Security overview
The first scan is read-only. Provider access and refresh tokens are stored server-side only and encrypted at rest when real auth is enabled.
Sessions use HTTP-only cookies. Production cookies are configured for Secure and SameSite=Lax. Cleanup requires a verified payment followed by separate provider write consent.
API routes check scan ownership before returning cleanup plans or deleting scan data. File contents are not downloaded for exact duplicate detection.
Disconnecting the account removes stored authorization tokens and, for Google and Dropbox, requests provider-side token revocation. It prevents future scans until cloud-provider access is granted again, but it does not sign the user out of the provider or browser.
Production control review · August 2026
Checked across scan, payment, consent, and cleanup
Production separates read-only OAuth from later write consent, keeps provider tokens server-side, verifies Stripe payment, and revalidates every selected item before moving it to recoverable trash.
- Read-only
- first connection
- Separate
- write consent
- Per file
- cleanup revalidation
These controls were reviewed against the deployed workflow rather than only the marketing copy. Cleanup remains governed by the independent server safety gate.
Written by ClearCopies Editorial · Technical review by ClearCopies Engineering