Security and privacy of your data

What permissions do we request?

When you connect your Google or Microsoft account, the base permission is read-only access to your calendar: we can see your events, but we don't create, edit, or delete them. For Google Calendar, there's also an optional, separate write permission — we explain it in detail below.

Base connection: read-only. With these permissions we don't touch, modify, or delete anything — with either provider.

Optional write permission (Google Calendar)

If you additionally grant the Google Calendar write permission — optional, separate from the read permission and requested separately — Pausa can create, edit, and delete events on your Google Calendar on your behalf, only when you perform those actions from the platform (for example, when creating a task, moving its time, adding guests or a video-call link, or deleting it). We never create, edit, or delete anything on our own initiative — only when you explicitly ask us to.

Security infrastructure

Protecting your data doesn't rely on permissions alone — it's backed by multiple layers of security at the infrastructure level.

Encryption and secure transport

• TLS/SSL in transit — all communication between your browser and our servers is encrypted using TLS 1.2+, the same standard used by banks and financial platforms.
• AES-256 encryption at rest — access tokens and sensitive data are stored encrypted with AES-256, the standard used by the U.S. government for classified information.
• HTTPS enforced — there's no unencrypted version of Pausa. All traffic is forced to HTTPS via HSTS.

Authentication and authorization

• OAuth 2.0 / OpenID Connect — we don't store your Google or Microsoft password. You authorize directly with your provider.
• Minimal-scope tokens — each token we receive has permissions limited to exactly what you authorized: if you only granted read access, that token can't modify your calendar even if compromised; the write token (if granted) only allows the actions you initiate from the platform.
• Encrypted refresh tokens — long-lived tokens are stored with application-level encryption, separate from the main database.

Security practices

• Principle of least privilege — we only request the permissions strictly necessary for Pausa to work.
• No credential storage — we never see or store your password. Authentication happens directly between you and Google/Microsoft.
• Environment separation — development, staging, and production are fully isolated from each other.
• Audit logs — we keep access logs to detect and respond to any unusual activity.

App validation and registration

Pausa is registered and verified with the major identity providers. This guarantees that when you connect your account, you're authorizing a legitimate, audited application.

Microsoft Entra ID (Azure AD)

• Verified publisher — Microsoft validated our identity as a company through the Microsoft Partner Network. You'll see the blue verification badge next to "PausaCo."
• Verified MPN ID — we hold an active, validated Microsoft Partner Network ID.
• Verified domain — our publisher domain is verified via DNS with Microsoft.
• Privacy policy and terms — loaded and visible directly on Microsoft's consent screen.

Pausa isn't listed on the Microsoft AppSource marketplace — it doesn't need to be: it works as a direct OAuth application where you authorize access from your own account. Publisher verification is the security validation Microsoft applies to this type of integration.

Google Cloud / OAuth

• Verified Google Cloud project — our app goes through Google's verification process for apps that access user data.
• Verified consent screen — Google reviews and approves the consent screen you see when connecting your account.
• Read-only, non-sensitive scopes only — by requesting read-only permissions only, we meet Google's strictest security requirements.
• We comply with Google's API Services User Data Policy, including limited use of data.

Admin configuration guide

If your organization uses Microsoft 365 or Google Workspace with controlled access policies, an admin may need to approve Pausa before users can connect their calendars.

Microsoft 365 / Entra ID

If your organization restricts which applications can access user data, an IT admin needs to grant admin consent for Pausa:

1. Sign in to the Microsoft Entra admin center.
2. Go to Enterprise applications → All applications.
3. Search for "Pausa" in the list (or ask a user to attempt to connect so it appears).
4. Click the application → Permissions → Grant admin consent.
5. Review the requested permissions (User.Read and Calendars.Read) and approve.

Once approved, all users in your organization will be able to connect their Microsoft account to Pausa without individual approval.

Restrict access to specific users (Assignment Required)

By default, once an admin approves Pausa, all users in the organization can connect their account. If you need to restrict access to certain users or groups, you can enable Assignment Required:

1. In the Microsoft Entra admin center, go to Enterprise applications → search for Pausa.
2. In the left panel, click Properties.
3. Turn on Assignment required? → Yes.
4. Click Save.

Now only the users or groups you explicitly assign will have access to Pausa. To add them: on the same Pausa application screen in Entra, go to Users and groups → Add user/group → select the individual users or security groups → Assign.

Tip: if you use Entra ID security groups, you can manage access to Pausa dynamically: adding or removing a user from the group automatically grants or revokes their access to the app.

Google Workspace

If your organization uses Google Workspace with third-party app access controls:

1. Sign in to the Google Admin console.
2. Go to Security → API controls → Manage third-party app access.
3. Click Configure new app → OAuth app name or client ID.
4. Search for "Pausa" or enter the application's Client ID.
5. Select access level: Trusted (recommended) to allow the read-only scopes.
6. Click Configure.

Once configured, users in your domain will be able to authorize Pausa without restrictions.

Network / Firewall configuration

If your organization has network or firewall restrictions that block external domains, you'll need to allow access to Pausa's domains for the application to work correctly.

The simplest, future-proof option is to allow *.pausaco.com. This covers all current services and any subdomain Pausa adds in the future, with no need to update firewall rules later.

Subprocessors

To operate Pausa, we use the following subprocessors, all subject to data processing agreements and confidentiality obligations:

Calendar and personal data are stored exclusively on servers in Brazil. OpenAI and n8n process calendar data in the United States solely to classify MacroTasks and analyze workload; they don't store or use it for any other purpose. PostHog only receives platform usage data.

What do we do with your data?

• We read and store your calendar events on servers in Brazil to help you manage your time. They're stored encrypted with AES-256 and processed by OpenAI and n8n solely to classify MacroTasks and analyze workload.
• If you granted the optional Google Calendar write permission, we create, edit, or delete events on your behalf — only when you explicitly ask us to from the platform.
• We use your email to identify your account within Pausa.
• OAuth access tokens are stored encrypted with AES-256, in a database separate from calendar data.
• All communication travels protected with TLS/SSL.

What do we never do?

• We never create, edit, or delete events on your calendar unless you explicitly ask us to from the platform — and only if you granted the write permission separately.
• We never share your data with unauthorized third parties — only with the subprocessors listed above, subject to confidentiality agreements.
• We never access more information than strictly necessary.
• We never store calendar events in plain text — always encrypted with AES-256.
• We never see or store your Google or Microsoft password.
• We never transmit data without encryption.

Your data, your control

You can revoke Pausa's access to your account at any time, directly from your provider's security settings:

• Google: Manage third-party access
• Microsoft: Manage connected apps

Once revoked, Pausa immediately loses the ability to read your calendar.

Legal basis and full documentation

The full detail on legal bases for processing (LGPD for Brazil, Law 25.326 for Argentina), data retention, and your rights as a data subject is in our Privacy Policy. For the platform's terms of use, see our Terms and Conditions.

If you have questions about the security of your data, write to us at soporte@pausaco.com. Transparency is part of who we are.