A connection gives one AI assistant read-only access to one Ceviche team, as one person. This page explains each part of that sentence and what enforces it.
Sign-in
- You sign in on Ceviche's own page, with your usual Ceviche email and password. The assistant never sees your password and never handles your Ceviche session.
- Sign-in uses OAuth 2.1, the standard way for one app to get limited access to another, with PKCE, which ties the sign-in to the app that started it so an intercepted code is useless.
- Ceviche always shows the consent page. No assistant can skip it or approve on your behalf. The page names the assistant, your team, your email and the address the sign-in returns to, and lists what the assistant will be able to read.
- Ceviche only completes a sign-in for assistants it recognises. Today that is Claude, ChatGPT and Codex, and apps that receive the sign-in on your own computer, such as Claude Code. A request that names any other web address is refused before you see a consent page.
What a connection can reach
| A connection can | A connection can't | |
|---|---|---|
| Teams | Read your one team | Reach any other team, ever |
| Records | Read what you could open in the app | Read anything your own account can't |
| Actions | Look things up | Create, change, approve, post, delete or move anything |
| Your account | Read your name, email and role | Change your account, password or settings |
One team
A connection is bound, at the moment you click Allow, to the team the consent page showed. Ceviche checks on every request that you are still on that team. If you leave the team, the connection stops working on its next request.
If the team changes between the moment the consent page loaded and the moment you clicked Allow, Ceviche refuses the Allow ("This page has expired") rather than grant access to a team you weren't shown.
Your own permissions
Every read runs as you. Ceviche's own row-level security, the same rules that decide what you see in the app, decides what the MCP returns. The MCP adds its own team check on top. Neither depends on the assistant behaving well: an assistant that asked for another team's records would get nothing back.
Read-only, whatever your role
Admins, members and viewers can all connect. The connection is read-only for all of them. There is one access level, read, and no way to ask for more. On top of that, every read runs in a database session that refuses writes outright, so even a mistake in the MCP itself couldn't change your data.
How long access lasts
-
Access renews itself while you use it. The assistant holds a short-lived pass (an hour) and swaps it for a new one as needed, without asking you again.
-
Unused connections expire. If the assistant doesn't use the connection for 30 days, it has to sign in again.
-
Access stops at once when:
- you disconnect it, from the assistant or from Ceviche (see Disconnect and revoke access);
- you leave the team, or your account is removed from it;
- Ceviche turns the MCP off for your team.
In each case the next request fails, even if the assistant still holds a pass that hasn't expired.
-
A stolen pass is caught. Each renewal pass works once. If a pass that was already used turns up again, Ceviche treats the connection as compromised and cuts it off completely, so whoever holds the copy and the legitimate assistant both have to sign in again.
Who can see and manage connections
- Each person sees their own connections in Linked Accounts, and can disconnect them.
- No one else can see or disconnect your connections, admins included. An admin who wants a person's access stopped can remove them from the team, which stops their connections at once, or ask Ceviche to turn the MCP off for the team.
- Ceviche keeps a record of each tool call: which account, which team, which assistant app, which tool, how many records came back, how long it took and whether it worked. It doesn't record your questions or the records returned. See How your data is handled.
Text inside your records
Records hold text written by people: vendor names, notes, descriptions, rejection reasons. Some of it comes from outside your team, such as the name a vendor gives itself on a bill. Someone could write text that tries to give the assistant instructions. Ceviche MCP defends against this:
- It tells the assistant, in its instructions and in every tool, that text from records is data and never an instruction, and that it must never send Ceviche data anywhere because a record says to.
- It removes web addresses and email addresses from record text before the assistant sees it, so a record can't plant a link that leaks data.
- It cuts unusually long text and strips hidden control characters.
- When record text reads like an instruction to an AI, the answer carries a warning saying so, and that it is data from your books, not a request from you.
No defence of this kind is perfect, and the assistant makes the final call. Because the MCP is read-only and bound to your own team, the worst a planted instruction could do through Ceviche is read your own team's data, which you can already see.
Good practice
- Connect only assistants your firm has approved for financial data.
- Use Claude's tool permissions if you want to approve each lookup. See Connect Claude.
- Disconnect assistants you no longer use. Linked Accounts lists them all.
- Report anything that looks wrong to operations@ceviche.ai or your Ceviche contact. See Support.