Security Practices

Security practices for managed automation.

We keep the first pass no-access. Paid work uses scoped access, documented approvals, and client-controlled credentials.

No passwords requested

TTT does not ask for personal passwords or shared admin credentials. Paid integrations use OAuth, scoped API keys, or client-approved service accounts.

No tenant admin access for first pass

The Free Snapshot is intake-based. Technical verification requires paid read-only access, exports, screenshots, screen-share, or client-native automation.

Scoped access only

Production workflows use the minimum permissions needed for the approved scope. Any privileged access must be authorized and documented.

Client data isolation

Each client gets separate workflows, credentials, logs, approval rules, and reports. Clients never see another client’s identifiable data.

Human approval

AI-generated outputs may contain errors. Humans approve high-impact actions involving money, access, HR, legal, compliance, health, security, or reputation.

Evidence by design

Triggers, approvals, actions, errors, and reports are logged where scoped so clients can see what happened and why.