No passwords for connected services
Gmail is connected with Google OAuth. Ahim does not request or store a Google password.
The user can remove access at any time.
Ahim must earn the right to operate. Connections are limited, visible and removable from the user’s account.
Encrypted OAuth token at rest
The current Gmail refresh token is encrypted on the server. It is never exposed through the browser interface.
Disconnect actually removes access
The Gmail disconnect endpoint asks Google to revoke the token and always deletes Ahim’s local token. This is implemented now for Gmail, the only external connector currently stored by the prototype.
Never provide these to Ahim
Bank passwords, card CVV codes, recovery phrases, private keys and exchange withdrawal secrets are prohibited. Future finance integrations must use official consent-based providers.
Security has to match the product stage.
The current prototype is local, not a production banking or identity service. Each new connector needs its own security review before launch.
See the product