Privacy and what each connection can see
Every way into AUGMTD reads state, never content, and none of them can act. This page says what each one reaches.
The rules every connection follows
- One person, never more. A key or a connected app acts as the person who made or allowed it, in one workspace, and sees what that person sees. It stops when they revoke it, when they leave the workspace, or when the workspace is suspended.
- Read and propose only. No connection can send, post, book, apply, close or dismiss anything. A proposal is a card that waits for the person, expires after 24 hours, and is withdrawn when the key or app is revoked.
- Recorded. Every proposal is a line in the person's activity, and reads are summed per key and hour. An owner or admin sees every member's keys and can revoke any of them.
- Outside text is data. Anything that came from mail, meetings or other people is marked
{ "text": "…", "untrusted": true }. - A workspace may allow reading only. With Connected apps and keys may only read on, no key or app can propose anything.
What each connection reaches
| Connection | Set up by | Reads | Can do |
|---|---|---|---|
| A key (REST, MCP, the CLI) | the person, for themselves | their tracked work, promises, approvals, changes; with team memory, the shared work they belong to | propose, if its scopes allow |
| A connected app (Claude, ChatGPT, agents) | the person, by clicking Allow | the same, through the MCP server only | propose, if allowed |
| A destination (webhook, feed, team chat digest) | an owner or admin | events about tracked clients, from each member who agreed, from that moment on | nothing: it only receives |
| A source (inbound webhook) | an owner or admin | nothing | send updates that become evidence or a card a person confirms |
What never leaves
- Email bodies and subjects, quotes, meeting transcripts and notes, files and attachments, drafts.
- Mail with people who are not on a tracked client.
- A colleague's work that the person is not a member of, and a member's work they hid or did not share.
- Anything per person: no connection gets activity counts, response times or rankings of people. Patterns are per stage or per process, over at least 5 runs and 3 people.
- A free email domain, and a one-person company's domain except at the
labelslevel.
Where the data is processed
A connection reads what AUGMTD already holds in the workspace's own region and tier. What your tool then does with it (an AI app, a CRM, an automation) is governed by that tool's own terms: choose tools your company has approved for this data.
Stop a connection
- A key: Settings → Connections → API keys, Revoke. It stops at once.
- A connected app: Settings → Connections → API keys → Connected apps, Disconnect.
- A destination or source: an owner or admin turns it off or removes it in Settings → Connections.
- Team memory: each member can hide work or switch sharing off; an owner or admin can turn it off for the workspace.