Security

IKF Coach is served over HTTPS. Browser sessions and application requests are transmitted through encrypted connections.

Users sign in with Google authentication. NeoSapien, Gmail, and Google Calendar connections require explicit user authorization before IKF Coach can access those services.

IKF Coach stores account, organization, conversation, report, and connector records server-side. OAuth tokens are handled on the server and are not exposed in client-side application code.

• IKF Coach requests only the Google permissions needed for Gmail and Google Calendar features.
• NeoSapien memories are used only as source context for memory-backed coaching and reports.
• Connected Google services are used only when relevant to a user request.
• Server-side authorization checks protect account, organization, and admin routes.
• Connected NeoSapien and Google Workspace data is not used for advertising and is not used to train public AI models.

NeoSapien provides memory context for coaching and daily reports after user authorization. Users can disconnect NeoSapien from IKF Coach settings, and server-side checks prevent unauthenticated access to connector operations.

IKF Coach currently requests Gmail permissions for email workflows and Google Calendar permissions for calendar, event, and availability workflows. It does not request permissions for other Google Workspace products.

• gmail.compose is used to create user-requested Gmail drafts for follow-ups, replies, and productivity workflows.
• gmail.modify is used for user-requested Gmail workflows that need thread context, draft context, labels, or mailbox updates.
• calendar.calendarlist.readonly is used to identify the user's available calendars.
• calendar.events is used for user-requested scheduling, event review, event updates, meeting preparation, and follow-up workflows.
• calendar.freebusy is used to check availability for scheduling and planning.

• Google Workspace data is accessed only after explicit user authorization.
• Google Workspace data is used only for user-facing Gmail and Calendar features requested by the user.
• OAuth tokens are stored server-side and are not exposed in client-side code.
• Human access to Gmail or Calendar data is limited to user-approved support, security investigation, legal compliance, or aggregated internal operations.
• AI service providers may process relevant Gmail or Calendar context only to complete the requested user-facing feature; Google Workspace data is not used for advertising or public AI model training.

The application separates platform admin access, organization membership, onboarding state, and normal user access. Protected application routes and APIs require an authenticated session and the appropriate account state.

If you believe you found a security issue in IKF Coach, contact [email protected] with a clear description and reproduction details. Please do not access, modify, or exfiltrate data that does not belong to you.