DEFENSE-IN-DEPTH BY DESIGN
Security is our core product feature, not an afterthought.
In an era where autonomous AI bots hallucinate false promises and trigger spam blacklists, MYAILIVA enforces structural, code-level safety guardrails.
Human-in-the-Loop
Outbound delivery code checks status === "queued" and requires prior approval. The application physically cannot deliver a message while in draft state.
Local-First Data
Your correspondence, lead tables, and audit trails reside on your local machine in an encrypted SQLite database. We do not store or monetize your correspondence on cloud servers.
Anti-Hallucination Guards
Deterministic regex engines and dictionary filters validate all generated text before presentation. Price tags, currency numbers, and unverified commitments are strictly blocked.
Local Credential Encryption
OAuth refresh tokens and API secrets stored in your local workspace are encrypted using authenticated AES-256-GCM via Node.js crypto. Sensitive keys remain in your designated local environment.
GOOGLE API DISCLOSURE & RESTRICTED SCOPES
Google API Services User Data Policy Disclosure
MYAILIVA's design and data handling adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Limited Use Principles:
1. Minimum necessary access: We request only the scopes necessary (gmail.modify or gmail.readonly + gmail.compose) to detect inbound replies and prepare local response drafts.
2. No third-party data transfers: We do not transfer Google user data to advertising platforms, data brokers, or external marketplaces.
3. No advertising use: Google user data is never utilized for serving advertisements.
4. Human review protections: Operator messages and emails are private to your workspace and not subject to unauthorized human inspection.
Restricted Scopes & Security Assessment (CASA):
In the current evaluation release, users operate in Google Cloud Testing mode (supporting up to 100 test accounts) or locally on desktop where credentials remain on the user's disk. Full public multi-tenant cloud release will undergo independent Cloud Application Security Assessment (CASA Tier 2/3) certification by an authorized laboratory.
APPLICATION SECURITY
SSRF Validation & Rate Protection
When performing website research, MYAILIVA's fetcher strictly blocks loopback targets (127.0.0.1, localhost), internal metadata endpoints (AWS/GCP metadata services), private IP ranges, and encoded bypass strings.
Rate limiting guards every API endpoint, ensuring that brute-force attempts and denial-of-service vectors are automatically throttled.
