Security

Security, OAuth Permissions and Data Boundaries

Verified security behavior from the current Growomo implementation, including authentication, credential encryption, provider scopes, disconnect behavior, and release boundaries.

Verified security boundaries

  1. Authentication

    Firebase-backed identity establishes the signed-in user.

  2. Credential encryption

    Persisted OAuth tokens and API credentials use a Fernet-backed service.

  3. Provider scopes

    Permissions are documented for each platform and connection.

  4. Disconnect and revocation

    Growomo disconnects locally and attempts provider revocation where supported.

  5. Release verification

    Deployment evidence is checked separately before broader public claims.

Provider scopes and data boundaries

Permissions are requested per connection. Review the exact scopes during provider consent.

See all integrations
Provider permission scopes, purposes, and execution boundaries
PlatformConnection typeAccess purposeBoundaryScopes
Google Analytics 4Management-capableCollect, manage, and analyze analytics dataExplicit approval for supported changes
View exact scopes
https://www.googleapis.com/auth/analytics.readonlyhttps://www.googleapis.com/auth/analytics.edithttps://www.googleapis.com/auth/userinfo.email
Setup guide
Google Search ConsoleRead-onlyMonitor search performance and site healthReporting only
View exact scopes
https://www.googleapis.com/auth/webmasters.readonly
Setup guide
YouTube channel and analytics reportingRead-onlyRead channel and analytics reportingReporting only
View exact scopes
https://www.googleapis.com/auth/youtube.readonlyhttps://www.googleapis.com/auth/yt-analytics.readonly
Setup guide
Meta AdsManagement-capableRead reporting and support approved ad actionsExplicit approval for supported changes
View exact scopes
ads_management
Setup guide
Google AdsManagement-capableRead reporting and support approved ad actionsExplicit approval for supported changes
View exact scopes
https://www.googleapis.com/auth/adwordshttps://www.googleapis.com/auth/userinfo.email
Setup guide
YouTube AdsManagement-capableRead reporting and support approved ad actionsExplicit approval for supported changes
View exact scopes
https://www.googleapis.com/auth/adwords
Setup guide
Google Business ProfileManagement-capableRead profile data and support approved profile actionsExplicit approval for supported changes
View exact scopes
https://www.googleapis.com/auth/business.manageopenidemailprofile
Setup guide

Scopes can change over time. The provider consent screen shows the exact permissions requested for each connection.

Disconnect and revocation

Disconnecting marks the integration disconnected, stops future Growomo syncs, removes usable stored credentials, and attempts provider-side OAuth revocation where supported. Non-sensitive audit state can be retained for security and support. Account and data-deletion requests follow the published legal process.

Request

You disconnect the integration in Growomo.

Revoke where supported

Growomo calls provider revocation when that path is available.

Confirm local state

Usable credentials are removed and future Growomo syncs stop.

Questions and boundaries

Frequently asked questions

Does Growomo encrypt all data with AES-256?

Growomo does not make that blanket claim. The verified implementation encrypts persisted OAuth tokens and API credentials with a Fernet-backed service; infrastructure-wide claims require separate evidence.

Are all Growomo OAuth connections read-only?

No. Search Console and YouTube reporting use read-only scopes. GA4, advertising and Google Business Profile connectors request management-capable scopes.