Swivel Assistant
Security and Permissions for the Swivel Assistant and Connected AI
How Swivel keeps the Swivel Assistant and connected AI apps inside your permissions, your account and your access code, and what Swivel records.
The AI Can Do Only What You Can Do
Section titled “The AI Can Do Only What You Can Do”The Swivel Assistant and any AI app you connect to Swivel work as you. Every action runs inside your account and goes through the same permission check as the Swivel screen it matches.
- It never sees more than you do. Every record an action reads goes through the same visibility rules as the screen. An action can show less than the screen, never more.
- Your role applies. Tenant roles are Owner, Manager and Staff. For example, billing and AI credit purchases are for Owners only, and pipeline, sales stage and transaction type settings are for Owners and Managers, as on the settings screens. See Swivel User Roles and Permissions.
- Your access code applies. If you sign in with an access code, the AI sees products, transactions, workflows and tasks narrowed the same way your screens narrow them. See Access Codes.
- It stays in your account. The AI works in one account at a time and cannot reach another firm’s records.
- A denied action stops there. When you ask for something your role does not allow, the AI gets a message that it isn’t allowed, and nothing changes.
To change what a person can do with the assistant, change that person’s role or access code. The assistant and connected apps follow the same settings as the screens.
How the Swivel Assistant Signs In
Section titled “How the Swivel Assistant Signs In”The Swivel Assistant does not use a password or a key on the page.
- When the assistant acts for you, Swivel gives it a short-lived pass that works for about 10 minutes and cannot be renewed. It is never shown on the page or in the chat.
- Each pass matches the account and access code of the page you wrote from.
- When you change or reset your password, every pass issued before the change stops working.
- When a reseller views your account, or an upline views it through Network View, the assistant does not act in your account for them.
How Connected AI Apps Sign In
Section titled “How Connected AI Apps Sign In”A connected AI app (see Connect Your Own AI to Swivel (MCP)) signs in through Swivel’s own sign-in page:
- Your sign-in, your MFA. You sign in to Swivel and pass the same multi-factor check as the app.
- You approve each app. Swivel always shows the approval screen to an app that registered itself, names where you will be sent, and warns you when an app runs on your computer or is not one Swivel recognizes.
- One user, one account, one access code. Each connection is tied to the user who approved it, the account picked at sign-in, and the access code entered, if any.
- Only for AI tools. A connection’s pass works only on the MCP server. Swivel’s other APIs refuse it.
- No API keys. Swivel API keys cannot be used with the MCP server, because every action must run as a signed-in user.
- Unfinished sign-ins are removed. An app that registers but is never approved is deleted after 24 hours.
A connection gets all of your permissions. You can’t limit one connection to fewer actions.
Sensitive Data
Section titled “Sensitive Data”- SSN and Medicare numbers are never included when the AI reads a contact. They are stored encrypted.
- Files the AI makes or exports open only for the person who asked, in the browser where they are signed in to Swivel.
- Page context: the Swivel Assistant gets the page’s name, address and record IDs with each message, never the text on the page. You can leave the page out of a message. See Ask the Swivel Assistant for Help.
When you connect your own AI app, data it reads from Swivel goes to that app and its AI provider, under their terms.
The Assistant Asks Before Risky Actions
Section titled “The Assistant Asks Before Risky Actions”The Swivel Assistant asks you before it deletes something, sends an email or text, reaches outside Swivel, makes many changes at once, or spends money. It goes ahead only after you click Yes, go ahead. See When the Assistant Asks First.
A connected AI app follows its own rules for asking. Check your app’s tool approval settings.
What Swivel Records
Section titled “What Swivel Records”- Changes: a change the assistant or a connected AI app makes is saved under your name, the same as a change you make on a screen.
- AI credits: the AI credit usage page lists Swivel Assistant credits by day and person. Account Owners can open it from Settings > Billing. See AI and Transcription Credits.
- Chats: your chats with the assistant and the team are kept in the History tab.
Can a Staff user use the assistant to see contacts they can’t see on screen?
Section titled “Can a Staff user use the assistant to see contacts they can’t see on screen?”No. The assistant checks the same visibility rules as the Contacts screen. A Staff user sees the same contacts through the assistant as on screen.
Can I turn the assistant off for one person?
Section titled “Can I turn the assistant off for one person?”No. There is no on/off setting for the assistant. To limit what a person can do, change the person’s role or access code.
Can someone outside my firm use the assistant in my account?
Section titled “Can someone outside my firm use the assistant in my account?”No. The assistant acts only for users of your account. When a reseller or an upline views your account, the assistant does not act for them there.