> ## Documentation Index
> Fetch the complete documentation index at: https://reedai-07fa30f1.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions & Privacy

> Understand tool permissions, data privacy, and security controls for ZeroTwo extensions

## Tool Permissions Overview

Every tool in ZeroTwo requires specific permissions to function. Understanding these permissions helps you make informed decisions about which tools to enable and what data they can access.

<Note>
  ZeroTwo follows the principle of least privilege - tools only receive the minimum permissions needed to function.
</Note>

## Permission Types

Different permission categories control what tools can access.

<Tabs>
  <Tab title="Conversation Access">
    **What tools can see in your chats**

    **Permission levels**:

    **None**:

    * Tool cannot access conversation history
    * Operates independently
    * Example: Image generation (doesn't need chat context)

    **Current Message Only**:

    * Access to the message that invoked the tool
    * No historical context
    * Example: Web search (only needs current query)

    **Recent Context**:

    * Last 5-10 messages for context
    * Enough for understanding current topic
    * Example: Code interpreter (needs recent code snippets)

    **Full Conversation**:

    * Access to entire conversation history
    * Required for context-aware tools
    * Example: Memory system (needs full context to store properly)

    <Info>
      You can see what level each tool requires in Settings > Tools > \[Tool Name] > Permissions.
    </Info>
  </Tab>

  <Tab title="File Access">
    **What tools can do with your files**

    **Read Permissions**:

    * **Uploaded files**: Access files you upload in chat
    * **Generated files**: Access AI-generated content
    * **Project files**: Access all files in current project
    * **Organization files**: Access org-wide files (Enterprise)

    **Write Permissions**:

    * **Create files**: Generate new files
    * **Modify files**: Edit existing files
    * **Delete files**: Remove files (rare, requires explicit consent)

    **Examples**:

    * Code interpreter: Read uploaded data files, create result files
    * Image generation: Create image files
    * Canvas: Read/write document files

    <Warning>
      Tools with file deletion permission always ask for confirmation before removing files.
    </Warning>
  </Tab>

  <Tab title="Integration Access">
    **Third-party service connections**

    **OAuth Scopes**:
    Each integration requests specific scopes:

    **Gmail**:

    * Read emails
    * Send emails (optional)
    * Modify labels
    * Create drafts

    **Google Drive**:

    * Read files
    * Create files
    * Modify files (optional)
    * Delete files (optional)

    **GitHub**:

    * Read repositories
    * Read issues/PRs
    * Write comments (optional)
    * Create branches (optional)

    **Notion**:

    * Read pages
    * Search workspace
    * Create pages (optional)

    You can review and revoke these permissions anytime in Settings > Integrations.
  </Tab>

  <Tab title="Network Access">
    **External connections**

    **API Calls**:

    * Which domains tool can contact
    * Rate limits
    * Data transmission

    **Webhook Access**:

    * Can receive external data
    * Endpoints exposed
    * Authentication required

    **Blocked by Default**:

    * Internal network access
    * Local file system (except sandboxed)
    * System commands

    <Info>
      Network access is logged and can be audited in Enterprise plans.
    </Info>
  </Tab>

  <Tab title="Personal Data">
    **User information access**

    **Profile Data**:

    * Name and email
    * Avatar
    * User preferences
    * Account settings

    **Usage Data**:

    * Tool usage statistics
    * Conversation patterns
    * File access logs

    **Custom Data**:

    * Custom instructions
    * Memory data
    * Saved preferences

    **Restrictions**:

    * Cannot access passwords
    * Cannot access payment info
    * Cannot access other users' data (unless shared)

    <Check>
      Personal data access requires explicit user consent and is clearly indicated.
    </Check>
  </Tab>
</Tabs>

## Granting Permissions

How to approve tool access.

### First-Time Tool Use

<Steps>
  <Step title="Enable tool">
    When you first enable a tool or integration
  </Step>

  <Step title="Permission dialog">
    ZeroTwo shows what the tool will access:

    **Example for Gmail tool**:

    ```
    Gmail Integration requests permission to:
    ✓ Read your email messages
    ✓ Search your inbox
    ✓ Send emails on your behalf
    ✓ Create and modify drafts

    This tool will NOT be able to:
    ✗ Delete emails
    ✗ Access other Google services
    ✗ Change account settings
    ```
  </Step>

  <Step title="Review carefully">
    * Read what data will be accessed
    * Check what actions are possible
    * Note what is explicitly blocked
    * Review privacy policy link
  </Step>

  <Step title="Approve or deny">
    **Approve**: Tool gets requested permissions

    **Deny**: Tool cannot be used

    **Customize** (Pro/Enterprise): Select specific permissions

    <Tip>
      You can always revoke permissions later in Settings.
    </Tip>
  </Step>

