This page is maintained by the Othen team to answer common security and privacy questions about how the product handles your data. It's a description of our current practices, not an independent certification.
Your Google access
- Each person connects their own Google account. Othen never uses a shared account to read customer mail.
- Othen stores only an encrypted connection reference; Google tokens stay with our connection provider.
- Each connection attempt is tied to the signed-in person who started it and expires after 15 minutes.
- Disconnecting in Settings revokes the connection. You can also remove access in your Google account.
What the software can and cannot do
- Every Google request passes through one checked list of allowed actions. Sending, deleting, archiving, moving and sharing are not on it.
- Before each change, Othen re-checks that you have not paused it, that the account is still connected, and that the target is your chosen label or folder.
- Email and document text is treated as information, never as instructions.
- Each change carries a marker so an interrupted attempt is found rather than repeated. If Othen cannot tell whether a change was saved, it asks you instead of retrying.
Data isolation
- Every table with your data is locked to your account. Plan, trial and profile status can only be changed by our server.
- All traffic uses TLS; stored data and backups are encrypted at rest.
AI provider
Drafts and document reading use an AI model through our AI provider. Your content is not used to train models. AI can still be wrong, so drafts wait for you to review.
Certifications
Othen does not currently hold certifications such as SOC 2 or ISO 27001.
Reporting a vulnerability
If you think you've found a security issue, . We'll acknowledge within 2 business days and work with you in good faith. Please don't disclose publicly until we've had a chance to respond.