Authentication

Access to GStudio is gated by Google Sign-In via Firebase Authentication. Only email addresses explicitly approved by the administrator can log in — all others are denied at the authentication layer before any data is accessible. Session tokens are managed by Google's identity platform and are not stored in this application.

Data isolation

All user data is stored in Google Cloud Firestore under per-user documents keyed to each user's unique Firebase UID. Firestore security rules are enforced server-side and prevent any user from reading or writing another user's documents — even if they knew the document path. There is no shared data store between users.

Data in transit

All communication between your browser and GStudio's backend (Firebase Hosting, Firestore, and Cloud Functions) is encrypted in transit using TLS (HTTPS). Unencrypted HTTP requests are automatically redirected to HTTPS by Firebase Hosting.

Server-side access control

Sensitive operations — such as running the weekly intelligence brief, sending invitation emails, recording e-signatures, and managing the user allowlist — are handled by Cloud Functions that verify the caller's identity server-side before executing. These functions are deployed on Google Cloud Run and are not directly accessible from the public internet without a valid Firebase Auth token.

What the administrator can see

The platform administrator (Dr. Solvason) manages the approved-user allowlist and global tool permissions. He does not have programmatic access to the contents of other users' tool data (notes, schedules, runway figures, etc.) — each user's data is stored under their own UID and is not readable by the admin account through normal application flows. Firestore rules enforce this separation.

Limitations & disclaimer

GStudio is built on Google's Firebase and Cloud infrastructure, which provides enterprise-grade physical security and availability guarantees. However, no digital system is immune to breach. This tool is not designed to store confidential, proprietary, personally identifiable, or otherwise sensitive information. You are solely responsible for ensuring that data you enter is appropriate for an unsecured cloud environment. Please review the Data Safety Disclaimer you agreed to at sign-up.