> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getsmartalex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and permissions

> What an AI app can and cannot do in your SmartAlex workspace once you connect it, which actions ask you first, and how to disconnect it.

When you connect Claude, ChatGPT, Cursor, Codex or another AI app to SmartAlex, it works as you. It sees what you can see and does what your role allows, nothing more. This page explains how that works and how to take access away.

## How the AI app signs in

* You sign in to SmartAlex in your browser and press **Allow**. The AI app never sees your password.
* No API key or password is saved in your project files.
* The AI app works in the workspace you last opened in SmartAlex. To work in a different workspace, switch to it in SmartAlex first.
* Each person connects with their own sign-in, so everything the AI app does is done as that person.

## What it can do

The server has 80 tools. Which ones your AI app gets depends on you:

| Kind of tool | How many | Example |
| - | - | - |
| Reads only | 31 | List contacts, read a call transcript, check usage |
| Creates or changes data | 30 | Create an agent, update a contact, pause a campaign |
| Asks you first | 19 | Start a campaign, buy a phone number, delete an agent |

* **Your role applies.** If your role cannot delete contacts in SmartAlex, the AI app cannot either. A refused action says your role can't do it.
* **Your plan applies.** Tools your plan or add-ons don't include are hidden. Campaigns and buying numbers need the Outbound Campaigns add-on. HTTP tools and creating or deleting webhooks need Power Tools. Creating an agent needs a free agent slot.
* **Changes are live.** If an admin changes your role or permissions, your AI app gets the new permissions too.

## Actions that ask you first

Some actions spend money, contact real people or delete something for good. For these 19 actions, the AI app first gets a preview of exactly what will happen, including the cost where there is one. It must show you the preview and wait for your yes. It can then run the action only with a one-time code from that preview, which works once and expires after 10 minutes.

This is on for every workspace and cannot be turned off.

| Why it asks | Actions |
| - | - |
| Spends money | Buy a phone number, buy an agent slot, import knowledge from a website (pages past your plan's allowance are charged) |
| Contacts people | Start, resume or schedule a campaign, add contacts to a campaign, call someone back now, place a test call, invite a team member |
| Deletes for good | Delete an agent, contact, deal, knowledge item, webhook or HTTP tool, release a phone number, stop a campaign, remove a team member |

<Warning>
  The preview step makes sure the action matches what was shown, but SmartAlex cannot see whether you personally said yes. Read each preview before you approve it, and be careful with AI app settings that run tools without asking you.
</Warning>

Everything else runs straight away, for example editing a contact, pausing a campaign or changing an agent's prompt. Prompt changes are saved as versions, so you can undo them.

## What it cannot do

There are no tools for:

* your password, sign-in or two-step login settings
* payment methods or card details
* deleting your workspace
* API keys

Do these in SmartAlex itself.

## Your data

What a tool returns, such as contact details or call transcripts, is sent to the AI app you connected. That app handles it under its own terms and settings. Check your AI provider's data settings before you connect a work account.

When you create a webhook, its signing secret is shown once in the chat. Save it somewhere safe, and remember that your AI app may keep the chat history.

## Team members

* Each team member connects with their own sign-in and their own role.
* When you remove someone from your workspace, their AI apps lose access to it on their next request.
* To limit what someone's AI app can do, change their role or permissions in SmartAlex.

## Disconnect an AI app

<Steps>
  <Step title="Open your account">
    In SmartAlex, open the user menu at the top right and choose **Account**.
  </Step>

  <Step title="Go to Security">
    Open the **Security** tab and find **Where you're signed in**.
  </Step>

  <Step title="Sign it out">
    Find the AI app in the list and press **Sign out**.
  </Step>
</Steps>

Allow up to an hour for it to stop completely.

<Note>
  Signing out of the SmartAlex website does not disconnect your AI apps, and neither does removing SmartAlex from the AI app. Use **Where you're signed in** to end an AI app's access.
</Note>

If your AI app later says its sign-in has expired, sign in again from the app.

<CardGroup cols={2}>
  <Card title="Get started" href="/mcp/getting-started">
    Connect an AI app by signing in.
  </Card>

  <Card title="Trust and security" href="/security">
    How SmartAlex protects your account and data.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.