  <Step title="OAuth flow (if needed)">
    For third-party integrations:

    1. Redirected to service (e.g., Google)
    2. Sign in if needed
    3. Approve ZeroTwo access
    4. Redirected back
    5. Tool is connected
  </Step>
</Steps>

### Permission Prompts During Use

Some tools ask for additional permissions when needed:

**Example**: Canvas wants to export to Google Drive

```
Canvas requests permission to:
✓ Create files in your Google Drive
✓ Access "ZeroTwo Exports" folder

Allow once | Allow always | Deny
```

**Your options**:

* **Allow once**: Just for this action
* **Allow always**: Remember choice
* **Deny**: Cancel the action

## Managing Tool Permissions

Review and modify permissions anytime.

### Viewing Active Permissions

<Steps>
  <Step title="Open settings">
    Settings > Tools & Integrations > **Permissions**
  </Step>

  <Step title="View by tool">
    See all tools and their current permissions:

    **Example list**:

    ```
    📧 Gmail
      ✓ Read emails
      ✓ Send emails
      ✓ Manage drafts
      Last used: 2 hours ago
      [Manage] [Revoke All]

    💻 Code Interpreter
      ✓ Read uploaded files
      ✓ Execute Python code
      ✓ Create result files
      Last used: 5 minutes ago
      [Manage] [Revoke All]

    🔍 Web Search
      ✓ Access conversation context
      ✓ Make web requests
      Last used: 1 day ago
      [Manage] [Revoke All]
    ```
  </Step>

  <Step title="Click Manage">
    View detailed permissions for any tool
  </Step>
</Steps>

### Modifying Permissions

<Steps>
  <Step title="Select tool">
    Click **Manage** next to the tool
  </Step>

  <Step title="Toggle permissions">
    Enable/disable specific permissions:

    **Gmail example**:

    * ✅ Read emails (required)
    * ✅ Search inbox (required)
    * ☑️ Send emails (optional - toggle off)
    * ☑️ Create drafts (optional - toggle off)

    <Warning>
      Disabling required permissions will prevent the tool from working properly.
    </Warning>
  </Step>

  <Step title="Save changes">
    Click **Save** to apply

    Tool will use new permission set immediately
  </Step>
</Steps>

### Revoking Access

**Complete revocation**:

<Steps>
  <Step title="Open tool settings">
    Settings > Tools > \[Tool Name]
  </Step>

  <Step title="Click Revoke Access">
    Click **Revoke All Permissions** or **Disconnect**
  </Step>

  <Step title="Confirm">
    Confirm you want to revoke access

    **What happens**:

    * All permissions removed
    * OAuth tokens revoked (if applicable)
    * Tool disabled
    * Integration disconnected
    * No more data access
  </Step>

  <Step title="Re-enable anytime">
    You can re-connect and grant permissions again later
  </Step>
</Steps>

## Data Privacy

How ZeroTwo protects your data when using tools.

### Data Storage

<AccordionGroup>
  <Accordion title="Where data is stored">
    **ZeroTwo data storage**:

    **Conversation data**:

    * Encrypted at rest (AES-256)
    * Stored in secure databases
    * Regional data centers
    * Regular backups

    **File uploads**:

    * Encrypted in transit and at rest
    * Secure object storage
    * Access-controlled
    * Retention policies applied

    **Integration credentials**:

    * OAuth tokens encrypted
    * API keys in secure vault
    * Never logged or exposed
    * Automatic rotation (when supported)

    <Info>
      Data residency options available on Enterprise plans.
    </Info>
  </Accordion>

  <Accordion title="Data retention">
    **How long data is kept**:

    **Conversation history**:

    * Kept until you delete
    * Auto-deletion after inactivity (configurable)
    * Deleted on account closure

    **Files**:

    * Kept until you delete
    * Project-based retention policies
    * 30-day recovery after deletion

    **Logs**:

    * Activity logs: 90 days
    * Security logs: 1 year
    * Audit logs: 7 years (Enterprise)

    **Tool data**:

    * Cleared when tool disconnected
    * Cache expires automatically
    * No persistent storage by tools
  </Accordion>

  <Accordion title="Data sharing">
    **Who can see your data**:

    **Never shared**:

    * Personal conversations (unless you share)
    * Private project data
    * API credentials
    * Payment information

    **Shared with AI providers**:

    * Message content (to generate responses)
    * Tool call results
    * **NOT** stored for training by default
    * Opt-out available for all providers

    **Shared with integrations**:

    * Only data you explicitly grant access to
    * Controlled by OAuth scopes
    * Revocable anytime
    * Logged for audit

