# How SMTAK Protects Customers' Connection Tokens: Separate Encryption per Workspace Canonical: [How SMTAK Protects Customers' Connection Tokens: Separate Encryption per Workspace](https://smtak.com/en/blog/multi-tenant-isolation-and-cryptographic-vaults) Locale: en Purpose: How SMTAK protects your Google connection: one permission, AES-256-GCM sealing with a key per workspace, read-only or logged support, and what we do not claim. Content updated: 2026-10-20 Source revision: sha256-8c3ecb5a8d21b436 Maintenance owner: SMTAK team, support@smtak.com [Topic map](https://smtak.com/llm/topics/software.md) ยท [Complete scoped map](https://smtak.com/sitemap.md) Published: 2026-08-24. SMTAK protects your Google connection with five layers you can verify in the code: one permission, business.manage; sealing the token with AES-256-GCM under a key derived per workspace with HKDF; keeping it on the server only so it never reaches the browser; support sessions that either view only or log every step with a written reason; and a disconnect that revokes the grant at Google and wipes the token from our database. This page is for the buyer who asks: what happens to my Google connection once I give it to SMTAK? Everything below describes what the server code does, not marketing promises, and we mention no certifications or external audit that we cannot show here. ## What does the connection give SMTAK? When you connect your Google business profile to SMTAK, the platform receives a token that lets it read your reviews and publish the replies you approve. That token is among the most sensitive data, so separating workspaces by queries alone is not enough. ## 1. You grant it on Google's own screen, with one permission - The connection starts by sending you to Google's consent page, where you sign in; your Google account password never passes through SMTAK. - To connect the business profile SMTAK requests one permission, managing the business profile (business.manage), and no extra ones. The request is set not to include permissions you previously gave other apps. - The step is protected by a random state value and a PKCE verifier, both valid only ten minutes, and the server stores a hash of the state value, not the value itself. - If you choose to sign in to SMTAK with a Google account, that is a separate flow requesting only your basic identity (openid, email, profile), not management of your profile. ## 2. It is sealed with a key specific to your workspace The token is encrypted with AES-256-GCM before it is saved in the database. The key is not stored with the token: it is derived when needed with HKDF-SHA256 from a master key held in the server's secret settings, not in the database, and your workspace's identifier goes into the derivation. The result: - Each workspace has a different key. One workspace's key does not open another's token. - Each encryption uses a fresh random 12-byte value (IV), stored with the ciphertext. - The derived key is non-extractable in the cryptography interface that Cloudflare Workers provides. - Reading the token's row from the database alone is not enough to decrypt it, because the master key is not in it. AES-GCM also checks the integrity of the ciphertext on decryption, so any change to it makes decryption fail. ## 3. It stays on the server and never reaches the browser The sealed token is read only in a loading function inside the server, when the platform must pull your reviews or publish a reply you approved. In the current code there is no route that reads the sealed token and returns it to the browser; the interface receives the connection status only (connected or not), and no interface code handles the token. The server refreshes the Google access token itself when it expires. ## 4. Team support does not change anything without a trace The platform owner may need to enter your account to help you. There are two modes: - View: sees the pages as you see them, and any change request is refused by the server with a 403 (`support_session_read_only`), so nothing is saved. - Support and fix: starts only with a written reason (at least three characters), and the reason is recorded when the session starts and ends. Every change request (its method and path) is recorded in your workspace's log under the owner's name before it runs. - A session lasts sixty minutes. - And there are actions no support session can perform, which are for the account holder alone: connecting and disconnecting Google, payment and subscription and cancelling it, changing the owner's password, sending team invitations, requesting account deletion, and approving publication in the publishing studio. ## 5. Disconnecting revokes the token and wipes it When you disconnect Google (only an owner or admin role can) SMTAK asks Google to end the grant, then wipes the sealed text and the IV from the database and records the disconnect in your workspace's log. If Google refuses the