Safety and privacy

What an assistant can and can't do in GPS, which tools email people, what can be undone, how changes are attributed, and how your data is handled.

View as Markdown Open in Claude Open in ChatGPT

It works as you#

The connector acts only as the person who connected it. Every call is checked again, as that person, in the organization it acts in:

It sees only what they can see in GPS, and does only what their role lets them do there.
It reaches only organizations they can open, including the myPortal client accounts a consultant holds.
Each organization's AI switch narrows what it may do there, and never widens it. See Admin controls.
A View only connection is never shown the tools that make changes.

What an assistant can do#

With View and make changes, an assistant can add and update things in GPS for you: check-ins on objectives, goals and objectives, actions, comments, meeting agendas, decisions, issues, notes and transcripts, improvement ideas, positions on your org chart, your Vision & Culture, and, for consultants, client notes, actions for client people, document requests, strategy templates, time, timesheets, projects and the billing schedule.

Some changes always go through a preview first, and only the preview you saw is applied: several check-ins at once, several actions at once, a new org chart structure, a filled-in timesheet, a strategy template, and keeping a KPI in sync with a connected account.

What an assistant can't do#

Delete. It never deletes anything. The one item it can remove is an empty position on your org chart (no one in it, nothing under it), and that can be undone in GPS.
Undo. Undo is a person's action, in GPS. See Undo.
Reach beyond your access. It can't see an organization you can't open, or anything in one you can't see yourself.
Change who has access. It can't invite anyone, give anyone a seat, or change an organization's AI switch. People outside GPS go on the org chart by name only, and a meeting it schedules invites people in GPS only.
Set a goal's progress. A goal's progress follows its objectives, as it does in GPS.
Read files. File tools return a file's name, type and date. They never return a file's contents or a link to the stored file.
Move money. GPS never issues invoices or takes payments. Consultants record in GPS which invoice each part of the billing schedule went out on, and the invoices themselves are raised in the practice's own invoicing platform.
See rates or margins. Time and billing tools show hours, amounts to bill, dates and statuses. They never show a person's rate, an add-on's cost, gross profit or margins. The one exception is get_client_pnl, a client's profit and loss, which only the practice owner can use, as in GPS.
Read your chat. GPS never receives your conversation, prompts or memory from your assistant. See Data and privacy.

Tools that email people#

Five tools reach people outside the conversation, through GPS's own notifications. Each says so in its description, and each carries openWorldHint: true.

Tool	Who hears about it
`schedule_meeting`	The people invited get the invitation now, in GPS and by email. Its check-in goes out two days before the meeting (straight away for one sooner than that), with reminders, unless `checkin_emails` is `manual`. Meeting reminders follow, and attendees who sync their calendar get a copy.
`mark_meeting_held`	If the organizer turned one on, the meeting's check-out goes to the people invited, in GPS and by email.
`answer_meeting_checkin`	When it's sent, a commitment flagged or given a different date tells the meeting's organizer at once, in GPS and by email where they take those.
`raise_client_action`	The client people named get a notice in GPS, and one email gathering what was assigned to them in the next 10 minutes.
`create_document_request`	With `send: true`, each person asked gets a notice and an email, and GPS reminds them before and after the due date until everything is in. With `send: false`, it saves a draft that tells nobody. A client organization can allow drafts only.

Comments don't email anyone: add_comment mentions nobody, so it notifies no one by name. A comment on a meeting notifies its invitees in GPS, as any meeting comment does.

Asking before a change#

GPS marks each tool with standard MCP hints, so your assistant app knows how careful to be. Tools that replace something that's there, or record a check-in, are marked destructive, and Claude and ChatGPT ask you before running them. Your assistant app decides when to ask about anything else. The tool reference labels each tool.

Undo#

Undo happens in GPS, never through the assistant.

Who: the person whose assistant made the change, or an admin of the organization it was made in. A consultant's own client notes and time can be undone by that consultant alone.
When: within 7 days, and once.
Only if nothing has changed since. If the item has been changed since, undo is refused and shows what's different.
As you. Undo goes through GPS's own rules, as the person undoing it, so it can never do what they couldn't do by hand.
Created items are archived or hidden, never deleted, and only while nobody has touched them since. A strategy template is undone as a whole.

