Data and security

Every area keeps its records in the database and runs on Conecto's servers.

These areas also send data to the places named here.

account_data_locations gives the agent the same list, area by area, for the business's own records of processing.

• A key is stored as its SHA-256 hash, with its last four characters to tell keys apart. The key itself is shown once, when it is made.
• A key can be kept to some areas, some tools, reading, some networks and an end date. Keys and scopes has the fields.
• A tool's secret arguments, like a password or a token, are encrypted while the call waits or runs, and kept as [redacted] once it ends. The call log and the API show [redacted] in their place.
• A tool's secret answer reaches the bot, and the call log keeps [redacted] in its place.
• The credentials of connected systems and notify channels are stored encrypted and never shown back.
• The Vault keeps the business's own secrets encrypted. A read of one is counted and stays out of the call log.

Every call is logged with the key that made it, its status, what it cost and what it was given and answered. GET /v1/calls, the account_list_calls tool and the Activity page of the account show it. A scoped key sees its own calls only. A call's input and output are cleared 30 days after it was made, and the rest of its record is deleted after 13 months. When the business erases a person, the calls that name them lose their contents at once.

account_audit_log lists the account's admin and security actions, like keys made and revoked, newest first, with a check that none was changed or removed.

Approval rules make risky calls wait for a person, like a refund over an amount or a change in the company's HubSpot, and the request shows what the call would change. Each key spends within its daily budget, the account within its monthly ceiling, and a team within its budget. Approvals and Limits explain both.

• Events are kept 30 days.
• The originals of received emails are kept 30 days.
• An account with no activity for two years is deleted, with warnings to the owner 60 and 14 days before. Activity is a key making a call, or a payment. An account that holds credit, or rents something, stays.
• An account that issued invoices or keeps books stays, dormant, until its newest invoice, book entry, bill or bank line is 10 years old, counted from the end of its year. With the warnings, the owner gets every invoice as PDFs and the books, to keep.

The business answers people who ask to see their data, take it with them or have it erased, and Conecto's tools do the work. Confirming that the person asking is the person named is the business's job.

• account_find_person finds every record about one person, by email or phone number.
• account_export_person puts their records and files in one ZIP with a download link to give them.
• account_erase_person erases them across every area and says what it kept and why, like invoices the law keeps.
• account_export_all exports everything the account holds as ZIP files: every record as JSON Lines, and the stored files.

• On free credit, the agent contacts nobody outside the business. Email, phone numbers, documents sent outside and newsletters need one real top-up first.
• Email to addresses the business never wrote with before is capped at 20 a day. Replies have no cap.
• A Conecto inbox never writes first to an address found with prospect search or Conecto's lookups, or checked with them, and answers found_by_lookup with status 422. Once that person writes to the business, the inbox answers them like anyone else.
• Newsletters go out through the business's own email service, to people who confirmed. An invitation says how the people asked to hear from the business.
• The only phone calls going out are calls that confirm meetings booked in advance.
• A phone line's greeting tells callers they reached an automated line, and a greeting without that is refused.
• An email an agent writes to someone ends with a line saying the business's AI assistant wrote it. A reply a person at the business writes through the agent carries no such line.

Before an email goes to someone who never wrote to the business, Perplexity's decision model reads it through OpenRouter and judges whether it is cold outreach: a sales pitch, prospecting, link building, a partnership ask or a request for a meeting, sent to people with no tie to the business. Newsletter issues and invitations go through the same check. The model reads the subject and the words, with the number of recipients and never their addresses.

• A cold email stays unsent and answers cold_email with status 422. Nothing is charged.
• When the check is down, nothing goes out and the call answers check_unavailable with status 503. Call again in a minute. A newsletter issue stays scheduled and goes once it passes.
• Replies, email to people who wrote first, and email to the owner and the account's people skip the check.

The account's email pauses at once, until Conecto reviews it, when:

• The cold-email check refuses 3 within 7 days. Emails, newsletter issues and invitations all count.
• Over the last 30 days, with at least 50 sent, more than 2% bounced or more than 0.1% complained. Newsletters through the business's own email service count on their own: the hard bounces the service reports, and every reader who presses "I never signed up for this" on the unsubscribe page.

While it is paused, every email answers sending_paused with status 403. Newsletter issues already scheduled wait, and sending a new one answers sending_unavailable.

The bot that signs up accepts the terms for the business, with their data processing terms, and the account keeps the version, 2026-10-27. The privacy notice says how Conecto handles personal data.