Auth
Google admin identity
Used to authenticate, verify eligibility, and scope the active workspace.
Last updated June 5, 2026. Effective June 5, 2026.
The short version: Sever collects only what is necessary to run offboarding verification. We do not sell your data, use it to train AI models, or share it with advertisers. Your organization's directory data is never used outside its stated purpose.
Auth
Used to authenticate, verify eligibility, and scope the active workspace.
Records
Directory-backed offboarding records stay tenant-scoped behind RLS.
Storage
Generated PDFs stay in private Supabase Storage and stream through authorization.
Sever provides Google Workspace offboarding verification, app-access review, and audit evidence reporting for IT, security, and compliance teams. This Privacy Policy explains how we collect, use, store, share, and protect information obtained through your use of the Service.
Sever uses Google OAuth 2.0 for authentication and requests Google identity, Google Admin directory user, and Google user security-session scopes needed for offboarding verification. We do not request Gmail, Calendar, Drive content, or other personal Google service scopes.
Offline access tokens are used solely to maintain authorized directory sync and permitted deprovisioning actions. Tokens are stored server-side and are not exposed to browser storage.
We use essential cookies needed for Supabase authentication sessions, OAuth flow verification, CSRF protection, and security controls. We do not use advertising cookies or behavioral tracking technologies.
Your data is stored in a multi-tenant database with row-level security enforced at the database layer. Data is encrypted in transit, and our infrastructure providers encrypt stored data as part of their managed services.
Generated report PDFs are stored in private Supabase Storage and streamed through server-side authorization. Sever does not expose public report object URLs.
Access to production data is restricted to authorized personnel on a strict need-to-know basis. Sensitive support and diagnostic workflows use minimized summaries where practical.
Sever shares data only as needed to operate the Service, process billing, provide support, comply with law, or protect the Service and our users. We do not share customer data with advertisers or data brokers.
Sever relies on providers including Supabase, Google Workspace APIs, Vercel, Stripe, Upstash, and Sentry to deliver, secure, bill, host, rate-limit, and monitor the Service. Each provider is subject to its own privacy and security obligations.
We retain your organization's data while your account is active and for a limited period afterward where necessary for legal, billing, backup, and security purposes.
Evidence retention depends on your plan and account status. Organization owners may request organization export or deletion from account settings. Deletion may be subject to a grace period and to retention needed for legal, billing, security, backup, and audit-evidence purposes.
You may contact us to request access, correction, deletion, export, or restriction of personal information where applicable. Some requests must be handled by your organization's authorized administrator because Sever processes organization data on behalf of the customer.
If you have privacy questions, contact contact@usesever.com.