Security
Last updated: September 18, 2026
Read-only by design
SaaSClerk requests the minimum access required: the gmail.readonly OAuth scope for Gmail, or an IMAP authorization code for other providers. We cannot send, delete, or modify any email in your mailbox — the protocol itself makes it impossible.
Encryption
- Mailbox credentials (OAuth tokens / IMAP authorization codes) are encrypted at rest with AES-256-GCM.
- All traffic to and from SaaSClerk runs over TLS.
- Payment details never touch our servers — handled entirely by our PCI-compliant payment provider.
No email content storage
Email bodies are processed in memory during a scan and discarded immediately. What persists is the extracted subscription record: tool name, amount, billing cycle, renewal date.
Least privilege
Infrastructure access follows least-privilege principles. Database credentials are scoped, secrets are never committed to source control, and automated jobs authenticate with scoped tokens.
Responsible disclosure
Found a security issue? Please report it privately via our Discord community (ask for a maintainer in a DM) rather than opening a public issue. We acknowledge reports within 72 hours.