The short version
- You approve access on the provider's own sign-in page, not ours — we never see or ask for your password
- You can revoke access at any time from the provider's own account settings, no email required
- Access tokens are encrypted at rest, the same protection every connected provider's credentials get