Team and Enterprise
How a company owner decides which AI apps reach company data in Gryz, with the simple Team policy or the stricter Enterprise policy.
Updated · Reviewed by Jacob
Company workspaces and connected apps are rolling out. Some of this may not be on for your company yet.
Answer first
The company owner decides whether AI apps members connect to Gryz can reach the company at all. Nothing is reachable until an owner turns Connected apps on. Then the company picks a policy:
- Team (the default): connect once, few settings. Claude, ChatGPT and Cursor are allowed. Any other app needs an owner's approval.
- Enterprise: every app needs an owner's approval first, Claude, ChatGPT and Cursor included, and stricter protections turn on in one step.
Everything here is on the company Connected apps page. It covers apps members connect to their own Gryz. Company agents with their own keys are set up separately, on the Agents tab (see Company agent connections).
On for every company
These hold whatever the policy:
- Off until an owner turns it on. Every company, new or old, starts with connected apps off. The switch has three settings: Off, Read only, and Read and write.
- Projects can opt out. Mark a project No connected apps and no app a member connects can see it.
- Unknown apps are refused. An app Gryz has not verified (including one that registered itself under any name) cannot reach the company until an owner approves its exact app id.
- No public links. While an app can see a company, it cannot publish public documents or make public or password links, in the company or in the member's private space.
- No surprise access. A company a member joins later is not added to apps they already connected. They add it themselves.
- Leaving ends it. When a member leaves or is removed, their apps lose the company at once.
- Records. Every company line in Activity names the app by the id it registered with Gryz, never the name it chose for itself. Nobody using Gryz, and no part of the Gryz app, can change or delete them. App lines (agent and connected-app) are kept for 365 days (longer during a legal hold). Deleting the company removes them, and deleting an account removes the person's name; each deletion is recorded.
- Gryz can block an app everywhere if it is misused.
Team
- Claude, ChatGPT and Cursor are allowed as soon as the switch is on. An owner can block any of them.
- Members choose for each app whether it may write. Writing also needs the switch at Read and write.
- An app that can read company data can also save notes in the member's private space. Turn on Keep company data separate if that is not what you want.
Enterprise
Switching to Enterprise asks for every app to be approved, pauses member connections to apps that are not, and turns these on in one step. You can change each one after.
| Protection | Enterprise default |
|---|---|
| Every app needs approval | On, Claude, ChatGPT and Cursor included |
| Keep company data separate | On: while an app can see the company, the member's private space and their other companies are read only in it |
| Access ends after | 30 days (7 to 90). Members add the company again to keep using an app |
| Record which items apps members connect open or list | On. Members are emailed first and records start 7 days later |
| Daily limit of items an app a member connects can read | 2,000 items a day. With Pause a member’s app when it reaches the limit on (Enterprise turns it on), that member's app is paused at the limit until an owner resumes it |
| Seal the record each day | On |
| Company keys | End 90 days after they were made, and never sooner than 14 days after the switch. Each key's owner gets an email first. |
Before you switch, the page shows how many member connections pause now and how many company keys end in 14 days.
Opt in, with either policy
- Ask members to sign in to Gryz again every set number of days.
- Only connections the company sets up. Turns off every app members connect, and company agents members made.
- Record which items apps members connect open or list. On by default in Enterprise; an owner can turn it on in Team too. Members are emailed first and records start 7 days later. Only ids or short addresses are kept, never what is in them.
- Apps members connect can only suggest changes. Changes go to Review for a person to accept.
- Legal hold. Nobody can forget company memories or delete company documents; records and every document version are kept, and the company cannot be deleted.
Who can change what
- Only an owner can turn connected apps on, approve an app, switch the policy or turn a protection off.
- Turning on legal hold or item records is also owner only and needs two-factor sign-in.
- Owners and admins can block an app, remove it for one member or for everyone, mark a project No connected apps, and turn connected apps off.
- Anything that lets apps reach more (turning connected apps on, approving an app, loosening or removing a protection) needs two-factor sign-in. Anything that narrows access (turning it off, blocking, removing, marking a project) does not.
- Every change shows in Activity with the old and new setting.
Related
How search works and where your data goes
How Gryz search finds your documents, notes, memories and tasks, who sees what, where your text goes, and how to turn it off.
AI apps and your company
What Gryz controls when an AI app reaches company data, what it cannot control, and what your company and each member can do about it.