Business Connector / Security
Security, explained in plain words.
What happens when you press Allow, where that access is kept, who can see your data, and how it all goes away when you say so.
Access is granted, never handed over.
You sign in on the platform's own page
Google, Meta, TikTok, LinkedIn, Jobber, Intuit and Xero show their own sign-in and permission screens. We never see, ask for or store your password.
Each feature asks for its own permission
Nothing is requested until you switch a feature on, and each one asks only for the access it uses. Every integration page lists the exact permissions.
You can take it back at any time
Disconnect in your dashboard or in the platform's own settings. You don't need to ask us or your agency first.
How access is stored.
An access token is the key a platform gives us after you press Allow. This is how we look after them.
Encrypted by us, then stored
Tokens for social networks, Jobber, QuickBooks Online and Xero are encrypted by our application with AES-256-GCM before they are saved, using a key held only on our servers.
Encrypted at rest
Everything else, including Google access, is kept in our managed database, which is encrypted at rest with AES-256 by our database provider.
Never in your browser
Tokens are used only by our servers, only to call the platform for the feature you connected, and are never sent to a browser.
Encrypted in transit
All traffic to and from the Service, and to every platform, travels over TLS (HTTPS).
Who can see your data.
You and your agency
Your data appears only in your own dashboard, for your authorised users and the agency that serves you. Database access rules keep each business's records separate from every other's.
Our operators, only when needed
Access to production systems is limited to the people who run the Service, each with their own credentials, and used for support, security and keeping things working.
Nobody else
We don't sell data, use it for advertising, or use it to train artificial-intelligence models. See the Privacy Policy for exactly which providers process what.
Where it runs.
The Service is built on established providers, each under contract to protect the data and use it only to provide its service to us.
The full list, and what each one receives, is in section 10 of the Privacy Policy.
- Supabase
- Database, sign-in and file storage, United States
- Fly.io
- Application servers
- Vercel
- Web hosting
- Cloudflare
- Domain name services
- Mailgun and Amazon Web Services
- Email delivery
- Stripe
- Payments
- Twilio
- Phone calls and text messages
- Anthropic, Google, OpenAI, Perplexity
- AI features you start, through their commercial APIs, which don't train on the data
Disconnecting deletes the stored access straight away. Closing your account deletes the rest within 30 days.
Found a problem? Tell us.
If you think you've found a security issue, or you see a connection request you weren't expecting, email us. Please don't test against other people's accounts.
support@businessconnectorhq.com