---
title: Safety and privacy
description: How Signal's connector previews, confirms, logs and undoes changes, what an assistant never does, and how your data is handled.
product: signal
section: mcp
order: 4
---

# Safety and privacy

An assistant connected to Signal works as the person who connected it. It sees only what that person can see and does only what their role allows. On top of that, every change follows the same safety model.

## How changes work

1. **Preview.** The assistant asks Signal for a preview. Signal itself returns a card that says exactly what will change, from what to what. Nothing is saved yet.
2. **Confirm.** The assistant app asks the person before applying the change, unless they've set it to always allow Signal's changes. The confirmation works once and expires after 15 minutes.
3. **Apply.** Signal makes the change as the person. If the record changed after the preview, nothing is changed and the assistant is asked to preview again.
4. **Log.** Every change is recorded in **Settings › AI activity**, labeled with the app that made it.
5. **Undo.** Most changes can be undone once, within 7 days, from the chat or from Settings › AI activity. Field edits, stage moves and Assigned To go back, and a record the assistant created is removed if nobody has changed it since.

Longer changes, such as an import or a Prospect Spark search, run in the background, and the assistant can check how they're going.

### Changes that can't be undone

Five changes can't be undone, and their card says so before the person confirms:

| Change | Why |
|---|---|
| `send_test_email` | The test email has been sent (to the person's own address only). |
| `import_email_images` | Images copied into the email image library stay there. |
| `start_spark_search` | A Prospect Spark search spends the workspace's Spark allowance. |
| `lookup_company` | A Company Lookup spends the Spark allowance. |
| `find_company_contacts` | Finding contacts spends the Spark allowance. |

## What an assistant never does

- **It never sends an email itself to anyone but you.** The only emails it can set up go to your own address: a test of a draft Email (labeled [Test], at most 20 a day), or a dashboard you schedule for yourself.
- **It never sends a Campaign, publishes a Form or books a meeting, and never starts a Sequence or adds anyone to one itself.** Those stay with people in Signal.
- **It never deletes records.** It can take waiting calls off your own call queue, and Undo removes a record it created only if nobody has changed it since.
- **It never records or changes marketing consent,** opt-outs or unsubscribes, and never makes anyone a marketing contact.
- **It never shares a dashboard.** The dashboards it makes are private to you.
- **It never runs a Prospect Spark search without asking first,** and says that it uses the workspace's allowance.

### Workflows still run

Workflows run as they do in Signal. A workflow an assistant turns on, or edits while it's on, runs its own steps, and its card names every step that reaches outside Signal, such as one that emails people or adds them to a Sequence. Workflows also run on the records an assistant creates or changes, just as when you make the change yourself. So do Signal's own notifications, such as the email a teammate chose to get when a Deal changes stage.

## Untrusted text stays data

Anything that came from a record, an email, a Form submission or a web page reaches the assistant fenced as untrusted text (`{"untrusted": "…"}`), so it can be told apart from the person's own requests. An instruction planted in a note or an email is data, not a command.

Signal was tested against planted instructions in notes, emails, Form submissions, imported files and web pages; forged or stale confirmations; attempts to reach another workspace; attempts to send data out; and attempts to burn spending allowances.

## Privacy

- **What an assistant reads is sent to the app you connected.** Connect only apps you trust.
- **Workspace privacy preferences.** A workspace admin can hide contact details (email and phone) from every assistant, and can let assistants use call recordings and transcripts. That's off by default. See [Admin controls](admin-controls.md).
- **Answers never include** file URLs, tokens, session or trace ids.

**Model training.** Empiraa doesn't use connector data to train AI models. Your assistant provider has its own data terms for what the assistant sees.

## Security

- OAuth 2.1 with PKCE (`S256` only), public clients only, short-lived access tokens (1 hour) and refresh-token rotation. Access is revoked when the person disconnects, an admin disconnects them, or they change or reset their password. See [How it works](how-it-works.md#oauth-21).
- Rate limits per connection, per person and per workspace, plus workspace and platform-wide off switches.
- Signal pauses a connection that makes an unusual number of changes or errors, until the person resumes it.
- An internal penetration test covered the connector against OWASP ASVS level 2, the OAuth 2.0 Security Best Current Practice ([RFC 9700](https://www.rfc-editor.org/rfc/rfc9700)) and the MCP specification's security guidance.