    <Check>
      ZeroTwo never sells your data or uses it for advertising.
    </Check>
  </Accordion>
</AccordionGroup>

### Privacy Controls

**Settings you can control**:

<Tabs>
  <Tab title="AI Provider Privacy">
    **Control AI provider data usage**:

    Settings > Privacy > **AI Provider Data**

    **Options**:

    * ✅ **Zero data retention**: Providers delete data after response (default)
    * ☑️ **Allow training**: Let providers use for model training (opt-in)
    * ☑️ **Allow improvement**: Anonymous usage for improvements

    **Per-provider settings**:

    * OpenAI: Zero retention available
    * Anthropic: Zero retention by default
    * Google: Zero retention available
    * Others: Check provider policies

    <Tip>
      Free plans may require allowing some data usage. Paid plans offer zero retention.
    </Tip>
  </Tab>

  <Tab title="Tool Data Access">
    **Limit what tools can see**:

    Settings > Tools > **Data Access Controls**

    **Restrictions**:

    * **Sensitive data**: Mark conversations as sensitive (no tool access)
    * **PII detection**: Auto-redact personal information
    * **File filtering**: Exclude certain file types
    * **Domain blocking**: Block tools from specific domains

    **Per-project controls**:

    * Different settings per project
    * Stricter for confidential projects
    * Compliance templates (HIPAA, GDPR)
  </Tab>

  <Tab title="Sharing Preferences">
    **Control external sharing**:

    Settings > Privacy > **Sharing**

    **Options**:

    * Allow/block public share links
    * Require password on shares
    * Auto-expire share links
    * Watermark shared content
    * Track share views

    **Organization policies**:

    * Admin can enforce org-wide rules
    * Block external sharing
    * Require approval for shares
  </Tab>

  <Tab title="Memory & Learning">
    **AI memory privacy**:

    Settings > Memory > **Privacy**

    **Controls**:

    * Enable/disable memory system
    * Choose what's remembered
    * Exclude sensitive topics
    * Manual memory management
    * Clear all memories

    **Exclusions**:

    * Payment information never stored
    * Passwords never stored
    * Health information opt-in only (HIPAA)
  </Tab>
</Tabs>

## Security Best Practices

<AccordionGroup>
  <Accordion title="Review permissions regularly">
    **Monthly security check**:

    * [ ] Review all connected tools
    * [ ] Revoke unused integrations
    * [ ] Check permission changes
    * [ ] Verify OAuth tokens haven't expired
    * [ ] Review activity logs
    * [ ] Update security settings

    **Set calendar reminder** for monthly reviews.
  </Accordion>

  <Accordion title="Use principle of least privilege">
    **Minimize access**:

    ✅ **Do**:

    * Grant only required permissions
    * Use read-only when possible
    * Revoke when not needed
    * Segment data by project
    * Use separate accounts for sensitive work

    ❌ **Don't**:

    * Grant "allow all" permissions
    * Keep unused tools connected
    * Share credentials
    * Mix personal and work accounts
  </Accordion>

  <Accordion title="Protect sensitive information">
    **Handle confidential data carefully**:

    **For sensitive projects**:

    1. Mark project as confidential
    2. Disable non-essential tools
    3. Enable stricter access controls
    4. Turn on audit logging
    5. Require explicit consent for tools

    **For regulated industries**:

    * Use compliance templates
    * Enable enhanced encryption
    * Implement data retention policies
    * Regular compliance audits
    * Business Associate Agreements (if needed)

    <Warning>
      Never share passwords, API keys, or payment information in conversations.
    </Warning>
  </Accordion>

  <Accordion title="Enable two-factor authentication">
    **Secure your account**:

    Settings > Security > **Two-Factor Authentication**

    **Benefits**:

    * Prevents unauthorized access
    * Protects tool permissions
    * Secures OAuth connections
    * Required for compliance

    **Methods**:

    * Authenticator app (recommended)
    * SMS (less secure)
    * Hardware key (most secure)
    * Backup codes
  </Accordion>

  <Accordion title="Monitor tool activity">
    **Watch for unusual behavior**:

    **Activity monitoring**:

    * Unexpected API calls
    * Large data downloads
    * Failed auth attempts
    * Permission escalations

    **Set up alerts**:
    Settings > Security > Alerts

    * Email on suspicious activity
    * Slack notifications
    * Daily summary reports

    **Review logs**:
    Settings > Security > Activity Logs
  </Accordion>
</AccordionGroup>

## Compliance & Regulations

Tool privacy in regulated environments.

