Security & Trust
Effective October 19, 2026 · Entrevest LLC
These are the controls implemented for the current web release. This page is not a certification or a guarantee that future features are available.
Google identity and approved membership
We use Google sign-in through Firebase for Gmail and Google Workspace accounts. The server checks verified Google identity and approved membership. Approval is tied to an email and, on first accepted member sign-in, its Firebase identifier. Administrators have a separate, explicitly configured allowlist.
Server-side access checks
Protected requests require authentication and a current access check. Revoking approval blocks subsequent protected web requests. Approval and revocation decisions record the administrator and time. These are decision logs, not a claim that every application action has an immutable audit trail.
Encrypted connections and limited permissions
The website uses HTTPS. Database traffic uses Google’s authenticated, encrypted Cloud SQL connector. The web database login is limited to waitlist, approval, and rate-limit tables. Production hosting uses short-lived Google credentials restricted to this application’s production identity.
Session and abuse protections
Session cookies are protected from JavaScript access and require secure transport in production. Account and administrative changes have origin checks. Request-size limits and persistent rate limits reduce abuse. These controls do not make unauthorized activity impossible.
Mailbox access is a separate choice
Signing in does not connect Gmail. The Gmail pilot is limited to approved test accounts and requires separate read-only consent. Credentials are encrypted in the backend. Disconnecting stops future imports and initiates credential revocation, with retries if Google is unavailable. Optional AI parsing requires a separate, recorded choice and remains limited to approved pilot accounts. OpenRouter requests require zero-data-retention endpoints, prohibit training-data collection, and use restricted provider routing. Disabling AI, disconnecting Gmail, revoking approval or editing a capture prevents pending AI results from overwriting that record. Private bookings do not automatically become public reviews, visits, or guide content.
Your choices and reporting
Request waitlist removal, account closure, or help with your information by email. Report security concerns without accessing others’ data or sending passwords, authorization codes, or mailbox contents. We do not claim SOC 2 certification or an independent security assessment for this release.
Contact us
Eat Sleep Shop is operated by Entrevest LLC. For questions, privacy requests, account closure, or security reports, email alan@entrevest.com.