Request membership

Security

CliffsMe holds the keys to a lot of your life. These are the commitments built into the product, not promises bolted on.

Built to read, never to act

Every connection requests the narrowest permission the platform offers. Email (Gmail, Outlook), calendars, Slack and TikTok are read-only: CliffsMe cannot send, post, delete or change anything in them. Instagram messages and comments, and Facebook Page messages, are only available through permissions that also allow replying, because Meta offers no read-only version. CliffsMe uses those permissions to read only, and has no code that sends, posts or deletes on any platform.

Keys never leave the server

OAuth access and refresh tokens are encrypted with AES-256-GCM using a key held outside the database, and are only ever decrypted on our servers at the moment of a sync. They are never sent to a browser or phone. Clients have no direct database access at all: every request goes through an authenticated API that checks your identity on each call.

Sign-in

Accounts use Firebase Authentication with Google or email and password. Connecting a source uses OAuth 2.0 with PKCE and single-use state values that expire after 15 minutes.

Built to forget

Raw items expire automatically (30 days by default). Disconnecting a source deletes its tokens and items immediately. Account deletion removes everything.

Untrusted content stays data

Emails and messages can contain text written to manipulate AI. CliffsMe treats every source item as untrusted data, never as instructions, and the model has no tools that can act on your accounts. Every link in an edition is attached by our code from the original item, not written by the model.

Infrastructure

  • Data at rest is encrypted by Google Cloud; all traffic uses TLS.
  • Webhooks from Meta are verified with HMAC signatures before they are processed.
  • Scheduled background syncs are authenticated with Google-signed identity tokens, checked on every call.
  • The app runs on Firebase App Hosting (Google Cloud). Your data is stored in Google Cloud Firestore in Sydney, Australia.

Report a vulnerability

Email security@cliffsme.com. We respond within two business days and won’t take action against good-faith research.