Have you passed an independent security assessment?

Not yet, and you should know that before you connect a mailbox. Monty has not passed CASA (Cloud Application Security Assessment), the independent review Google requires of apps that use restricted Gmail scopes. We are pursuing it. Until it is granted, treat Monty as pre-certification software and connect Google mailboxes accordingly. This applies to Gmail and Google Workspace only — Outlook and Microsoft 365 mailboxes are unaffected. Everything described in the answers below is in place today regardless; what is outstanding is the independent audit of it, not the controls themselves. Monty is also in beta: features can change, and AI output can be wrong, so review anything before it reaches a contact.