Security & Privacy
Google CASA Tier 2 Security Verified
Save Bulk Gmail Attachments has passed Google's Cloud Application Security Assessment (CASA) Tier 2 — an independent, third-party security audit required for applications that access sensitive Google API scopes like Gmail and Google Drive.
This means our extension’s architecture, data handling, and security controls have been reviewed and verified by Google-authorized security assessors. While competitors route your attachments through their own servers, Save Bulk Gmail Attachments keeps attachment and email content in your browser. Our backend handles sign-in, subscription status and download counts, and never receives your files.
What We Can and Cannot See
Save Bulk Gmail Attachments processes your attachments in your browser. We cannot see, access, or store your emails or attachments. We do keep an account record — your email address, your subscription and your download counts — set out in our privacy policy.
How It Works
Local Processing
The extension’s attachment processing runs in your browser using JavaScript
Direct Downloads
Files download directly from Gmail to your device
Your Attachments Never Touch Our Servers
Attachments move directly between Google and your browser. We do run a server, and the extension contacts it to sign you in, check your subscription and count your downloads — it never receives your attachments or your message content.
Security Features
🔐 OAuth 2.0 Authentication
Uses Google's secure OAuth - we never see your password
🚫 Minimal Permissions
Requests read-only access to Gmail messages and attachments; cannot modify or delete emails
💾 Local Storage Only
Settings stored locally in your browser, not on our servers
🔍 Open Source Principles
Transparent about our data handling practices
What We DON'T Do
- ✗ Upload your attachments to our servers
- ✗ Send your email content to our servers
- ✗ Store your emails, attachments or contacts
- ✗ Share data with third parties for marketing purposes
Compliance & Standards
- ✓ GDPR - Account data disclosed in full, with export and deletion on request
- ✓ CCPA Compliant - California privacy rights respected
- ✓ Chrome Web Store Policy Compliant
- ✓ Google OAuth Verification Passed
- ✓ Google CASA Tier 2 Certified — Independent third-party security audit passed
Verify Our Claims
You can verify our security claims yourself:
- Open Chrome DevTools while using the extension
- Check the Network tab. Your attachments transfer only between Google's domains and your browser. You will also see our own server (auth.savebulkgmailattachments.com) for sign-in, subscription status and download counts, plus product analytics and error reporting. None of those carry your attachments or your message content.
- Review the extension's permissions in Chrome settings
- Monitor your network traffic with tools like Wireshark. No attachment or message content leaves for any destination other than Google and the folder you chose.
Security Updates
We regularly update the extension to maintain security standards and patch any potential vulnerabilities. Chrome automatically updates extensions to ensure you're always protected.
Report Security Issues
Found a security concern? Please report it immediately:
security@savebulkgmailattachments.comWe take all security reports seriously and will respond within 24 hours.