# What data reaches Applane?

> Your domain name, a Google ID token used once, and what admins type in the console. Never a Google access token, app source, prompt or row of your data.

Source: https://docs.applane.dev/security/data-flow/

Your employees' browsers talk to Google with tokens minted by your OAuth client in your GCP project. The apps run on your Apps Script. The model runs on your Vertex AI billing. The audit trail is your Cloud Audit Logs. Applane's backend stores your configuration, the email addresses of the people who build, and your invoice.

## What reaches Applane

| From | What | Why | Kept? |
|---|---|---|---|
| The extension, before sign-in | Your domain name | To find your company's record and return its OAuth client id | No |
| The extension, at sign-in | A Google ID token: your email, your domain, a nonce | To prove who is signing in before issuing a licence. Checked, then discarded. | The email becomes a seat row. The token is not stored. |
| The extension, daily | The same, to renew the licence | Same | Same |
| The admin console | What admins type: company name, project id, client id, group and bot addresses, settings, seat actions | To run the company | Yes, as the tenant record and the audit log |
| The setup checker | Pass or fail per check | To show the checklist | Yes, pass/fail only |
| Checkout | Nothing; the card goes to the payment provider | Billing | The provider holds it |

Back from Applane to the extension: the tenant configuration and a signed licence.

## What never reaches Applane

- Google access tokens or refresh tokens. The extension holds them in Chrome's identity plumbing and sends them to Google only.
- App source, files or versions. They live in Apps Script projects in your Drive.
- Prompts, chat history or agent transcripts. They live in the builder's browser; the model call goes from the browser to Vertex AI in your project.
- Sheet, Doc, Drive, BigQuery or Firestore contents.
- Who opens or uses a deployed app. Viewers are never counted or seen.
- A copy of your app inventory.

The contract types the extension is built against have no field for any of these, so they cannot be sent by accident.

## Where each call goes

| Call | From | To | With |
|---|---|---|---|
| Sign in | Extension | `accounts.google.com`, your client | The employee's Google session |
| Build (model call) | Extension | Vertex AI in your project | The employee's token, `cloud-platform` scope |
| Create, push, deploy an app | Extension | Apps Script API | The employee's token, `script.*` scopes |
| Read sheets, docs, Drive | Extension | Sheets, Docs, Drive APIs | The employee's token |
| Run an app | The viewer's browser | `script.google.com` | The viewer's own Google session |
| Find the company, get a licence | Extension | Applane API | Domain, then ID token |
| Admin console | Admin's browser | Applane | Applane's own sign-in (`openid email profile`) |

The setup checker's test sign-in runs from the admin's browser against Google; the token it gets stays there.

## Hosting

Applane's backend runs on Supabase in Frankfurt (AWS `eu-central-1`), behind Cloudflare with EU data localisation on. Payments are on Stripe. Transactional email goes through an EU provider. No US transfer for the data Applane processes on your behalf. See [DPA and sub-processors](https://docs.applane.dev/security/dpa-and-sub-processors/).