Data Security

How Iris protects your Gmail data and personal information

Security Architecture

Iris is built with a security-first approach. Your Gmail data is treated as sensitive at every stage of the pipeline — from authentication to audio generation.

OAuth Token Encryption

When you connect your Gmail account, Iris receives OAuth access and refresh tokens from Google. These tokens are the keys to accessing your Gmail data, so they are protected with strong encryption:

• Algorithm: AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode)
• Key management: The encryption key is a 32-byte secret stored as a server-side environment variable, never exposed to the client application or stored in the database
• Encryption format: Each encrypted token includes a unique initialization vector (IV) and authentication tag to prevent tampering
• At rest: Tokens are always stored in their encrypted form in the database — they are only decrypted in server memory when needed for a Gmail API call

Transient Email Processing

The most important security property of Iris is that raw email content is never persisted. Here is exactly what happens during episode generation:

1. The server decrypts your stored OAuth tokens in memory
2. It calls the Gmail API to fetch recent newsletter emails (body text truncated to 3,000 characters per email)
3. The email content is immediately passed to the AI summarization service
4. The AI returns a generated script summarizing the newsletters
5. The raw email content is discarded — it exists only in server memory for the duration of the request
6. Only the AI-generated script and resulting audio are stored

At no point is the original email body text written to a database, file system, log, or cache.

Database Access Controls

Iris uses Row-Level Security (RLS) policies on every database table to ensure users can only access their own data:

• Profiles: Each user can only read and update their own profile
• Alarms: Users can only view, create, and modify their own alarms
• Audio episodes: Users can only access episodes generated for them
• Gmail credentials: Users can read their own credential metadata, but only the server-side service role can write or modify encrypted tokens
• Saved articles: Users can only access articles they saved

Audio File Storage

Generated audio episodes (MP3 files) are stored in a private storage bucket with per-user access restrictions. Each user's audio files are stored in an isolated directory, and storage policies ensure:

• Users can only access files in their own directory
• Files cannot be accessed without authentication
• Episodes are automatically deleted after their retention period (3 days for free users, 14 days for Pro users)

Third-Party Data Sharing

Newsletter email content is shared with one third-party service for the core functionality of the app:

Raw email content is not shared with any advertising, analytics, or data brokerage services.

What Iris Does NOT Do

• Does not store raw email content in any database or file system
• Does not access personal correspondence — only newsletter emails matching quality filters
• Does not send, delete, modify, or draft emails (read-only access)
• Does not use Gmail data for advertising, profiling, or market research
• Does not allow human access to your email data
• Does not log or cache email content
• Does not share data with advertising networks or data brokers

Data Retention

Reporting Security Issues

If you discover a security vulnerability, please report it to info@joiniris.dev. We take all reports seriously and will respond promptly.