revocation request, that does not stop the disconnect on our side. You can also revoke SMTAK's permission at any time from your Google account settings. ## A record of what happens - Saving and disconnecting the Google connection is recorded in the workspace log, except the automatic hourly refresh of the token so it does not drown out people's actions. - Every support session records its start, end and reason. ## And around that - Account passwords are not stored as text but hashed with PBKDF2 at one hundred thousand iterations, the most the Cloudflare Workers environment accepts. - The connection to the platform is over HTTPS only: the server redirects any HTTP request to HTTPS. - For what AI replies publish on their own, read [safeguards for AI review replies](https://smtak.com/en/blog/ai-safeguards-and-governance-in-customer-reputation.md). - We have an automated test that tries one workspace's identifiers with another workspace's permissions and checks it changes none of that workspace's data and shows none of its text. ## What we do not claim - It is not "encryption the server cannot decrypt": the platform can decrypt the token because it needs it to pull your reviews and publish your replies. Whoever holds the master key and the database together could decrypt it. - We cite here no security certification and no external audit report, do not describe the protection as "bank-grade", and do not promise a leak is impossible. Encryption reduces the effect of a data leak; it does not remove the possibility. - Per-workspace keys cover the Google connection token. The rest of your workspace's data, such as reviews and reply settings, is protected by separating queries between workspaces and by account permissions. - The platform's own keys (such as the AI provider key) are stored sealed with the platform key, not a workspace key. ## Questions to ask any platform that asks to connect your account 1. What exactly is the permission it requests? Does it ask for more than it needs? 2. How is the token stored? Is the encryption key one for all customers or one per customer? 3. Can the platform's staff enter my account? Is that logged? Can they connect or disconnect my Google? 4. What happens to the token on disconnect? Is it revoked at Google and wiped on your side? 5. Do you show certifications or audit reports I can read? And what are their limits? To compare how different platforms connect, with their published sources, open the [comparison page](https://smtak.com/en/compare.md). ## Frequently asked questions ### What permission does SMTAK request from Google? One permission to connect the business profile, business.manage, and no extra ones. You can revoke it from your Google account at any time. ### Does SMTAK see my Google account password? No. You sign in on Google's own consent page, and your password does not pass through SMTAK. ### How is the connection token stored? Encrypted with AES-256-GCM under a key derived per workspace with HKDF from a master key in the server's secret settings, not in the database. ### Does the browser see the connection token? No. The sealed token is read only inside the server, and the interface receives the connection status, not the token. ### Can SMTAK staff enter my account? The platform owner has a view session that saves no change, or a support-and-fix session that needs a written reason and logs every change request. Connecting and disconnecting Google and payments are for the account holder alone. ### What happens to the token if I disconnect? SMTAK asks Google to end the grant, then wipes the sealed text from the database and records the disconnect in your workspace's log. ## Related articles - [How to Choose the Best Google Review Reply Software in Saudi Arabia (2026): 10 Criteria](https://smtak.com/en/blog/google-review-reply-software-saudi.md): How to choose Google review reply software: official integration, Arabic quality, human approval, multi-branch control, pricing, and red flags to avoid. - [Looking for a Repma Alternative in Saudi Arabia? What to Compare Before You Choose](https://smtak.com/en/blog/repma-alternative-google-review-management-saudi.md): Looking for a Repma alternative? Ten questions to compare any Google review platform in Saudi Arabia, from connection to price and trial, plus a test. - [A Staff Member or a Platform for Review Replies? A Fair Comparison of Time and Cost](https://smtak.com/en/blog/employee-vs-automated-reputation-software-cost.md): Staff member or platform for review replies? A decision guide on tasks, time and risks, and when a person is still needed, with no invented figures. - [What Is a Better Google Maps Rating Worth? Working Out the Return with Your Own Numbers](https://smtak.com/en/blog/roi-of-improving-google-maps-rating.md): No universal figure exists for what a better Google Maps rating is worth. What Google says on prominence, a known study, and decision steps with your numbers.