<Tabs>
  <Tab title="GDPR Compliance">
    **European data protection**:

    **User rights**:

    * Right to access: Export all tool data
    * Right to erasure: Delete all data
    * Right to portability: Download data
    * Right to object: Opt out of processing

    **Tool compliance**:

    * Data processing agreements (DPAs)
    * Consent management
    * Purpose limitation
    * Data minimization

    **Enable GDPR mode**: Settings > Compliance > GDPR
  </Tab>

  <Tab title="HIPAA Compliance">
    **Healthcare data protection** (Enterprise):

    **Requirements**:

    * Business Associate Agreement (BAA)
    * Audit controls
    * Person/entity authentication
    * Transmission security
    * Access controls

    **Tool restrictions for PHI**:

    * Disable non-HIPAA tools
    * Enhanced logging
    * Encrypted storage
    * Access restrictions

    **Contact sales** for BAA before processing PHI.

    <Warning>
      Not all tools are HIPAA-compliant. Check before processing protected health information.
    </Warning>
  </Tab>

  <Tab title="SOC 2">
    **Security controls** (Enterprise):

    **Tool-related controls**:

    * Permission management
    * Audit logging
    * Change management
    * Incident response
    * Vendor management

    **Compliance features**:

    * Annual SOC 2 Type II reports
    * Security questionnaires
    * Third-party audits
    * Compliance dashboard
  </Tab>

  <Tab title="Industry Regulations">
    **Other compliance frameworks**:

    **Financial Services** (PCI DSS, FINRA):

    * No payment card data in conversations
    * Enhanced access controls
    * Extended audit retention

    **Legal** (Ethics rules):

    * Client confidentiality
    * Conflict screening
    * Attorney-client privilege

    **Government** (FedRAMP, ITAR):

    * Special authorization required
    * US-based data centers
    * Background checks
    * Incident reporting
  </Tab>
</Tabs>

## Tool Security Features

Built-in security mechanisms.

### Sandboxing

**Isolated execution**:

**Code Interpreter**:

* Runs in E2B sandbox
* No network access by default
* Limited file system
* Resource limits (CPU, memory, time)
* Automatic cleanup

**Custom Extensions**:

* Isolated processes
* Limited permissions
* Network restrictions
* API rate limiting

### Data Encryption

**Always encrypted**:

* **In transit**: TLS 1.3
* **At rest**: AES-256
* **OAuth tokens**: Secure vault
* **API keys**: Hardware-encrypted

**Key management**:

* Automatic rotation
* Separate per organization
* Hardware security modules (Enterprise)

### Audit Logging

**What's logged**:

* Tool activation/deactivation
* Permission grants/revokes
* API calls made
* Data accessed
* Errors and failures
* Configuration changes

**Log retention**: 90 days to 7 years (configurable)

**Access logs**: Settings > Security > Audit Logs

## Troubleshooting

<AccordionGroup>
  <Accordion title="Tool asking for unexpected permissions">
    **Why this happens**:

    * Tool updated with new features
    * More permissions needed for full functionality
    * Previous permissions revoked

    **What to do**:

    1. Review what permissions are requested
    2. Check tool changelog for updates
    3. Contact support if suspicious
    4. Deny if uncomfortable
    5. Use alternative tool if needed
  </Accordion>

  <Accordion title="Can't revoke permissions">
    **Possible issues**:

    * Some permissions are required
    * OAuth session hasn't expired
    * Cache needs clearing

    **Solutions**:

    * Disconnect integration completely
    * Revoke from provider's side (Google, GitHub, etc.)
    * Clear browser cache
    * Contact support if stuck
  </Accordion>

  <Accordion title="Privacy concerns about a tool">
    **If you're worried**:

    1. **Review tool documentation**: Privacy policy, data handling
    2. **Check permissions**: What it actually accesses
    3. **Read reviews**: Other users' experiences
    4. **Test in isolation**: Use in test project first
    5. **Contact support**: Ask specific questions
    6. **Don't use**: If still uncomfortable

    **Red flags**:

    * Requesting excessive permissions
    * No privacy policy
    * Poor reviews about privacy
    * Unclear data handling
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Custom Extensions" icon="puzzle-piece" href="/tools/custom-extensions">
    Build and add custom tools
  </Card>

  <Card title="Data & Compliance" icon="shield-check" href="/privacy/data-and-compliance">
    Learn about data protection
  </Card>

  <Card title="Security Settings" icon="lock" href="/projects/org-settings">
    Configure security options
  </Card>

  <Card title="Integrations" icon="plug" href="/integrations/mcp-overview">
    Explore integration options
  </Card>
</CardGroup>

<Check>
  Understanding tool permissions helps you use ZeroTwo safely and confidently while protecting your data!
</Check>