AI apps and your company
What Gryz controls when an AI app reaches company data, what it cannot control, and what your company and each member can do about it.
Updated · Reviewed by Jacob
Company workspaces and connected apps are rolling out. Some of this may not be on for your company yet.
Answer first
When an AI app such as Claude, ChatGPT or Cursor reads company data through Gryz, that data goes to the app's provider, under your company's (or the member's) own agreement with them. Gryz decides what the app can reach, checks it on every call, and records what it did. Gryz cannot control what the app does with the text after it has read it. Safety is shared between Gryz, your company and each member.
What Gryz controls
- Whether apps reach the company at all. Off until an owner turns it on. Unknown apps are refused until an owner approves them. See Team and Enterprise.
- What the app can reach. One workspace per call: the member's private space, or one company they added. Projects marked No connected apps are never visible, and the app never gets more than the member can open, capped at editor.
- What the app can change. Companies start read only. Writing needs the company to allow it and the member to tick Allow writing in this company for that app, and the write must name the company.
- The way out to the internet. While an app can see a company, it cannot publish public documents or make public links, anywhere.
- What the app sees as instructions. Everything it reads from Gryz is marked as data, never instructions, and it is told to ask the person before it works in a different workspace than the request came from.
- Stopping it. The member, an owner or admin, the company switch, or Gryz can stop an app, and the next call is refused. When a member leaves, their apps lose the company at once.
- Records. Which app (by its Gryz app id) used which tool, in which project, and when. Nobody using Gryz, and no part of the Gryz app, can change or delete them. App lines (agent and connected-app) are kept for 365 days (longer during a legal hold). Deleting the company removes them, and deleting an account removes the person's name; each deletion is recorded. A company can also record which items an app opened or listed (on by default in Enterprise; an owner can turn it on in Team too).
What Gryz cannot control
- What the app does with what it read. It can keep company text in its chat history or its own memory, or pass it to another tool connected to the same app. Gryz never sees the chat.
- Which account of the app was used. Claude Free and Claude Enterprise look the same to Gryz, and so do ChatGPT's personal and business plans. An allowed "Claude" includes a member's personal Claude account if they connect that one.
- A member's other Gryz account. If a member connects a second Gryz account (for example a personal one) to the same app, the app can carry text between the two.
- A model that is talked into a mistake. Within what the company and the member allowed, text an app reads can still trick it into writing in the wrong company. Read only, suggestions only and keeping company data separate make this smaller.
- Desktop apps by address. Gryz recognizes the Cursor desktop app by the address it returns to, which another program on the same computer could also use. In Enterprise, Cursor still needs an owner's approval.
What your company can do
- Choose Enterprise if every app should be approved first, and keep company data separate.
- Keep sensitive work out. Mark those projects No connected apps.
- Limit writing. Leave the switch at Read only, or let apps only suggest changes.
- Use your AI provider's admin settings. Business plans of AI apps can usually limit which connectors members may add. Check with your provider.
- Only connections the company sets up, if members should not connect their own apps at all.
What each member can do
- Check who you are. The Allow screen says "Signed in as" with your email. Use your work Gryz account for work.
- Connect your work AI account to your work Gryz account, not a personal one.
- Remove access anytime in Connected apps, for one company or the whole app.
Where the data goes
AI apps you connect are not Gryz sub-processors. You or your company choose to send data to them, under your own agreement with that provider. The services Gryz itself uses are listed in the privacy policy.