This page documents security behaviour verified in the current Growomo implementation. It does not make infrastructure-wide encryption or compliance claims that have not been independently evidenced.
Data Isolation
Application records are associated with the authenticated Growomo user and team. Access is enforced through the product's authentication and authorization controls.
Encryption
- Persisted credentials: OAuth access tokens, OAuth refresh tokens, and stored API credentials are encrypted at rest using the backend credential-encryption service.
- Scope boundary: This verified credential protection does not mean every database, storage, or backup system can be described as using AES-256.
- In transit: Production connections must use HTTPS. Deployment-level TLS configuration is verified as part of the production release gate.
OAuth Permissions
- Google Search Console uses a read-only reporting scope.
- YouTube channel and analytics reporting use read-only reporting scopes.
- Google Analytics 4 requests both reporting and edit scopes.
- Meta Ads, Google Ads, YouTube Ads, and Google Business Profile request management-capable scopes. They must not be described as read-only integrations.
- Provider changes require an explicit user action through a protected execution path.
Disconnecting Integrations
When you disconnect a platform, Growomo immediately marks the integration disconnected, stops future syncs, removes it from active connected dashboard state, and deletes usable stored OAuth tokens or API keys. For OAuth providers such as Google and Meta, Growomo also attempts to revoke provider access where supported. If provider revocation fails, Growomo will still disconnect locally and show guidance to remove Growomo access in the provider account settings. For API-key integrations, rotate or revoke the key in the provider dashboard.
Growomo keeps only non-sensitive disconnect audit metadata such as platform, user, disconnect time, local disconnect status, and provider revocation status.
Data Requests
You can request account deletion through Growomo's documented data-deletion process. See the Privacy Policy and Data Deletion pages for the current process and contact details.