Trust
Your team’s work belongs to you.
Your apps, source code and business data stay in your Google environment. Your browser sends AI requests directly to Google through your company’s Cloud project. Applane never receives or stores your app data, code or prompts.
We keep account and billing information, admin activity and service logs to run Applane. Request logs include IP addresses and are kept for 30 days. This website also uses analytics and collects details you send through the demo form. The privacy notice explains what we keep. Read the privacy notice.
- Apps run on
- Your Apps Script
- Model runs on
- Your Vertex AI
- Source in
- Your Drive
- Applane holds
- Config and seats
Ownership
Keep what you build.
Your company owns the apps and their source code. They keep running if you cancel Applane. An active subscription is needed to build or change them with Applane.
Yours
- The apps, as Apps Script projects in your Drive
- The source, with Google’s version history
- The data they read and write, in your Sheets, BigQuery and Firestore
- The deployments, on script.google.com under your domain
- The model usage, on your Vertex AI project
- The audit trail, in your Cloud Audit Logs
Ours
- The builder and the MCP bridge
- The agent, its prompts and its validator
- The app template and the governance rules
- The admin console and the licence backend
Data flow
Where each call goes.
Solid boxes hold data. Three things enter Applane: your domain name, a Google ID token used once to prove identity, and admin-console traffic.
Employee’s browser
One tab at app.applane.dev. Chat history and drafts stay in this browser.
Your Google Workspace and GCP project
- OAuth client (Internal)yours, in your project
- Apps Script API + web appsthe apps
- Vertex AI · Geminithe model, your billing
- Drive · Sheets · Docs · BigQueryread as the viewer
- Cloud Audit Logsevery call, user-attributed
- Apps execute as the viewer. Blast radius = one person’s own permissions.
Applane backend
- Tenant configclient id, project id, admin group
- Seats and licensesbuilder emails, first and last seen
- Invoicesper seat, per year
Three things enter Applane: a domain string, an ID token that is discarded after verification, and admin-console traffic. Nothing else.
What we store
The records we keep.
| Data | Retention | Personal data |
|---|---|---|
| Company name, verified domains, plan | Life of contract + 30 days | No |
| Tenant config: OAuth client ID, GCP project ID, admin group, feature flags | Same | Group addresses only |
| Admin emails | Same | Yes |
| Builder emails, first and last seen, client version | Same; reclaimed seats kept 12 months for invoice disputes | Yes |
| Seat events and admin actions | 12 months | Actor emails |
| Billing records | 7 years (Dutch bookkeeping law) | Billing contact, held by the payment provider |
| Server logs: request ID, path, status, IP | 30 days | IP address |
What we never receive
- Google access tokens or refresh tokens
- App source code, files or versions
- Prompts, chat history or agent transcripts
- Sheet, Doc, Drive, BigQuery or Firestore contents
- Who opens or uses a deployed app
- A copy of your app inventory
Enforced by the API contract: the session request has no field for anything else, and the ID token is discarded after verification.
OAuth scopes
What the builder asks for, and why.
Granted to your own OAuth client, never to an Applane client. Google’s classification is shown so your reviewer can map it to policy. Because the consent screen is Internal, no scope needs Google verification and no CASA assessment applies.
| Scope | Google class | Why |
|---|---|---|
| openid, emailnon-sensitive | non-sensitive | Sign the employee in and check that the account is a verified member of your Workspace domain. Any other account is rejected and its token revoked. |
| script.projectssensitive | sensitive | Create the Apps Script project for each app and push its files. The project is a Drive file owned by the builder. |
| script.deploymentssensitive | sensitive | Create and update the web-app deployment that gives each app its URL, and repoint it for publish and kill-switch actions. |
| script.processessensitive | sensitive | Read-only execution history, so the builder can be told that a scheduled run failed. Without it that detector is silent. |
| spreadsheetssensitive | sensitive | Read sheet schemas while building, and let apps on the read-write tier write to sheets as the signed-in viewer. |
| drive.readonlyrestricted | restricted | List the apps shared with the builder and read the docs, slides and folders they point the agent at. Never write. |
| cloud-platformsensitive | sensitive | Call Vertex AI (Gemini) in your GCP project with the builder’s own identity, so usage is attributed and billed to you. |
Scopes are fixed by the build, not by the tenant. Per-tenant trimming is on the roadmap and needs the list to become configuration.
