SPMC CUSTOMER-OWNED GOOGLE DRIVE STORAGE — SETUP

Purpose
- Stores encrypted Business Communication voice files in the customer's own Google Drive.
- Audio is encrypted in Organizer/Team BEFORE upload.
- The bridge never receives the decryption key or plaintext audio.

Setup (customer account)
1. Go to script.google.com while signed in to the CUSTOMER'S Google account.
2. Create a new Apps Script project.
3. Paste Code.gs from this folder.
4. Run setupPrivateStorageBridge() once and authorize Google Drive.
5. Copy the generated token from the execution log/result.
6. Deploy > New deployment > Web app.
7. Execute as: Me. Access: anyone allowed by the customer's deployment policy who has the bridge token.
8. Copy the Web App /exec URL.
9. In Organizer > Business Communication > Administration:
   - Set/Change Private Media Key (16+ characters).
   - Enable Encrypt voice messages before upload.
   - Voice storage = Customer-owned Google Drive bridge.
   - Paste Bridge URL and Bridge Token.
   - Save settings.
10. Give the company Privacy Key to employees through a separate trusted channel. Team asks for it once per device.

Important
- Do NOT send the Privacy Key through SPMC Business Communication itself.
- Losing the Privacy Key means encrypted historical audio cannot be decrypted.
- Keep a secure offline recovery copy of the Privacy Key.
- Rotating the key does not re-encrypt old audio automatically.
