Security & Trust Architecture
How Scaliz safeguards your Google Business Profile credentials, encrypts customer review communications, and enforces Google API Limited Use requirements.
Zero Password Storage
We never ask for, view, or store your Google password. Authentication occurs exclusively via Google OAuth 2.0.
AES-256 & TLS 1.3
OAuth tokens encrypted at rest with AES-256. All API traffic routed via high-security TLS 1.3 tunnels.
Zero AI Model Training
Your private business reviews and data are strictly isolated and never fed into public foundation models.
Instant Data Purge
Disconnect your Google Business Profile anytime. All OAuth tokens and cached reviews are instantly deleted.
Scaliz's use and transfer to any other app of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements. Scaliz does not transfer Google user data to third parties, use Google user data for advertising, or permit humans to read Google user data unless requested by the user for technical diagnostics.
1. Google OAuth 2.0 & Scopes of Access
Scaliz connects to your Google Business Profile using Google's verified OAuth 2.0 framework. We request the minimum permissions strictly necessary to execute GBP automation:
- https://www.googleapis.com/auth/business.manage: Used solely to retrieve incoming reviews, post approved AI review responses on your behalf, and update weekly Google Maps promotional posts.
- https://www.googleapis.com/auth/userinfo.email: Used strictly to identify your account administrator and verify profile ownership during sign-in.
2. Data Encryption at Rest & in Transit
We implement defense-in-depth cryptographic controls across all platform tiers:
- Data in Transit: 100% of network traffic between browsers, standee counter devices, Scaliz cloud infrastructure, and Google APIs is enforced over TLS 1.3 with HSTS (HTTP Strict Transport Security) and forward secrecy ciphers.
- Data at Rest: All databases, message queues, and backups are encrypted using AES-256 with keys managed in isolated Cloud Key Management Services (Cloud KMS).
- OAuth Token Vaulting: Refresh and access tokens are double-encrypted with per-tenant salting before persistence, preventing unauthorized access even in the hypothetical event of raw storage exposure.
3. AI Safety & Non-Training Commitment
We know your business customer interactions are confidential. Scaliz maintains strict boundary separation:
- We operate dedicated enterprise inference endpoints with contractual zero-data-retention agreements.
- Your customer reviews, reviewer names, locality references, and private manager feedback are never retained for training general-purpose foundational models.
- Prompt payloads are processed transiently in memory and discarded immediately upon response delivery.
4. Immediate Data Revocation & Self-Service Deletion
You maintain complete sovereignty over your Google authorization. You may revoke Scaliz access in two independent ways:
- 1-Click Disconnect in Scaliz: Navigate to Settings in your Client Portal and click “Disconnect Google Account.” All active tokens and sync jobs are instantly invalidated.
- Directly in Google Account Permissions: Visit myaccount.google.com/permissions to sever Scaliz's OAuth delegation immediately at Google's authentication layer.
5. Physical Standee NFC Hardware Security
Scaliz Smart NFC standees contain embedded NTAG213 / NTAG215 microchips configured in permanent read-only mode. The chips contain only a direct HTTPS destination URL to your review portal or private manager firewall. They contain no executable code, no tracking cookies, and no ability to extract personal data from customer smartphones.
6. Security Inquiries & Responsible Disclosure
We welcome reports from independent security researchers and customers. If you discover a security vulnerability, please report it responsibly: