Data-access terms

Security

The first time your organization registers an integration after these terms apply, the administrator registering it accepts them on the organization’s behalf. On a new install that is its first integration; on an install that already had integrations, it is the next one. They describe how credential brokering works, so that nobody hands Greenlight a key without knowing what it will be used for. Acceptance is asked once per organization, recorded with who accepted and which version, and written to the audit log.

These terms are Greenlight’s own statement about your installation. They are separate from Shift’s published privacy policy and terms of service, which are disclosure only and never ask for acceptance.

Version 2026-09-23.

What granting a credential means

1. A grant points a coding agent at your key. When you grant an integration credential to an app or to a person, their coding agent can call that upstream system using the credential. For an app, that is the app itself and the agents that build it. For a person, it is their own agent working on their behalf.
2. The key’s own permissions are the limit. Greenlight does not model or narrow the upstream’s permission system. The free-text scope you record on a credential describes it; it does not restrict it. Whatever the key can do in the upstream, a granted agent can do.
3. Greenlight brokers and audits proxied calls. For a proxied credential, the key never leaves Greenlight. Every call goes through the proxy and is recorded in the audit log, attributed to the app or person it was made for. Revoking the grant stops the next call.
4. Injected credentials are disclosed. For an injected credential, the holder receives the key itself, including on a developer’s machine. Greenlight records who was granted it but cannot broker or audit the calls made with it, and rotating the key upstream is the only way to take it back.
5. You choose what the key can reach. Create each key in the upstream system with the least access the work needs, on a dedicated account where the provider allows one, so its actions are attributable in the upstream’s own logs and it can be disabled without affecting a person.
6. You decide every grant. Nothing receives access until a grant is approved, either by you in the dashboard or by an auto-approve policy you set on the credential. You can revoke any grant at any time.

Where you see this in the product

• On every registration, the registration wizard explains what a grant means. Until your organization accepts these terms, it also asks you to accept them before it can finish.
• When you approve a grant, the confirmation says who the approval lets call which system with which credential, that calls are audited, and that you can revoke it there.

See Manage integrations for the registration and approval steps, and Data brokering for how the proxy works.