Security and data handling
What Operate As keeps and doesn't, how clients' access is encrypted and protected, and how long data is kept.
Your clients trust you with their Google, Slack and HubSpot accounts. Here's what we store, how it's protected, and how either of you ends it.
What we keep
- The client's name, and their email address if you add one.
- Which services you asked them for, and the link that opens their page: stored as a one-way hash to find it by, and encrypted so you can copy it again.
- For each connection: the provider, the permissions they approved, and when it was last used.
- Which account they connected each provider with, such as
jane@bakery.com, kept even after they remove it. - For each client's passkeys: the public key, which can check a sign-in but can't make one, and a hash of each browser session signed in to their page.
- The connection's access and renewal key, encrypted.
- A count of your API calls per day, for your plan's allowance.
- A log of each call your keys make: which key, client and service, the path without its query, and how the service answered. Never what the call carried.
- A record of who in your agency did what, such as adding a client or creating a key.
What we don't keep
- Your clients' passwords. They sign in on Google's, Slack's or HubSpot's own screen, never ours.
- The data your calls carry. A spreadsheet's rows or a message's text pass through and aren't stored.
- Your API keys. We keep a one-way hash, so even we can't read a key back.
- Anything after Remove. A removed connection, or a deleted client, is gone from our database.
Encrypted at rest
- Fernet is AES encryption with an HMAC: stored values can't be read or altered without the key.
- Keys live in a secrets manager, apart from the database.
- Keys rotate: a new key encrypts, and the old one still reads until everything is re-encrypted.
Kept on our server
A client's access is never sent to you, your n8n or your agents. We attach it to each call ourselves. See How it works.
Your workflows hold only an oa_ key. A leaked workflow export exposes a key you can revoke, limited to the clients, services and actions you chose, not a client's account.
Checked on every call
- The key exists and hasn't been revoked
- The key allows this client, service and action, and the spreadsheet, calendar or channel if you limited it to some
- The client is yours, and you asked them for that service
- Pass-through stays on the service's own API, never another address, however the path is encoded
- The call fits your plan's calls a minute, and the key's own cap if you gave it one
- One client's access is never used for another's call
- The provider checks the call against what the client approved
The full order of checks, with the status each one answers, is on How it works.
Clients approve exactly what you need
See Permissions.
Easy to end, never quiet
| How | |
|---|---|
| Remove | The client from their page, or you from the dashboard, at any time. We cancel with the provider where it allows it, and delete our copy. See Removing access |
| Delete a client | Cancels and deletes every connection, and their link stops working |
| Renewed | Access lasting about an hour is renewed just before a call needs it, so workflows run for months |
| Checked daily | Ended access is found before a workflow runs into it |
| Alerted | The moment access ends: a dashboard notification and an email to your team, the client's link emailed to them, and your webhook if your plan includes it. See Keeping access alive |
Your account is protected too
- Sign in with a password, Google or your company's single sign-on, with two-factor codes
- Owners always sign in with two-factor, and can require it of everyone in the workspace from Settings
- Download everything kept about your account from your account page
- Sessions stored as hashes, extended while active and capped at 30 days
- Logins, sign-ups and resets rate limited, and an email whenever how you sign in changes
- Client links only open the client's page. Nothing is connected, changed or removed until the client saves a passkey, and after that the page opens only with it. There's no password and nothing in their inbox that opens it, so a hacked inbox gets nowhere
- Client pages are limited per network, and cut off after a few keys a provider refuses, so a link can't be used to test stolen keys
- The account each client connected with is remembered, and you and the client are both emailed if a different one is connected
- A client who loses their passkeys gets back in only through you, with a code you read out to them. It replaces the passkeys they had and signs out every browser
- Roles and permissions for your team, and on plans that include it, an audit log of every action
- Webhooks signed with a secret and a timestamp, sent only to public HTTPS addresses
- Services holding patients' health records stay off until we've signed a business associate agreement with you
- A strict Content-Security-Policy on every page, and cross-site requests refused
How long data is kept
| Data | Kept for |
|---|---|
| Connections | Until the client or you remove them, or you delete the client |
| Activity log | 730 days by default |
| Call log | As long as your plan keeps call history: 7 days to a year |
| Failed sign-ins and password reset requests (they record addresses and IPs) | 30 days |
| Notifications | 90 days |
Certifications
We don't claim any security certifications. If you or a client needs more detail, or you think you've found a security issue, contact us through the website and we'll answer quickly.