Security
Mica is an editor, not a vault.
Your documents are markdown files in your own Google Drive. Mica opens them, lets people and AI agents write in them together, and saves them straight back. It never keeps a copy.
How it works
Three places your words can be, and only one of them keeps them
- 1
Your Google Drive
The only place your documents are stored. Each one is a .md file you own, with Drive's own sharing, Drive's own backups and Drive's own revision history.
- 2
Your browser
Where you read and write. Mica fetches a file from Drive when you open it and saves your changes back to the same file.
- 3
The live-editing relay
When people edit together, the relay holds the text in memory so everyone sees each keystroke. It never writes the text to disk, and lets it go shortly after the last person leaves.
What Mica keeps
The least it needs to run your account, and nothing you wrote
Mica keeps
- Your name and email address, from Google
- The IDs of the folders you connect, and of your bookmarks and recent files
- The names and colors of tags you create
- An encrypted key from Google, so Mica can open your files when you ask
- A record of what AI connections changed: the tool, the file ID, the size of the change and, for a share, who it went to
Mica never keeps
- The text of your documents, in its database, its logs, its analytics or on any disk
- Document titles, file names or folder names
- Your version history or pasted images, which are files in your own Drive
- A search index, or any other copy of your Drive
- The AI keys you add to the Assistant
Drive access
Why Mica asks for your Drive, and what it does with it
Google's narrower permission only covers files picked one at a time. It can't connect a team folder or a Shared Drive, and it can't follow the sharing your teammates already have in Drive. So Mica asks for Drive access, then holds itself to far stricter rules than that permission allows.
Only the folders you connect
Mica shows the folders you add, and any file you open from a link. Nothing else in your Drive appears in Mica.
Only when someone asks
Mica opens a file when you, a collaborator or an AI connection you approved asks for it. There is no crawler, no scheduled job and no index; search asks Drive directly, at the moment you search.
Only the files you write in
Mica edits markdown, text and CSV files. Word, Excel and PDF files are shown read-only.
Nothing is ever permanently deleted
Delete moves a file to Drive's Trash, and only when you choose it. Mica's own cleanup touches only its own files, such as images you have removed from a doc.
Sharing changes only when you click Share
Who can see a file is whatever Drive says. Mica writes a real Drive permission only from its Share dialog, at your request.
People
Nobody at Mica reads your documents
Mica's servers pass your documents between Drive and your browser. They don't store them, and Mica's people don't read them. The only exceptions are the narrow ones Google's Limited Use rules allow: when you ask Mica to look at a specific file for support, when a security incident requires it, or when the law does.
- Mica never sells your data, never shows ads, and never uses your documents to train AI models.
- The key Google gives Mica is encrypted, and Mica's own admin tools cannot display it.
- Staff admin access is limited to a small group, behind Google sign-in with 2-step verification enforced.
- AI keys you add to the Assistant stay in your browser. Requests go straight to Anthropic, OpenAI or Google, never through Mica.
Trust
Built to earn your trust
Mica asks for Drive access so it can open the files you choose. It is independently assessed, verified by Google, and keeps no copy of what you write.
Your docs stay in your Drive
Every document is a .md file in your own Google Drive. Mica's servers keep no copy of the text, the title or the file name.
CASA Tier 2 validated
Google requires an independent security assessment of every app with full Drive access. TAC Security validated Mica against CASA Tier 2, assurance level 1.
Verified by Google
Google reviewed how Mica uses Drive access and approved it under its API Services User Data Policy.
Run by a SOC 2 Type 2 company
Mica is built and run by Bullwhip, whose security controls are independently audited to SOC 2 Type 2 by Accorp Partners CPA LLC.
Practices
How Mica protects your account
Encrypted in transit
Every connection uses modern TLS, and browsers are told never to connect to Mica without it.
Encrypted at rest
Mica's database is encrypted, and the key Google gives Mica is encrypted a second time on top.
Sign-ins out of reach
Your sign-in lives in a secure cookie that code on the page cannot reach, and Sign out everywhere ends every session at once.
Checked on every change
Every change to Mica's code is scanned for vulnerable dependencies and leaked secrets.
Analytics without identifiers
Mica's analytics are cookieless and carry no names, emails or file IDs.
Least privilege for AI
Claude and ChatGPT connect through Mica's MCP server, act under your own Drive permissions, and can be revoked at any time.
Control
You can take it all back, any time
- Remove Mica's access to your Drive from your Google account at myaccount.google.com/permissions. Mica stops being able to open your files at once.
- Disconnect a folder and it leaves Mica. Nothing in Drive changes.
- Revoke an AI connection under Account → Connections.
- Sign out everywhere from the account menu ends every Mica session on every device.
- Delete your account by emailing privacy@bullwhip.io. Your documents stay in your Drive either way.
Questions, answered
Can Mica see my whole Drive?
Google's permission covers your Drive, but Mica only shows the folders you connect and the files you open, and only opens a file when someone asks it to. It never scans, indexes or copies the rest.
What happens to my docs if I stop using Mica?
Nothing. They are .md files in your Drive and stay exactly where they are, readable by anything that opens text files. Mica's version history and pasted images are files in your Drive too, beside each doc.
Does Mica use my documents to train AI?
No. Mica does not use your documents or any Google data to train AI models, and does not let the services it uses do so on its behalf. AI only sees a document when you ask an assistant to work on it.
Who runs Mica, and where?
Mica is built and run by Bullwhip Technologies LLC on Google Cloud in the United States. Bullwhip's SOC 2 Type 2 report is available on request from its Trust Center.
How do I report a security issue?
Email privacy@bullwhip.io with what you found and how to reproduce it. It goes to the team that runs Mica.
Bring your Drive. Keep your markdown.
Free during early access. Connect a folder and start writing.
Start free