Security and data handling

How are API keys, code, and prompts handled?

Requests move through Google Apps Script Copilot to the AI provider you select. BYOK credentials use that same request path.

Last reviewed 2026-07-20

Verified request path

See the route before you send.

The browser extension collects only the request context needed for the feature you invoke.

Browser extensionGoogle Apps Script Copilot WorkerSelected AI provider

Data handling at a glance

Provider terms and retention settings apply to provider-side processing.

Processed by: Extension and Worker request path
Retention: Used to authenticate the configured provider request; do not treat this as a no-contact path.
Your control: Remove or replace the key in extension settings.

Processed by: Extension, Worker, and selected provider
Retention: Processed for the requested response; provider retention is governed by that provider.
Your control: Choose the provider, avoid sending secrets, and delete project context where the extension provides that control.

Processed by: Google Apps Script Copilot service providers
Retention: Retained as needed for account operation, billing, support, and legal obligations.
Your control: Use account controls or contact support.