DEALWHISTLE / TRUST & EARLY ACCESS
Know what the Gmail test does before you connect an inbox.
Dealwhistle is an early-access product. Connected-source monitoring is inactive, no CRM connector is available, and real-inbox validation has not been confirmed. The Gmail option today is an owner-authorized, on-demand, read-only quiet-deal test. It is not background monitoring and does not send or change Gmail messages.
PRODUCT STATUS
What is available today
Dealwhistle remains in early access until connected-source monitoring is working and real-inbox validation is confirmed. At present, connected-source monitoring is inactive, no CRM connector is available, and real-inbox validation is unconfirmed.
The available Gmail flow is a separate, owner-authorized quiet-deal test. The workspace owner starts each test on demand. It does not run in the background, send or reply to messages, create drafts, or change Gmail messages.
BEFORE GOOGLE CONSENT
One inbox, one owner-run test at a time
Only the workspace owner can connect one Gmail inbox and run a quiet-deal test. Before Google consent, the requested scope is exactly:
https://www.googleapis.com/auth/gmail.readonly
Each on-demand test reads at most 100 threads with activity in the rolling 90 days before the test. Spam and trash are excluded. Earlier messages in selected threads are also read to establish message direction and deal context.
Information read
From, To, Cc, Subject, and Date headers; message timestamps; and message text used for deal context. Attachments are not read.
Actions not performed
The test does not send or reply to email, create drafts, modify messages or labels, archive, or delete email.
DATA HANDLING
What a test keeps
For conversations kept for review, Dealwhistle retains:
- Subject and participant email addresses
- Verified inbox address, message count, and latest/inbound/outbound times
- First outbound time and the applied inactivity basis and elapsed days
- An excerpt of at most 280 characters from the latest message
- Any unique deal match and the evidence saved for the scan
Full message bodies and attachments are not stored. Gmail returns message and thread identifiers and label metadata; only a Gmail thread identifier is retained from those fields for scan review. The verified Gmail address and encrypted OAuth credentials are stored server-side and the credentials are never returned to the browser.
Scan summaries remain in workspace history and do not automatically expire. Workspace members with access can review saved summaries. Only the workspace owner can connect the inbox or run tests.
VERIFIED SAFEGUARDS
The controls confirmed in the product
- Read-only Gmail scope. The OAuth request asks only for
https://www.googleapis.com/auth/gmail.readonly. - Encrypted OAuth credentials. Credentials are encrypted on the server with AES-256-GCM using the app-owned
GMAIL_TOKEN_ENCRYPTION_KEY, held in the Polsia secret vault. - Credentials stay server-side. The browser does not receive the saved OAuth credentials.
These are the specific controls confirmed in the app setup documentation and Gmail implementation. They do not establish broader security or privacy practices.
NOT YET VERIFIED
Details we cannot confirm from the materials reviewed
The following information is unverified. This does not mean that a practice, document, or entity does not exist; it means the inspected product and company materials do not establish it.
- Broader security practices
- Broader privacy practices
- External audits or certifications
- Legal compliance status
- Data-sharing and subprocessor practices
- Whether a privacy policy is published
- Deletion behavior and retention periods beyond the scan-summary behavior above
- Legal operating entity, jurisdiction, and postal address
- Support response commitment
CONTACT
Questions about early access?
Email Dealwhistle at dealwhistle-13@polsia.app.
The legal operating entity, jurisdiction, postal address, and support response commitment are unverified.