Security and your data
This page explains how your terminal handles the keys you connect and the records it keeps. For the legal terms, see the Privacy Policy and the End User License Agreement.
Keys and passwords you connect #
- Every key, token and password you save in Settings → Connections is encrypted on the server with AES-256-GCM before it is stored. Each encrypted value is tied to its own connection and field, so it can't be moved to another one. The encryption key is kept apart from the database.
- Secrets are write-only. After you save, the terminal never shows a secret again; at most it shows the last few characters so you can tell keys apart.
- A blank secret field on an existing connection means "keep what is stored". Typed secrets are cleared from the screen after you save or close the panel.
- Test results carry only derived facts (an account name, a mode, a count), never the provider's raw answer, and any secret is removed from messages.
What the terminal does with connected tools #
- It reads. No connector creates, changes or deletes anything in your tools. Three connections send on your behalf when you set them up to: Email sends invitations and set-password links, Slack alerts posts alerts to the channel you chose, and DIN CTRL carries answers back to the agents that asked.
- Each connector reads only what its screens need. For example, Gusto keeps name, job title, department, start date and whether the person still works there, and never pay, tax IDs, birth dates or addresses. HubSpot keeps counts and totals only, never contact names or emails.
- Ask each provider for read-only access where it offers it: a Stripe restricted key, an UptimeRobot read-only key, a Cloudflare read-only token, read scopes in HubSpot and Greenhouse, and the Viewer role in Google Analytics. Each connector page says exactly what to grant.
Calls the terminal makes #
- Only to
https://addresses on the public internet. The terminal refuses addresses that point at private, local or reserved networks, checks the address it resolved before connecting, and never follows redirects. - Calls time out after 15 seconds.
Signing in #
- People sign in with their own account. Invitations use a single-use link that expires (72 hours unless your terminal sets another limit); the person chooses their own password of at least 12 characters.
- The terminal keeps its sign-in in the browser tab's memory only.
- Roles decide what each person can change. Screens show controls only to people with the right role, and the engines check every change again on the server.
History is kept #
- Nothing is deleted from the terminal's screens. Connections, brands, Operate items and other records are retired, not deleted, and their history stays.
- Each connection's History lists every change, test and sync with who did it.
- Every import is recorded in the audit trail, row by row.
Stopping a connection #
- Retire stops every sync for good and keeps the history.
- Disconnect from QuickBooks also asks Intuit to revoke the terminal's access and deletes the stored tokens.
- To be sure, also remove the terminal's access inside the provider (each connector page says where).