Account and security

You can sign in to DataPipe with Google, ORCID, GitHub, or an email address and password. How you sign in has nothing to do with where your data goes: a Google sign-in does not give DataPipe access to your Google Drive, and connecting Google Drive does not change how you sign in.

One account can have several sign-in methods linked to it, and you add or remove them in your account settings. Adding a second method is worth doing: it is what keeps you in the account that owns your experiments if you ever lose access to the first. DataPipe will not let you remove your only remaining method.

DataPipe needs permission to write to your storage account, and all tokens are stored encrypted. For Google Drive and Zenodo you authorize DataPipe directly, and it manages and refreshes those tokens for you. For Dataverse you supply an API token, so create one specifically for DataPipe and revoke it when you are done collecting data. You can disconnect any provider from your account settings at any time.

Three details behind that, for anyone who needs them for an ethics application or a data management plan:

• Every stored credential — access tokens, refresh tokens and pasted API tokens alike — is encrypted with AES-256-GCM before it is written, and decrypted only in the server code that is about to make a request to your provider.
• Credentials live on your user record, and nothing running in a browser can write them: the database rules permit only the server to add or change a stored connection.
• The only credential that ever reaches your browser is a short-lived Google access token, handed over when you use the Drive folder picker to choose where an experiment's data should go. The refresh token behind it never leaves the server, and no other provider's credentials are sent to the browser at all.

Disconnecting a provider deletes DataPipe's stored credential for it and stops new data from reaching it. It never removes data already stored there, and you can reconnect at any time.

What disconnecting affects, and what it leaves alone. Disconnecting

You must have signed in within the last five minutes to delete an account. If it has been longer, DataPipe asks you to sign in again first — the same protection that stops a stolen session from destroying an account.

DataPipe deletes its own data first and your sign-in record last. If something fails partway, your account still exists and still owns everything that survived, so you can simply try again. Nothing is left stranded without an owner.

What is removed

• Every experiment you own, along with its filename record.
• Every queued upload, including files you have not downloaded.
• The metadata and log documents belonging to those experiments.
• Your user record, which is where your encrypted provider credentials live.

What is not removed

Nothing in your storage provider. Your Google Drive folders, Dataverse datasets, Zenodo depositions, and OSF components all stay exactly as they are, in your own account, with everything DataPipe wrote to them. Deleting a DataPipe account removes DataPipe's ability to write to them, not the data itself.

What DataPipe holds while an experiment is running, and for how long. What DataPipe stores