Account & security
Security and privacy
How keys are stored, who can see what, and how to revoke access.
- Your API keys are encrypted with AES-256-GCM before they're stored, are never shown again, and are never sent to your browser.
- Your data is isolated per company by database row-level security. Employees only ever get CRM access.
- AI processing happens with your own Anthropic or OpenAI account, under their API terms. API data is not used to train their models by default.
- Connected AI apps (MCP) act only within the access you granted, never see your keys, can't delete anything, and are logged. Revoke them in Settings → AI connections.
- Grok Bot always asks before emailing, spending or deleting.
- The Help assistant never needs your keys. Don't paste keys, passwords or private data into it.
If you think a key leaked, delete it in the provider's dashboard, create a new one, and paste the new one in Settings.