How we handle your data and access.
Your automation runs in your own account, on the least access we can work with, with secrets out of the code and a handover that leaves you in control.
The short answer. Evenops builds automations that run inside your own Google Workspace or cloud account. We ask for least-privilege access, keep secrets out of the code, keep audit trails on systems that touch people or money, and hand over the source, keys and a runbook at the end. We hold no security certifications and say so below.
Where your system runs
For Google Apps Script builds, your automation runs inside your own Google Workspace: the script is a project in your account, bound to your Sheets, Forms or Drive. For other builds it runs in your cloud account. Either way you own the code, the keys and the pipeline, and they are handed over to you.
The access we ask for
Least privilege: we ask for the access the job needs and no more. Apps Script works out the permissions a script needs by scanning its code, and a person sees a consent screen listing them before anything runs. Google recommends setting the permissions explicitly in the project's manifest file (appsscript.json) for published scripts, so the script holds only the minimum it needs. Anything broader than the job needs is a design problem we fix, not a screen to click through.
How secrets are kept
Secrets are kept out of source: no passwords, API keys or tokens in the code. The platforms have their own stores for them. Apps Script has script properties, which are available to everyone who uses the script. Google Cloud Secret Manager lets you control who can read each secret with fine-grained access roles, and keeps a version history of changes, including who made them.
Audit trails and logging
Systems that touch people or money keep an audit trail, so your team can see what ran and what it decided. For failures we use the platform's logs. Apps Script keeps a built-in execution log that is short-lived, and Google recommends Cloud Logging for production use because its logs persist for many days.
How AI features handle data
Many of our systems need no AI at all. Where a model is the right tool, we let it read untrusted content into fixed fields only, check those fields in code, and put a person in front of anything unusual or uncertain. More on this in the AI integration security review.
The scope names the provider and plan, if any, that you approve. We do not promise a blanket “your data is never used for training”, because that depends on the provider, the plan and the settings. Here is what each provider’s own page says, as read on 11/10/2026. Terms change, so follow the links.
Anthropic (Claude API)
Its privacy centre says that by default it does not use inputs or outputs from its commercial products, which include the Anthropic API, to train its models, with exceptions such as feedback you choose to submit.
Provider policy, checked 11/10/2026OpenAI (API)
Its API documentation says data sent to the API is not used to train or improve OpenAI models unless you opt in, and that abuse-monitoring logs are kept for up to 30 days by default. Zero data retention exists but needs OpenAI's approval.
Provider policy, checked 11/10/2026Google (Gemini API)
Its terms differ by tier. For Paid Services Google says it does not use your prompts or responses to improve its products, and logs them for a limited period solely to detect abuse. For Unpaid Services it says it does use submitted content to improve its products and that human reviewers may read it.
Provider policy, checked 11/10/2026
What we hand over
At handover, in the Run phase, you get the full source, the deploy pipeline, the keys, and a runbook, with monitoring in place. Your team owns it and can extend it without us. The phases are described on the process page.
What your written scope states
Every project starts with a written scope that you approve before we build. For each point below, the scope says what applies to your project, and you approve it.
Where it runs
Which account, project or environment the system runs in.
Access and duration
What access we need, to which files or systems, and for how long.
Secrets
Where each key or credential is stored, and who can read it.
AI provider and plan
If a model is used: which provider and which plan you approve, and what data it receives.
Logging and alerts
What is logged, and who is alerted when a run fails.
Handover
How our access is removed and who can publish a new version.
This website
Our own site is separate from client systems. These are the services that handle data when you use it. The privacy policy is the full legal statement, including what we collect and your rights.
Vercel
Hosts this site and runs the server function behind the contact form.
Their privacy policyBrevo
Sends the confirmation email and handles email lists with double opt-in.
Their privacy policyhCaptcha
Spam protection on forms. Loads only when you start filling one in.
Their privacy policyGoogle Analytics 4
Page analytics. Runs after consent in the EEA, UK and Switzerland, and wherever your country cannot be determined.
Their privacy policy
The contact form does not store your message in a database; it is relayed to our inbox.
Agreements, and what we do not claim
We sign a mutual NDA on request. We do not hold SOC 2 or ISO 27001 certification, and we do not claim HIPAA compliance. If you need a business associate agreement (BAA), raise it at the start and we will tell you in writing whether we can sign one.
Security questions, questionnaires or a vulnerability report: write to hello@evenops.com.
Google sources, checked 11/10/2026
Common questions
No. We are a small senior team and we do not hold SOC 2 or ISO 27001 certification. What we offer instead is a plain description of how we work, a system that runs in your own account where your own controls apply, and a written scope that states the security points of your project for you to approve.
Got a security questionnaire?
Send it over with the workflow you have in mind and we will answer it in writing before you commit to anything.
We typically respond within 24 hours