Data & Permissions
Your password stays with Propamp
Sign-in happens on a Propamp-hosted page in your own browser. The AI client receives an access token and a refresh token — never your password. No client, and no connector configuration, ever holds your credentials.
That is also why there is no API key: a token issued through OAuth can be scoped and revoked, and it identifies the person who authorized it.
Access is scoped to your organization
A session can only reach data belonging to the organization the signed-in account is a member of. The server validates that on every connection, before any tool is registered — so a session cannot see another organization’s products, costs, or suppliers even by asking for them by ID.
Read and write are marked separately
Of the 128 tools, most only read. The rest are labelled in the protocol itself: every tool carries a machine-readable hint saying whether it only reads, whether it modifies data, and whether the change is destructive.
| Access | Count | What it means |
|---|---|---|
| Read | 87 | Fetches data. No side effects. |
| Write | 28 | Creates or updates records — a PO, a shipment draft, an expense, a supplier. |
| Delete | 13 | Removes or archives a record. |
Your AI client uses those hints to decide when to ask you first. In practice: reads happen freely inside a conversation, and anything that changes or removes data prompts for approval. See the Tool Reference for the access level of any individual tool.
Deletes are real. purchase_order_delete archives rather than hard-deletes, but several others —
expenses, lead times, inventory override templates, dictionary entries — remove the record. Read the
approval prompt before you accept it.
Amazon Ads is gated separately
Amazon Ads tools appear only if your organization has an Amazon Ads key connected in Propamp, and the subset that can change live campaigns, budgets or bids is off by default and enabled per organization on request. See Amazon Ads (Beta).
Revoking access
- Stop one client using it — remove the connector or server entry in that client. The token stops being used, and Propamp sessions for it expire.
- Cut off every client immediately — email [email protected]. We can revoke your organization’s live MCP sessions server-side, which takes effect at once rather than waiting for tokens to expire.
- Someone left the team — removing their Propamp account removes their MCP access with it, since the token is only as valid as the account behind it.
Sessions
Idle sessions expire after 60 minutes. Expiry is a normal part of operation, not a fault — clients re-initialize automatically and you will not usually notice.