Signl authenticates every request, stores API keys only as hashes, exposes no tool that writes to any of your systems, and deletes person-level signal data on a fixed schedule. This page covers what a connected agent can reach, what we keep and for how long, and how to revoke access or request erasure.
What a connected agent can reach
Signl exposes five tools, all read-only. Nothing in the tool surface writes to your CRM, your inbox, or any other system you use. See the MCP tool reference for the full list.
What we receive is the tool call itself: the tool name and the arguments your agent filled in. We do not receive your conversation. Your agent decides which tools to call and what to put in the arguments, so if you want to see exactly what left your machine, ask it to show you the arguments from its last Signl call.
Credentials
OAuth is the recommended path for Claude, ChatGPT and any client with a browser flow. You never handle a secret, each client holds its own grant, and revoking one leaves the others working.
API keys exist for clients with no OAuth flow, such as the CLI and scripts. A key begins with sk_signl_, is displayed exactly once at creation, and is stored only as a SHA-256 hash. It cannot be shown again by anyone, including us. Treat it as a password: anyone holding it can spend your credits.
If you use keys, generate one per client. A single shared key means revoking it disconnects everything at once.
Revocation. Both paths are revoked from the dashboard. Revoking an OAuth grant affects only that client; revoking a key affects everything using that key.
Transport and authentication
The MCP server runs over Streamable HTTP at a single POST endpoint, stateless: every request is authenticated independently and handled by a fresh server instance bound to your account, so there is no session state that could leak between users. GET and DELETE are rejected.
An unauthenticated request returns a 401 with a WWW-Authenticate header pointing at our authorization server metadata, following RFC 9728. That is what lets a client's connector UI find the OAuth endpoints rather than failing with a generic error.
What we keep, and for how long
| Data | Retention |
|---|---|
| Cached verified contacts | Kept so we do not re-charge you or re-query a provider for the same person. Deletion requests are actioned promptly |
| Public professional activity | 90 days from the date of the post, then deleted automatically |
| Role-change signals | 180 days, then deleted automatically |
| Billing records | As required by UK tax law, typically 6 years |
| Suppression records | Kept minimally and indefinitely, so an erasure or objection cannot be undone by later processing |
That last row is worth explaining, because it looks like a contradiction. When someone asks us to delete their data, we keep just enough of a record to recognise them if they appear in a provider response again. Retaining that minimal record is what makes the erasure stick. Deleting it entirely would mean silently reprocessing someone who already told us to stop.
The 90 and 180 day figures above are enforced in code, not by policy alone, and they match what our privacy policy publishes.
Person-level data
Person-level signals are the most sensitive category we handle, so they are gated separately from everything else.
Job change, promotion and tenure signals are derived from the employment history already present in an enrichment you paid for. No new provider call, no additional collection.
Public content analysis is a distinct and heavier category. It constitutes profiling under Article 4(4) UK GDPR, so it sits behind its own switch rather than riding along with employment facts, and it is off unless explicitly enabled. The refresh_person_signals tool is the only path that pays to fetch fresh person data, and it is available on the Unlimited plan only, rate-limited by a monthly cap shared across all accounts.
Lawful basis
Signl provides business contact details for business-to-business prospecting. Where we process personal data of individuals in the UK or EEA, we rely on legitimate interests under Article 6(1)(f) UK GDPR.
You are an independent controller of any data you export. Your own lawful basis, notice and opt-out handling when you contact those individuals are yours to establish. This page describes what we do; it is not legal advice about what you should do.
Full detail is in the privacy policy and the fair use policy.
Erasure and objection
Anyone whose data we hold can ask us to delete it or object to our processing, whether or not they are a customer. Requests are actioned across our systems, and the suppression record described above prevents the same person being reprocessed later.
Email vlad@akyx.digital to make a request. Account holders can also delete their own account data from the dashboard.
Reporting a security problem
Email vlad@akyx.digital with "security" in the subject. We answer these ourselves and we would rather hear about a problem early than tidily.
Related
Connect your agent for the setup itself, the MCP tool reference for what each tool does, and MCP security for revenue teams for the questions worth asking any data vendor before connecting.