Account and security

You can sign in to DataPipe with Google, ORCID, GitHub, or an email address and password. How you sign in is separate from where your data goes. Signing in with Google doesn't give DataPipe access to your Google Drive, and connecting Google Drive doesn't change how you sign in.

One account can have several sign-in methods, which you add or remove in your account settings. We recommend adding a second one. If you ever lose access to the first, it's what keeps you in the account that owns your experiments. DataPipe won't let you remove your only remaining method.

DataPipe needs permission to write to your storage account, and it stores every token encrypted. For Google Drive and Zenodo, you authorize DataPipe directly and it manages and refreshes those tokens for you. For Dataverse, you supply an API token yourself, so create one just for DataPipe and revoke it when you finish collecting data. You can disconnect any provider from your account settings at any time.

If you need more detail for an ethics application or a data management plan, here are the specifics:

• Every stored credential, whether an access token, a refresh token, or a pasted API token, is encrypted with AES-256-GCM before it is written. It is decrypted only in the server code that is about to make a request to your provider.
• Credentials live on your user record, and nothing running in a browser can write to them. The database rules let only the server add or change a stored connection.
• The only credential that ever reaches your browser is a short-lived Google access token, used by the Drive folder picker when you choose where an experiment's data should go. The refresh token behind it never leaves the server, and no other provider's credentials are sent to the browser at all.

Disconnecting a provider deletes its stored credential and nothing else. Data already in your storage stays where it is. Disconnecting

You need to have signed in within the last five minutes to delete your account. If it has been longer, DataPipe asks you to sign in again first. This is the same protection that stops a stolen session from destroying an account.

DataPipe deletes its own records first and your sign-in record last. If something fails partway through, your account still exists and still owns whatever is left, so you can simply try again. Nothing is ever left behind without an owner.

What is removed

• Every experiment you own, along with its filename record.
• Every queued upload, including files you haven't downloaded.
• The metadata and log documents for those experiments.
• Your user record, which is where your encrypted provider credentials live.

What is not removed

Anything in your storage provider. Your Google Drive folders, Dataverse datasets, Zenodo depositions, and OSF components stay exactly as they are, in your own account, with everything DataPipe wrote to them. Deleting your account removes DataPipe's ability to write to them, not the data itself.

What DataPipe holds while an experiment is running, and for how long. What DataPipe stores