Onboarding
Data and Access Setup
What we connect, how a link to your own tools is scoped, how access is granted on a least-privilege basis, and how you keep full control of your data from day one.
Before your AI team can do anything useful, it needs to know your business. That means giving it the channels and information it works from, and doing it in a way that keeps you in control at every step.
This page explains what gets connected, who decides what access is granted, and what the architecture looks like from a security standpoint.
What we connect
These connections are running now for clients:
| Connection | What it is for |
|---|---|
| Send and receive through your own mailbox | |
| Google Chat | Message your AI team where you already work |
| SMS and WhatsApp | Text conversations through Twilio |
| Files | Documents you share with your AI team |
| Stripe | Billing only |
Our ad-account work reads data only. MCP is an open standard created by Anthropic. An open protocol does not guarantee that a connection can operate independently of CNX: credentials, third-party tools and platform dependencies still need agreement. For a full explanation of MCP, see How AI Agents connect to tools (MCP).
Internal and custom systems
If a tool has an API, an MCP server or a dashboard, we can connect it.* That includes POS tools such as Square, Toast and Clover, accounting tools such as QuickBooks and Xero, CRM such as HubSpot, and booking tools such as Vagaro and Boulevard. Connecting your tools is part of the Business Partnership plan. Ownership of qualifying customer-specific custom IP starts in subscription month 13; the transferable work and its dependencies need specification. Build completion does not set the ownership clock.
We don't promise compatibility with every tool before scoping. We assess each tool and price the work first.
* Some tools take longer and need a workaround, such as computer use under a person's supervision. We confirm the scope in writing before we build. Tool names belong to their owners; naming one means we can work with it, not that they endorse or certify us. See what we connect.
The Company Brain (when we build one)
Beyond the connections above, we can build a Company Brain for you: a searchable store of the documents and emails you share with your AI team. Its technical foundation is called the Knowledge Vault. It is scoped to your project, not a standard part of every plan.
During setup, we work with you to identify which documents and data sources belong in the Knowledge Vault. That content is vectorized and indexed — meaning your AI team can search it semantically, not just by keyword. Once populated, your AI team answers from your actual business record, not from a general-purpose model's training data.
The Company Brain helps retain operational knowledge as records accumulate. The records, export scope and platform dependencies for any departure handoff need agreement; CNX's platform itself does not transfer.
How access is granted
Access follows a least-privilege model. That means every agent is granted access to exactly the systems and actions it needs — nothing more.
Here's how it works in practice:
Per-agent, per-tool, per-action scoping. When an agent needs to read from one connection, that permission is granted explicitly to that agent for that connection. It cannot use the same connection to do something else. Access is defined at the action level, not the system level.
No shared credentials. Each agent operates under a dedicated non-human identity — not a shared API key, not a generic service account. Every agent has its own identity, its own keycard, and its own defined set of doors it can open.
You review access before it goes live. During setup, your build engagement team presents the proposed access configuration for each agent. You confirm or adjust it before anything is activated. Nothing connects without your explicit sign-off.
Revocation is immediate. If you want to remove an agent's access to a specific tool, that change takes effect immediately and does not affect other agents or other connections. Access isn't bundled — it's modular.
What the security posture looks like
Your AI Agents are built on an architecture designed to reduce the attack surface. That's a specific claim about the design methodology — not a claim that the system is impervious.
The architectural choices that matter most for a business owner evaluating this:
- Ephemeral execution. Agents are spun up for a task and destroyed after. There is no persistent process running in the background between sessions. Nothing to target when work isn't happening.
- Server-side only. Your agents never run in the browser. Instructions and logic live on the server. They cannot be overridden or manipulated from a client-side input.
- Encrypted credentials. Every credential stored in your workspace is encrypted with its own key. Credentials are not stored in plain text, not shared across agents, and not accessible outside the agent that holds them.
- Human approval gates. Any action that spends money, sends a communication, modifies a record, or takes an irreversible step requires your explicit approval before it executes. Preparation is automated. Decisions are yours.
- reviewable audit trail. Every agent action is logged — what ran, when, on whose approval, with what data. The record is reviewable. If a regulator or auditor ever asks what happened, you have the answer.
- A way to stop it. A person you authorize can stop an agent. This is part of the setup guardrails, along with limits on what the agent can see and do and a person who approves.
For a complete explanation of the governance architecture — agent identities, authority boundaries, stop controls, and the "digital contractor" model — see Governance and Security.
What we do not connect without your direction
There are categories of data and access we do not configure without an explicit conversation:
- Customer PII (names, contact data, payment details) — access to customer records is scoped narrowly and confirmed with you during setup, not assumed
- Financial write access — write access (creating invoices, triggering payouts) requires a separate, explicit grant
- Employee and HR data — if your business uses Connected Spaces for people scheduling, access to employee profiles and availability data is scoped to the agents responsible for those tasks only
- Third-party credentials — we do not store credentials for tools you have not explicitly included in your setup configuration
If a connection is not listed in your confirmed agent configuration, it does not exist.
Frequently asked questions
When does data access get configured — before or after launch? During your build engagement, before any agent is activated. We scope the connections, present the access plan, and activate only after your sign-off.
Can I add a new tool connection after we launch? Yes. If the tool has an API, an MCP server or a dashboard, we can connect it. It is part of the Business Partnership plan: we scope it and confirm with you in writing before it goes live.
Does my data train anyone's AI? No. Under the business terms we use with every AI provider, your data is not used to train their models.
Can I audit what my agents have access to right now? Yes. Ask us for the list of each agent's connections and the permissions active for each, at any time.
What if I want to disconnect a tool entirely? You can ask us to remove any connection. The agent loses access and cannot reconnect without a new explicit configuration.
Is the Knowledge Vault stored with an AI provider? No. Your Knowledge Vault lives within your Connected Spaces workspace infrastructure — hosted on Vercel, governed by your account. It is not stored on or accessible to any third-party AI provider.