Trust
Your Google does the work. We hold the config.
Employees’ browsers talk to Google with tokens minted by your OAuth client in your GCP project. Apps run on your Apps Script, the model on your Vertex AI billing, the audit trail in your Cloud Audit Logs. Applane’s backend never receives a Google access token, a line of app source, a prompt, or a row of your data.
- Apps run on
- Your Apps Script
- Model runs on
- Your Vertex AI
- Source in
- Your Drive
- Applane holds
- Config and seats
Ownership
Yours, not ours.
Applane never owns anything built with it. Nothing we run touches your data: no proxy, no storage, no model calls through us. Cancel the licence and the apps keep running; only the builder locks.
Yours
- The apps, as Apps Script projects in your Drive
- The source, with Google’s version history
- The data they read and write, in your Sheets, BigQuery and Firestore
- The deployments, on script.google.com under your domain
- The model usage, on your Vertex AI project
- The audit trail, in your Cloud Audit Logs
Ours
- The Chrome extension and the MCP bridge
- The agent, its prompts and its validator
- The app template and the governance rules
- The admin console and the licence backend
Data flow
Where each call goes.
Solid boxes hold data. Three things enter Applane: your domain name, a Google ID token used once to prove identity, and admin-console traffic.
Employee’s browser
Side panel and workspace tab. Chat history and drafts stay in this browser.
Your Google Workspace and GCP project
- OAuth client (Internal)yours, in your project
- Apps Script API + web appsthe apps
- Vertex AI · Geminithe model, your billing
- Drive · Sheets · Docs · BigQueryread as the viewer
- Cloud Audit Logsevery call, user-attributed
- Apps execute as the viewer. Blast radius = one person’s own permissions.
Applane backend
- Tenant configclient id, project id, admin group
- Seats and licensesbuilder emails, first and last seen
- Invoicesper seat, per year
Three things enter Applane: a domain string, an ID token that is discarded after verification, and admin-console traffic. Nothing else.
What we store
Config, seat emails, invoices.
| Data | Retention | Personal data |
|---|---|---|
| Company name, verified domains, plan | Life of contract + 30 days | No |
| Tenant config: OAuth client ID, GCP project ID, admin group, feature flags | Same | Group addresses only |
| Admin emails | Same | Yes |
| Builder emails, first and last seen, extension version | Same; reclaimed seats kept 12 months for invoice disputes | Yes |
| Seat events and admin actions | 12 months | Actor emails |
| Billing records | 7 years (Dutch bookkeeping law) | Billing contact, held by the payment provider |
| Server logs: request ID, path, status, IP | 30 days | IP address |
What we never receive
- Google access tokens or refresh tokens
- App source code, files or versions
- Prompts, chat history or agent transcripts
- Sheet, Doc, Drive, BigQuery or Firestore contents
- Who opens or uses a deployed app
- A copy of your app inventory
Enforced by the API contract: the session request has no field for anything else, and the ID token is discarded after verification.
OAuth scopes
What the extension asks for, and why.
Granted to your own OAuth client, never to an Applane client. Google’s classification is shown so your reviewer can map it to policy. Because the consent screen is Internal, no scope needs Google verification and no CASA assessment applies.
| Scope | Google class | Why |
|---|---|---|
| openid, emailnon-sensitive | non-sensitive | Sign the employee in and check that the account is a verified member of your Workspace domain. Any other account is rejected and its token revoked. |
| script.projectssensitive | sensitive | Create the Apps Script project for each app and push its files. The project is a Drive file owned by the builder. |
| script.deploymentssensitive | sensitive | Create and update the web-app deployment that gives each app its URL, and repoint it for publish and kill-switch actions. |
| script.processessensitive | sensitive | Read-only execution history, so the extension can tell a builder that a scheduled run failed. Without it that detector is silent. |
| spreadsheetssensitive | sensitive | Read sheet schemas while building, and let apps on the read-write tier write to sheets as the signed-in viewer. |
| drive.readonlyrestricted | restricted | List the apps shared with the builder and read the docs, slides and folders they point the agent at. Never write. |
| cloud-platformsensitive | sensitive | Call Vertex AI (Gemini) in your GCP project with the builder’s own identity, so usage is attributed and billed to you. |
Scopes are fixed by the extension build, not by the tenant. Per-tenant trimming is on the roadmap and needs the list to become configuration.
Admin controls
What IT can do without asking us.
