For your IT team
What Anchord reads, what it asks for, and who approves it
Anchord helps service teams resolve client escalations. Users connect the systems where the facts live, through each system's own sign-in (OAuth). There is nothing to install and no service account or API key to share. This page lists exactly what each connection allows.
Before your team connects
- Decide which systems the pilot uses. Each is optional, and files can be uploaded instead.
- If your policies require it, pre-approve the Anchord app in each system (see who approves, below).
- Where you can, start with a test or sandbox account.
- Questions about security or data handling go to ashish@anchord.tech.
System by system
HubSpot
Reads the companies, contacts, deals and tickets about the client a brief is for. Read only: it never creates, changes or deletes a HubSpot record.
Who approves: A HubSpot super admin, or someone allowed to install apps in your HubSpot account. Remove it any time under Connected apps in your HubSpot settings.
Permissions requested
- crm.objects.companies.read
- crm.objects.contacts.read
- crm.objects.deals.read
- crm.objects.tickets.read
- crm.objects.owners.read
- crm.schemas.companies.read
- crm.schemas.contacts.read
- oauth
Jira
Reads issues and who owns them. Optional, separate grant: creates issues in one project the user names, only for the follow-through steps they approve. Without that grant it never writes.
Who approves: You can approve it yourself. Anchord sees only the projects you can see. If your company limits third-party apps, your Atlassian admin allows it first. Each user can remove it under Connected apps in their Atlassian account settings.
Permissions requested
- read:jira-work
- read:jira-user
- offline_access
- write:jira-work (optional)
Slack
Searches the messages the connecting user can already see, and keeps only those that name the client. Sends the questions the user approves as direct messages from the Anchord app, and reads replies in that direct message.
Who approves: You, unless your workspace requires app approval. Then a Slack admin approves the request, and you connect again. Requests appear in your workspace's app management under Requests, and you can remove the app there at any time.
Permissions requested
- chat:write
- im:write
- im:history
- users:read
- users:read.email
- reactions:write
- channels:read
- search:read (user token)
Microsoft 365
Searches the mail and Teams chats the connecting user can already see, and keeps only those that name the client. Sends the questions the user approves, on Teams or as email from their own Outlook.
Who approves: You, if your company lets staff approve apps. Many don't: then an IT admin approves it once for everyone, and you connect again. All are delegated permissions: Anchord acts as the signed-in user, never as the whole organization. To approve for everyone, an admin clicks Connect Microsoft 365 in Anchord and ticks Consent on behalf of your organization. Remove it any time under Enterprise applications in Microsoft Entra. Optional: User.Read.All, only if the user turns on the org chart, reads each person's job title, department, office and manager so questions from AI agents go to the right team. It always needs an admin's approval.
Permissions requested
- User.Read
- User.ReadBasic.All
- Mail.Read
- Mail.Send
- Chat.Read
- Chat.Create
- ChatMessage.Send
- offline_access
How your data is handled
- Read only, unless a user allows moreAnchord never changes or deletes anything in your systems. The only writes are the questions a user approves (Slack, Microsoft 365) and, with the separate Jira grant, issues for approved steps.
- Nothing goes out without approvalEvery question is reviewed by the user before it is sent. The only message Anchord sends on its own is one reminder on a question the user already sent.
- Encrypted at restConnection tokens, and what Anchord stores about a client (briefs, questions, answers and model output), are encrypted with AES-256-GCM and bound to the customer's own workspace, so one workspace's data can't be read as another's.
- AI with fixed rulesCommercial AI model APIs suggest; fixed rules decide what counts as established, and every model call is recorded. Your data is not used to train AI models.
- HostingAnchord runs on Vercel in the US (US East), with a managed Postgres database.
- Revoke and deleteDisconnect in Anchord stops access at once, and you can also remove the app in each system as above. One step in the account menu deletes the workspace: every brief, answer and connection, and everything Anchord read. During the open test, workspaces with no activity for 30 days are deleted automatically.