Admin controls
What IT can do without asking us.
- Your OAuth client
- The consent screen is Internal to your Workspace org, the client lives in your GCP project, and the grant shows under your project name in the Google Admin console. Revoke it per user there.
- Seats
- Open mode with a cap, or an allowlist of named people. Reclaim or block a seat at any time. Idle seats reclaim after 60 days.
- Org inventory
- Every published app is shared with your admin group by rule. Admins list apps, owners, audiences and collaborators from the builder, with their own identity. Nothing is copied to us.
- Kill switch
- Repoint any live app to a maintenance page. Reversible, URL preserved.
- Offboarding
- Drive ownership transfer moves a leaver’s apps to a successor. Source, versions and deployments survive.
- Audit
- Every Apps Script API and Vertex AI call is in your Cloud Audit Logs, attributed to the user. Our console exports our own records: config changes, seat events, admin actions.
Sub-processors
Who helps us run Applane.
These providers support our accounts, billing, website and communications. They do not host your apps or receive your app data through Applane. Their purposes and locations are listed below and in the privacy notice.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and backend functions (tenant config, seats, licenses) | Ireland (EU, eu-west-1) |
| Cloudflare | Network edge and static hosting for this site and the admin console | EU data localisation enabled |
| Stripe | Invoicing and payment processing | EU entity; Stripe holds the billing contact |
| PostHog | Product analytics on this website: page views and clicks on the sign-up and demo buttons. No session recording, no form contents, no identification of visitors | EU (eu.i.posthog.com) |
| Cloudflare Turnstile | Bot check on the demo form | Cloudflare, EU data localisation enabled |
| Email provider (to be named) | Transactional email (licence and admin notices) | EU |
Roles under GDPR
For builder and admin emails Applane is a processor acting for you; for the billing contact, a controller. Data stays in the EU. Tenant offboarding deletes all tenant rows within 30 days; billing records are kept as bookkeeping law requires.
DPA
A short data-processing agreement on the standard EU Article 28 clauses is available on request from day one. It lists the two data categories above, the sub-processors, EU hosting, 72-hour breach notification and deletion timelines. Your own paper can be reviewed for Enterprise.
Certifications
No SOC 2 report yet. The security reviewer’s pack is this page, the architecture documentation, the sub-processor list, the DPA, and a filled CAIQ-Lite questionnaire on request. A third-party penetration test is planned after the first annual contract.
FAQ
Before your team gets started.
What does Applane store about us?
We keep account and billing information, admin activity and service logs to run Applane. Request logs include IP addresses and are kept for 30 days. This website also uses analytics and collects details you send through the demo form. The privacy notice explains what we keep.
We never receive Google access tokens, app source code, prompts, spreadsheet or BigQuery data, or the identity of anyone who only views an app.
Which Google scopes does Applane ask for?
Apps Script projects, deployments and processes (to create, push, deploy and watch apps), Sheets (to read schemas and write app data as the signed-in user), Drive read-only (to list apps and read the docs the builder points at), and cloud-platform (to call Vertex AI in your own project).
The grant is to your own OAuth client, so it shows up under your project name in the Google Admin console and you can revoke it per user. The full list with reasons is above.
Is there anything to install?
No. Applane runs at app.applane.dev in Chrome or Edge. Nothing is pushed to laptops and there is no Chrome policy to set; access is controlled by who is in your builders group.
What does setup take?
About an hour with one person who has GCP and Workspace admin rights: a GCP project with billing (an existing one is fine), five APIs enabled, one IAM grant to a group, an Internal consent screen and a web OAuth client with one redirect URI, and a DNS TXT record to verify your domain. We provide a script for the GCP part and a checker that verifies the result.
In a company where those are three different people with ticket queues, expect one to two weeks, mostly waiting.
What happens if we stop paying?
Your apps keep running in your Google environment. You keep their source code in Drive. After your subscription and grace period end, you can no longer build or change apps with Applane.
You don’t need to export your apps to keep them. Subscribe again whenever you want to use the builder.
What if Applane’s backend is down?
Building, previewing and deploying talk to Google, not to us, so they keep working. The builder holds a licence that renews every three days and stays valid for seven more days offline. Existing seats are never blocked by a cap change or a lapsed renewal.