Last reviewed: August 2026
ReplyConductor connects to your Gmail account, so we treat account security and data protection as core product requirements, not an afterthought. Here's what's actually in place.
ReplyConductor requests restricted Gmail scopes
(gmail.modify, gmail.send,
gmail.settings.basic) to classify and reply to email on
your behalf. Google requires apps using these scopes to pass a
CASA (Cloud Application Security Assessment) Tier 2
review, conducted by an independent, Google-authorized security lab
against the OWASP ASVS standard. ReplyConductor has completed this
assessment and received its Letter of Validation, confirmed by Google.
Personally identifiable information — account details, processed-email metadata, and related records — is encrypted at rest using AES-256-GCM. Encryption keys are managed through Google Cloud KMS envelope encryption, so the key used to protect your data is never stored alongside it.
ReplyConductor never asks for your Gmail password. Access is granted entirely through Google's OAuth flow, scoped to only what the product needs. You can review or revoke ReplyConductor's access at any time from your Google Account permissions page — no need to contact us.
If you have a security question or want to report a concern, contact us at [email protected].