01What you hand over when you connect a tool
An automation reads from one system and writes to another: a sheet, a mailbox, a CRM, a payment account. To do that it holds a credential, either a key or a permission you approved. Whoever holds the credential can do whatever it allows. Google's help page describes three levels for linked apps: basic profile, read and copy, and manage, which means edit, create and delete. It says you can review or remove linked apps at any time. It also warns that revoking access stops further access but does not erase what the app already copied, and you may need to ask the developer to delete it. So the first safety step is a list: every connection, what it can read, what it can change, and who can remove it.
- List every connected tool, with the system it touches
- Note whether each one only reads or can also edit and delete
- Name the person who can remove it
- Revoking access stops new reads. Data already copied needs a deletion request to the vendor
02Give each connection the least access it needs
Stripe's guide to API keys is a good model even if you never touch Stripe. It says to use restricted keys with limited permissions instead of a key that can do everything, and gives the example of an invoicing system that can manage invoices and nothing else. A third party that monitors disputes can be given read-only access to disputes. If that third party were compromised, the attacker would be limited to those calls. The same guide says never to put secret keys in source code, never to share them by email or chat, to store them in a secrets vault or an environment variable, and to rotate them from time to time. It also notes that Stripe never asks you for your secret key.
- One key or permission per job, with only the rights that job needs
- Read-only wherever the tool only reads
- Secret keys stay out of code, email and chat
- Rotate keys on a schedule, and at once if one may have been exposed
- Stripe never asks you for your secret key
03Check who is knocking on the way in
Data also flows into your automation, usually through a webhook: a URL that another service calls when something happens. Anyone who finds that URL can call it too. Stripe's webhook documentation says that without verification an attacker could send fake events to trigger actions like fulfilling orders, granting account access or modifying records, and it tells you to check the signature in the Stripe-Signature header on every event. It also says to log event IDs, because the same event can arrive twice. PROOF48's SunVolt Club case study lists signature-verified Stripe webhooks. That is the standard to ask of any build, ours included.
- Verify the signature of every incoming webhook before acting on it
- Log processed event IDs so a duplicate does nothing
- Rate limit the endpoints a stranger can reach
- Check uploaded files by type and size, not by their name
04Know where the data travels, and what stays behind
Every tool in the chain sees the data it processes, and the run history it keeps can hold copies of what passed through. Ask each vendor in writing where the data is stored, how long run logs are kept, whether it is used for anything beyond your job, and how you get it deleted when you leave. If the data includes personal data about customers, the GDPR rules on processors apply. Our post on chatbot data goes through the four questions and the contract, so we will not repeat them here. Then look at the way out. When someone leaves your team or you drop a tool, remove its access the same day. A forgotten connection is the quietest risk on this page.
- Where is the data stored, and for how long are run logs kept?
- Is it used for anything beyond your job?
- How do you get it deleted or returned when you leave?
- Remove access the same day a person or a tool leaves
- Customer personal data: GDPR processor rules apply, see our chatbot data post
05Where PROOF48 is the wrong choice
PROOF48's AUTOMATE plan costs 2,997 EUR a month. It includes an AI website chatbot, AI DM and email auto-responders, booking automation, a CRM and two custom automations a month. It does not cover WhatsApp or phone. Be clear about what we do not publish: this site carries no data processing agreement template, no sub-processor list and no security certification. If your procurement needs a certified vendor today, we are the wrong choice. So are processes that change every week, and any compliance decision with legal accountability. If a built-in feature of a tool you already use does the job, that is one connection fewer. Check it first.
- AUTOMATE, 2,997 EUR a month: website chatbot, DM and email auto-responders, booking automation, CRM, two custom automations
- WhatsApp and phone are not covered by AUTOMATE
- No data processing agreement template, sub-processor list or security certification is published on this site
- Wrong choice if you need a certified vendor today, or for compliance decisions with legal accountability
- A built-in feature of a tool you already use is one connection fewer
Rotiseria: the outside services an order passes through
Rotiseria Baba Novac, a rotisserie in Bucharest, runs an ordering system that PROOF48 built. The case study lists the connections: Stripe handles the cart and checkout, an order confirmation email goes out on every order through Resend, and the system is a containerised deploy on our own infrastructure. That is three places an order's data lives, which is exactly the list the first section asks you to write. The case study does not describe key rotation or access reviews, so we do not claim them. We do not publish the restaurant's order volume, because that number is theirs.
See the build: Rotiseria Baba NovacQuestions, answered
Is it safe to give an automation tool access to my Google account?
It depends on the level you approve. Google lists three: basic profile, read and copy, and manage. Review linked apps in your account at any time and remove those you no longer use. We make no claim about any specific vendor's security. Read each vendor's own documentation.
What should I do if a key leaks?
Rotate it at once, even if you are not sure anyone saw it. Stripe's guide treats any exposure, such as a public repository, a log file or an email, as a possible compromise.
Does PROOF48 hold a security certification?
None is published on this site, and we publish no data processing agreement template or sub-processor list either. If you need any of them, ask in writing before you subscribe and treat a refusal as your answer.
Does the GDPR apply to my automations?
If they handle personal data about people, yes. Our post on chatbot data covers the processor rules and the contract. For your own case, ask a legal adviser.
Can an automation fail without anyone noticing?
In any setup with no monitoring, yes. PROOF48 says every automation it builds has a health check and a defined alert path, so a failure reaches you before it reaches your clients.
Where PROOF48 fits
Connecting business data to an automation tool is as safe as the access you grant and the checks you keep. List every connection, give each the least access it needs, verify who calls your webhooks, ask vendors in writing where data goes, and remove access when a person or a tool leaves. PROOF48's AUTOMATE plan is 2,997 EUR a month and covers website chat, DM and email, not WhatsApp or phone. We publish no certification or sub-processor list, so ask us in writing too.
Cosmin Tiu · Founder, PROOF48
Cosmin has worked in online marketing and software development since 2018, and has built with AI every day since January 2023. He still writes code from scratch daily, in Python, React, Rust and C#. PROOF48 ships business websites in 48 hours and invoices afterwards, so every opinion on this blog was paid for in real builds, not in theory.