trust

Credentials and encryption

The keys and tokens that let a connector reach a client's tools are the most sensitive thing we hold. This is how they are handled.

• They are encrypted with AES-GCM before they are stored. For TechTrack Connect accounts there is no unencrypted fallback: if encryption is unavailable, saving fails instead.
• Each credential belongs to one connector. Apps on another connector, or in another account, cannot use it.
• Credentials are never shown back to you, never sent to your assistant and never written to logs.
• Templates only suggest which apps to add. They never copy credentials, so every client connects fresh.
• For your connectors, the activity log keeps the tool name, the field names of its arguments (never their values) and whether the call worked. Results are not kept.
• Your connector address is a secret too. See Add it to your assistant.