Security

• No file warehouse — uploads stream to Google; we do not keep a permanent copy of file contents on SangamDrive disks.
• Encrypted Drive tokens — refresh tokens are encrypted at rest with an application encryption key.
• Separate logins — platform login (SangamDrive account) is separate from Google Drive OAuth connections.
• HTTPS in production — hosted deployments should only be served over HTTPS.

Account email, encrypted OAuth tokens, connection status, storage summaries, and file metadata needed for the dashboard. Details are in the Privacy Policy.

Drive access uses Google’s OAuth consent screen. You can revoke access anytime in your Google Account permissions, and you can disconnect accounts inside SangamDrive.

If the Google Cloud project is unpublished or unverified, Google may show an “unverified app” warning. That is Google’s process, not a SangamDrive phishing page — confirm the redirect URL matches this site before continuing.

• Use strong unique passwords for your SangamDrive account
• Only connect Google accounts you control
• Sign out on shared devices
• Review connected apps in your Google Account settings periodically

If you believe you found a security issue, please report it privately via Contact or a GitHub security advisory on the repository. Do not post exploit details publicly before we can respond.