- Your OAuth client
- The consent screen is Internal to your Workspace org, the client lives in your GCP project, and the grant shows under your project name in the Google Admin console. Revoke it per user there.
- Install policy
- Force-install or allowlist the extension by its fixed ID from Chrome management. A managed-storage policy can pin your tenant domain.
- Seats
- Open mode with a cap, or an allowlist of named people. Reclaim or block a seat at any time. Idle seats reclaim after 60 days.
- Org inventory
- Every published app is shared with your admin group by rule. Admins list apps, owners, audiences and collaborators from the extension, with their own identity. Nothing is copied to us.
- Kill switch
- Repoint any live app to a maintenance page. Reversible, URL preserved.
- Offboarding
- Drive ownership transfer moves a leaver’s apps to a successor. Source, versions and deployments survive.
- Audit
- Every Apps Script API and Vertex AI call is in your Cloud Audit Logs, attributed to the user. Our console exports our own records: config changes, seat events, admin actions.
Sub-processors
Hosting and invoicing, nothing else.
The backend is a small database and a few functions. Every processor is EU-hosted. We give notice before adding one, and the list is repeated in the privacy notice.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and backend functions (tenant config, seats, licenses) | Ireland (EU, eu-west-1) |
| Cloudflare | Network edge and static hosting for this site and the admin console | EU data localisation enabled |
| Stripe | Invoicing and payment processing | EU entity; Stripe holds the billing contact |
| PostHog | Product analytics on this website: page views and clicks on the sign-up and demo buttons. No session recording, no form contents, no identification of visitors | EU (eu.i.posthog.com) |
| Cloudflare Turnstile | Bot check on the demo form | Cloudflare, EU data localisation enabled |
| Email provider (to be named) | Transactional email (licence and admin notices) | EU |
Roles under GDPR
For builder and admin emails Applane is a processor acting for you; for the billing contact, a controller. Data stays in the EU. Tenant offboarding deletes all tenant rows within 30 days; billing records are kept as bookkeeping law requires.
DPA
A short data-processing agreement on the standard EU Article 28 clauses is available on request from day one. It lists the two data categories above, the sub-processors, EU hosting, 72-hour breach notification and deletion timelines. Your own paper can be reviewed for Enterprise.
Certifications
No SOC 2 report yet. The security reviewer’s pack is this page, the architecture documentation, the sub-processor list, the DPA, and a filled CAIQ-Lite questionnaire on request. A third-party penetration test is planned after the first annual contract.
FAQ
Questions IT asks first.
What does Applane store about us?
Your company name and verified domains, your tenant configuration (OAuth client ID, GCP project ID, admin group), the email addresses of admins and of people who have signed in to the builder with first and last seen dates, and your invoices.
We never receive Google access tokens, app source code, prompts, spreadsheet or BigQuery data, or the identity of anyone who only views an app.
Which Google scopes does the extension ask for?
Apps Script projects, deployments and processes (to create, push, deploy and watch apps), Sheets (to read schemas and write app data as the signed-in user), Drive read-only (to list apps and read the docs the builder points at), and cloud-platform (to call Vertex AI in your own project).
The grant is to your own OAuth client, so it shows up under your project name in the Google Admin console and you can revoke it per user. The full list with reasons is above.
Can we force-install it?
Yes. The extension has a fixed ID and a public Chrome Web Store listing, so it goes in the ExtensionInstallForcelist policy like any other. A managed-storage policy can also pin your tenant domain so employees never type it.
What does setup take?
About an hour with one person who has GCP and Workspace admin rights: a GCP project with billing (an existing one is fine), five APIs enabled, one IAM grant to a group, an Internal consent screen and a web OAuth client with one redirect URI, and a DNS TXT record to verify your domain. We provide a script for the GCP part and a checker that verifies the result.
In a company where those are three different people with ticket queues, expect one to two weeks, mostly waiting.
What happens if we stop paying?
The apps keep running. They are Apps Script projects in your Drive, deployed on script.google.com under your domain, and nothing about them depends on Applane. Only the builder locks: the extension, the admin console and the MCP bridge stop working at the end of the paid month, after a 7-day grace period.
There is no minimum term and nothing to export, because nothing of yours was ever with us. Subscribe again and the builder unlocks with everything still in place.
What if Applane’s backend is down?
Building, previewing and deploying talk to Google, not to us, so they keep working. The extension holds a licence that renews every three days and stays valid for seven more days offline. Existing seats are never blocked by a cap change or a lapsed renewal.