Technical Whitepaper • WP-BYOS-2026
BYOS Storage Privacy & Permission Scopes Specification
Cryptographic and architectural proof that Bring-Your-Own-Storage (BYOS) cannot access, read, or inspect your personal Google Drive or OneDrive files.
OAuth 2.0 Scope Isolation Breakdown
Comparing the restricted AppData sandbox against legacy permission models.
| Scope Identifier | Personal Files Access | Filesystem Location | Risk Posture |
|---|---|---|---|
| drive.appdata (AuricPass) https://www.googleapis.com/auth/drive.appdata | ZERO ACCESS (Mathematically Impossible) | Hidden isolated sandbox folder | VERIFIED LEAST-PRIVILEGE |
| drive.file (Legacy Sync) https://www.googleapis.com/auth/drive.file | Access to any file opened with or created by app | User Drive root folder | EXCESSIVE EXPOSURE |
| drive (Full Cloud Access) https://www.googleapis.com/auth/drive | FULL READ/WRITE to all user personal & business files | Complete filesystem tree | PROHIBITED HAZARD |
🔐
Client-Side Envelope Encryption
Every vault record is encrypted locally via AES-256-GCM before transmission. Google Drive only receives opaque ciphertext bytes.
⚡
PBKDF2 600k Hash Derivation
Enforces PBKDF2 600,000 iterations baseline with SHA-256. Master passphrases never leave device volatile RAM.
🚫
Zero Intermediary Servers
Direct browser-to-cloud API connection. AuricPass operates zero database servers, zero sync proxies, and zero honeypots.
Google Cloud Identity Verification Dialog
CLIENT_ID: 10842...apps.googleusercontent.com ✓ See, create, and delete its own configuration and data in your Google Drive
This permission ONLY allows AuricPass to access files it created inside the hidden Application Data folder. It does NOT allow viewing, editing, or deleting any other documents, photos, or personal files.