Is it safe to connect an AI assistant to Scribble?
The connection is limited to the space and permissions you approve. Scribble's tools do not expose payment details or API keys. Our server receives the data your assistant includes in tool calls and does not request chat history. You can remove send permission or disconnect from Integrations. Per-card confirmation is controlled by your assistant, so keep its confirmation settings on.
On this page
#What Scribble receives
The server receives the arguments your assistant includes in each tool call. For a card, these include the recipient's name and address, message, handwriting and design. For a contact search, they include the search terms. Review what your assistant shares before approving an action.
Our server does not request your chat history, memory or files. Your assistant may include information from your conversation in tool arguments, so anything included there reaches Scribble.
#What the assistant receives
- Only data belonging to the one organization chosen when you connected. A second organization is a second connection, approved separately.
- A card preview, including the message and any standing text in your design. A preview link is available for 30 days, so you can open it when your assistant cannot display the image. Anyone given that link can see the card. The link stops working after 30 days.
- Only tools covered by the permissions you approve. Read contacts controls address-book searches. Read cards can also return recipient details from cards already sent; removing address-book access does not remove those order details.
- Never your API keys, webhook signing secrets, card payment details or invoices. Nothing in the tool surface can reach them.
- Never another customer's anything. Every query is filtered by your organization before it runs.
#How the connection is secured
| Property | How |
|---|---|
| Sign-in | OAuth 2.1 with PKCE (S256). Your Scribble password or magic link is never shared with the assistant. |
| Access tokens | Expire after one hour and are stored only as a SHA-256 hash on our side. |
| Refresh tokens | Rotate on every use. Reusing a spent one is treated as theft and kills the whole connection. |
| Token binding | Every token is stamped with this server's address and refused anywhere else, and tokens issued elsewhere are refused here. |
| Consent | Recorded per application. Approving one assistant never approves another. |
| Return address | The address you are sent back to after sign-in must exactly match one the application registered in advance. |
| Rate limit | 120 tool calls a minute per connection. |
| Revocation | Immediate, from Integrations. Any conversation still holding a token is refused on its next call. |
#Restricting it to your own staff
Scribble signs people in with OpenID Connect, which is what lets an administrator say only people with an @acme.com address may connect this. Several assistant platforms — ChatGPT among them — offer that setting only for connectors that support it. Ours does: there is a discovery document at /.well-known/openid-configuration, a signing key published at /.well-known/jwks.json, and a userinfo endpoint that answers with the signed-in person's email address.
The address comes back with a flag saying whether it was ever confirmed, and that flag is read from the account rather than assumed. A domain restriction built on an unconfirmed address would stop nobody, since anybody can type one.
| Permission | What it returns | What it lets an assistant do |
|---|---|---|
openid | A stable id for the signed-in person, and the name of the organization they connected | Nothing |
email | Their email address, and whether it is confirmed | Nothing |
profile | Their name | Nothing |
These are identity only. None of them can send a card, read your address book, or reach anything a tool reaches — that is the four permissions above, and they are chosen separately.
#The risk worth understanding
An assistant can misunderstand a request or follow unwanted instructions in something it reads. If it has send permission, that can result in a card you did not intend to send. Check the recipient, message and cost before approving.
Scribble checks permissions and the connected space on tool calls. Your assistant controls its own confirmation prompts:
- Keep send confirmations on. Sending is marked as an action that spends credits, but this marker does not guarantee that a client asks first. Scribble does not collect a separate per-card approval.
- Credits cap the damage. Nothing can be spent that you have not already bought, and the balance is visible.
- The permission is optional. A connection without Send handwritten cards cannot post anything at all, no matter what it is told.
- There is no tool to buy credits or change billing details. Top up your balance yourself in Scribble.
#What we log
We log which tool was called, when, by which connection and whether it succeeded. Card content is stored so we can produce and track the card. Preview links are available for 30 days. We do not receive the surrounding conversation unless your assistant includes it in a tool call.
#Revoking access
Open Integrations
In Scribble, go to Integrations. Connected assistants are the first panel.
Choose Disconnect
Confirm. It takes effect on the assistant's very next call.
You’ll know it worked when The assistant reports the connector as disconnected, or fails its next tool call with an authorization error.
Disconnecting removes access. It does not cancel cards already in production — for that, cancel the card while it is still waiting for a machine.
#Common questions
- Is my data used to train an AI model?
- Not by us — we do not train models on anything. What your assistant's provider does with your conversation is governed by their terms, not ours. Anthropic, OpenAI and Google all publish theirs.
- Does an admin see what a colleague's assistant did?
- An owner or admin sees every connection on the organization, who made it, what it may do and when it was last used, and can disconnect any of them. Cards sent through an assistant appear in the normal orders list like any other card.
- What happens if someone leaves the company?
- Remove them from the organization and their connections stop working — the grant is tied to their account, not to a shared key. This is the main reason the MCP server uses sign-in rather than API keys.
- Can I stop people connecting assistants at all?
- Not yet as a switch. Today, only owners and admins can disconnect, and every connection is visible. If you need it blocked outright, tell us — it is a small change and we would rather build it for a real requirement than guess.
Last checked against the product on . Something wrong or missing? Tell us.