.
Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing (including under GDPR and CCPA/CPRA). To exercise these rights, contact us at the address below. For Workspace end-user data, the connecting organization is the controller and we act as its processor.
We use strictly necessary cookies to keep you signed in and to secure the Service. We do not use advertising cookies.
We may update this Policy from time to time. Material changes will be posted here with a new "last updated" date and, where appropriate, notified to you.
Questions about this Policy or your data? Email privacy@andsecure.com.