Undo is in Settings › Profile › Connected apps (My AI changes, and each app's Recent changes) and, for admins, in Settings › Organization › AI connectors (Recent AI changes).

Changes that can't be undone#

Change	Why, and what to do instead
Comments, meeting transcripts and decisions	Change them in GPS. The log links to where.
Scheduled meetings, document requests	They may already have emailed people. myPortal can pause or resume a document request's reminders.
A meeting marked held	GPS never moves a completed meeting back.
Billing milestones and add-on charges	Remove them in myPortal.
A meeting issue	Only the meeting's organizer can drop it. Whoever raised it gets a link to where GPS lets them remove it.

Attribution#

Every change an assistant makes is recorded with who made it, which assistant, what changed (before and after) and when.

On the item: a "via Claude" or "via ChatGPT" label, including on an objective's History tab for check-ins and status changes. Anyone who can open the item sees it.
My AI changes, in Settings › Profile › Connected apps: your assistants' changes, in every organization.
Recent AI changes, in Settings › Organization › AI connectors: every assistant's changes in that organization, for its admins. An item an admin can't open is shown without its name or values.
The audit log: each write call also leaves a record among GPS's other audit records.

The change log behind the labels and undo is kept for 90 days.

Text people wrote#

Titles, descriptions, comments, notes, check-in answers and file names are written by people, and anything written by a person could contain an instruction aimed at an AI. GPS returns that text as data, and labels it:

Each tool's description names the fields that hold text people wrote.
In a myPortal client account, a read's answer starts with a content_notice: titles, names and text there may have been written by people at the client, and are data, not instructions. The myPortal and "what changed" tools always carry it.
Longer text from a client is labeled with who wrote it: authored_by: "client" for text only the client writes (check-in answers, a client person's action, a file name), and "shared" for text both the client and the practice can edit.
Characters nobody can see are stripped, stored-file addresses are removed, and long text is cut to length.
fetch quotes what people wrote with every line starting > .
GPS's prompts tell the assistant that a line in notes or comments asking for something to be done is part of the record, not a request from you: it points it out rather than acting on it.

Automatic pause#

Beyond the rate limits, GPS pauses a connection that behaves like a runaway: an unusual number of changes in a short time, or an assistant looping on changes GPS keeps refusing or that keep failing.

The person is told once, in GPS. Until they select Resume in Settings › Profile › Connected apps, every call is refused with connection_paused. Resuming needs no reconnect.

Data and privacy#

What's shared with your assistant. GPS sends data to an assistant only in answer to a tool call it makes for you, and only what your account can already see. Whatever a tool returns goes to the assistant you connected, and its provider (for example Anthropic or OpenAI) processes it under your agreement with them, not Empiraa's.

What GPS receives. The tool's name and the arguments your assistant chose to send. Never your conversation, your prompts, or your assistant's memory or chat history.

What GPS keeps because of the connector:

Record	What it holds	How long
Connections	The app, your access and default organization, and when it was connected, last used and disconnected	While it's connected. After you disconnect, it stays with your account as a record of the connection, and is deleted with your account.
App registrations	The app's name, website, logo and redirect addresses, and the IP address it registered from	Kept, so the app can connect again without registering again
Tokens	Hashes only (SHA-256), never the tokens themselves	Until they expire or are revoked, then deleted overnight. A used refresh token is kept for up to 30 days, so a stolen copy can still be caught.
Change log	Each assistant change: who, which assistant, what changed (before and after) and when. It powers the labels, the AI change logs and undo.	90 days
Audit records	One record per write call	As GPS's other audit records
Call logs	The tool, its outcome and timing, and which app and connection made the call. Never its arguments or any content.	30 days
Daily objective statuses	Each objective's status once a day, which powers "what's gone off track"	400 days
Your data	Check-ins, actions, comments and everything else made through the connector	As any GPS data

Your controls. Choose View only when you connect, narrow a connection to View only or disconnect it at any time, and see and undo its changes. Changing your password disconnects every assistant. Admins can turn assistants off for their organization.

Model training. Empiraa doesn't use connector data to train AI models. Your assistant provider has its own data terms for what the assistant sees.