Keys
Whose key is whose
The whole proposition is that a business owner never handles a credential, and that is a claim worth being able to check. So here is the division, with nothing rounded off.
Held by the platform
One key per capability, on the platform's own account, used by every workspace and metered per workspace on the server. These are switched on when a workspace is created.
Held by you, granted to us
These are tied to your business's identity, so there is no shared key that could stand in. Each one is a standard OAuth grant: you approve it with your provider, we never see your password, and you can revoke it from your provider's own account page without asking us. Gmail is asked for read-only — it cannot send, delete or file anything, which is how "nothing goes out without you" is kept true rather than promised.
- 01
You are never shown a key
There is no field to paste one into anywhere in this product, and no screen that would display one. That is enforced by the shape of the code rather than by a rule: the type that crosses from the server to your browser has no field for a token in it.
- 02
Pooled usage is metered, not estimated
What your workspace spends on a shared capability is counted against your workspace on the server, at the point the call is made. The figure under each reply is that count, not a guess printed to look reassuring.
- 03
A connection is asked for where it is needed
Not on signup, not in a setup wizard, and not as a list of nineteen toggles. The agent asks when a job actually requires it, in the channel that job is in, with the reason in the sentence above the button.
- 04
A connection can be ended from either side
Press Disconnect here and the grant is handed back to Google and the token deleted, in that order. Remove it from your Google account instead and the effect is the same from the other direction: the capability goes grey and the agent says so the next time it needs it. Nothing keeps working on a grant you have withdrawn.
- 05
Nothing is stored that does not have to be
A grant is a refresh token, the address it was granted on, and the scopes that were actually approved. The token is encrypted with AES-256-GCM before it reaches the database and is never returned by any endpoint this app serves. Your mail is read at the moment a job needs it and is not copied into this platform's database.