Is it safe to connect an AI assistant to Scribble?
An assistant sees only what it asks for through a tool call, and only for the one organization you picked. It never sees your API keys, your payment details, or other customers' data — and Scribble never sees your conversation. The connection uses OAuth 2.1 with PKCE, tokens expire hourly, and you can revoke it in one click.
On this page
#What Scribble receives
Only the arguments of the tool the assistant calls. When you ask Claude to send a card, we receive the recipient's name and address, the message text, and your choice of handwriting. We do not receive the conversation those came out of, the rest of your chat history, your other files, or anything else the assistant has access to.
The protocol has no mechanism for us to ask. Our server cannot request your conversation, your memory or your files, and does not.
#What the assistant receives
- Only data belonging to the one organization chosen when you connected. A second organization is a second connection, approved separately.
- Only categories covered by the permissions you ticked. Untick the address book and contact data is never returned at all.
- Never your API keys, webhook signing secrets, card payment details or invoices. Nothing in the tool surface can reach them.
- Never another customer's anything. Every query is filtered by your organization before it runs.
#How the connection is secured
| Property | How |
|---|---|
| Sign-in | OAuth 2.1 with PKCE (S256). Your Scribble password or magic link is never shared with the assistant. |
| Access tokens | Expire after one hour and are stored only as a SHA-256 hash on our side. |
| Refresh tokens | Rotate on every use. Reusing a spent one is treated as theft and kills the whole connection. |
| Token binding | Every token is stamped with this server's address and refused anywhere else, and tokens issued elsewhere are refused here. |
| Consent | Recorded per application. Approving one assistant never approves another. |
| Return address | The address you are sent back to after sign-in must exactly match one the application registered in advance. |
| Rate limit | 120 tool calls a minute per connection. |
| Revocation | Immediate, from Integrations. Any conversation still holding a token is refused on its next call. |
#The risk worth understanding
The real risk with any AI integration is not us being breached — it is your assistant being talked into something. If an assistant reads a web page or an email containing instructions, a poorly-defended one can be persuaded to act on them. In our case that would mean a card sent to somebody you did not choose.
Four things bound it, and none of them depend on the assistant behaving well:
- Sending is flagged irreversible, so a compliant assistant must ask you first and show you the exact recipient and message.
- Credits cap the damage. Nothing can be spent that you have not already bought, and the balance is visible.
- The permission is optional. A connection without Send handwritten cards cannot post anything at all, no matter what it is told.
- Our own tool descriptions contain no instructions. They describe what each tool does and nothing else — no directions to the model about how to behave, which is both a review requirement and the reason our surface cannot be used as an injection vector.
#What we log
Which tool was called, when, by which connection, and whether it succeeded — the same request log the API keeps. Card content is stored because we have to write it on a card. We do not store your prompts, and there is nothing in the request for us to store them from.
#Revoking access
Open Integrations
In Scribble, go to Integrations. Connected assistants are the first panel.
Choose Disconnect
Confirm. It takes effect on the assistant's very next call.
You’ll know it worked when The assistant reports the connector as disconnected, or fails its next tool call with an authorization error.
Disconnecting removes access. It does not cancel cards already in production — for that, cancel the card while it is still waiting for a machine.
#Common questions
- Is my data used to train an AI model?
- Not by us — we do not train models on anything. What your assistant's provider does with your conversation is governed by their terms, not ours. Anthropic, OpenAI and Google all publish theirs.
- Does an admin see what a colleague's assistant did?
- An owner or admin sees every connection on the organization, who made it, what it may do and when it was last used, and can disconnect any of them. Cards sent through an assistant appear in the normal orders list like any other card.
- What happens if someone leaves the company?
- Remove them from the organization and their connections stop working — the grant is tied to their account, not to a shared key. This is the main reason the MCP server uses sign-in rather than API keys.
- Can I stop people connecting assistants at all?
- Not yet as a switch. Today, only owners and admins can disconnect, and every connection is visible. If you need it blocked outright, tell us — it is a small change and we would rather build it for a real requirement than guess.
Last checked against the product on . Something wrong or missing? Tell us.