# Security and privacy

> How tool connections are encrypted, why the AI model never sees your credentials, which AI provider processes your messages, and how long data is kept.

Source: https://asktack.com/docs/security-privacy/

The assistant acts in your business tools, so it's built to hold as little access as it needs and to keep credentials away from the AI.

## Your credentials

- **One-tap sign-in (OAuth) is preferred.** You approve access on the tool's own page, and we never see your password.
- **OAuth tokens** are held by our own self-hosted connection service, which stores them encrypted.
- **API keys you paste in** are encrypted with AES-256-GCM using a data key that belongs to your organization only. That data key is itself encrypted ("wrapped") by a master key kept in a separate key management service, so the key that unlocks your credentials is never stored next to them.
- **Saved website logins** (coming soon, for tools with no API) are encrypted the same way. The assistant's browser types them in only on the site they were saved for, only after you approve that one sign-in, and the AI only learns which boxes were filled. See [Saved logins and sign-in help](https://asktack.com/docs/saved-logins/).
- **Photos you text** are fetched through private links that expire after 15 minutes. See [Texting photos](https://asktack.com/docs/photos/).
- **The AI model never sees credentials.** When the assistant decides to, say, create a job, our server fetches the token, makes that one call and discards it. Tokens and keys aren't put into prompts, and our code doesn't write them to logs.

## Who can do what

- Only messages from your own verified iMessage address or phone number can give the assistant instructions.
- Text that comes from your tools, such as customer notes, emails or documents, is treated as information and never followed as instructions.
- Anything that sends to another person, moves money or deletes a record waits for your confirmation (see [Confirmations and undo](https://asktack.com/docs/confirmations-and-undo/)).
- Every action the assistant takes is recorded, with what it did, when and whether it worked, and connection changes go to an audit log. You can review it on the **Activity** tab of your [account dashboard](https://asktack.com/docs/account-dashboard/), or ask the assistant what it did ("what did you do for Patel today?").

## AI provider

Your messages are processed by Anthropic's Claude models, through Anthropic's commercial API, to understand requests and decide what to do. We send only what's needed for the request.

Under Anthropic's [Commercial Terms](https://www.anthropic.com/legal/commercial-terms), Anthropic may not train models on content sent through its API, and its [privacy center](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training) says inputs and outputs from its commercial products aren't used for training. We don't use your data to train models either.

If we add another AI provider, we'll list it here before it processes your messages.


## Messaging

- iMessage is end-to-end encrypted between devices; [Apple's platform security guide](https://support.apple.com/guide/security/imessage-security-overview-secd9764312f/web) says Apple can't decrypt it. On our side, the receiving device is a Mac we operate. That Mac decrypts your messages and passes them to our servers so the assistant can read and answer them. From that point they're protected by our own security, not by iMessage's encryption.
- Reply STOP at any time to stop messages.

## Data retention and deletion

- **Disconnecting a tool** tells the tool to cut off our access and deletes its stored token or key, and our copy of names from it, right away. Records the assistant already created in that tool stay there.
- **Closing your account:** email privacy@asktack.com and we'll delete your messages, connections and profile, except records we must keep by law (such as billing records).
- See the [Privacy Policy](https://asktack.com/legal/privacy/) for retention periods and your rights.


## Reporting a security issue

Email support@asktack.com with "Security" in the subject. Please don't include passwords or keys.