What an AI assistant can access
Access is controlled by scopes. At connection time you see a consent screen listing the scopes the assistant is requesting. You can deny any of them. An assistant with a given scope can read or modify only the data that scope covers.| Scope | Data exposed |
|---|---|
profiles:read | Profile names, emails, phone numbers, DISC / Focus / Core scores, AI-generated behavioral debriefs for profiles on the connected account |
profiles:write | Create new profiles (sending an assessment invite), update profile metadata, delete profiles |
tags:manage | Tag names, colors, and the profile-to-tag relationships for tags on the connected account |
account:read | Account name, configured assessments, resource aliases on the connected account |
account:write | Account settings and resource aliases on the connected account |
How your data flows
- You tell the assistant something in plain language.
- The assistant decides whether to call a Profile tool and which one.
- The call goes from the assistant’s servers to Profile over HTTPS, authenticated by an OAuth access token scoped to your account.
- Profile returns the requested data (or performs the requested action).
- The assistant uses the response to answer you in chat.
What Profile does with the data
Profile logs every connector action in your account’s audit trail. We do not send your behavioral data or account contents to the AI provider for training, analytics, or any purpose other than fulfilling the tool call you triggered.What the AI provider does with the data
Every AI provider has its own data handling terms. When you use Claude, Anthropic’s policies apply. When you use ChatGPT, OpenAI’s policies apply. Check the terms of the specific assistant you’re connecting to. Profile does not control whether the AI provider uses conversation content for model training, caching, or fine-tuning. If that matters for your use case, read the provider’s documentation carefully before connecting.Retention
- Access tokens expire automatically after approximately one hour and are refreshed by the assistant as needed. Expired tokens cannot be used.
- Connection records (the list of apps you’ve authorized) persist until you revoke them.
- Audit logs of connector actions follow Profile’s standard audit retention.
- Profile data created by connector actions (new profiles, tags, invites) persists normally, same as if you’d created it through the web app.
Revoking access
At any time, you can:- Open Profile in your browser.
- Go to your User Profile.
- Open the Connected apps section.
- Click Revoke on the connection you want to disconnect.
Multiple Profile accounts
If you belong to more than one Profile account, each connection is tied to exactly one account. Connecting an assistant while signed in to Account A does not grant it access to Account B. To give the same assistant access to a second account, sign into that account in Profile and connect again.Your rights
You can:- View all active connections at any time from the Connected apps section of your user profile.
- Revoke any connection instantly.
- Export or delete your account data through Profile’s standard data controls. See our Data Privacy page.