# API Security & Third-Party > An overview of how Checkgrow manages external API integrations, credential security, and data flow between the platform and third-party services. Category: Security & Compliance Source: https://doc.checkgrow.com/docs/api-security-and-third-party-integrations ## Core Security Principles Checkgrow integrates with several external APIs to power its core features — from AI-generated content to LinkedIn automation and website research. This page explains the security principles that govern these integrations, how your credentials are handled, and what data flows to each external service. **Core Security Principles for All API Integrations** Every external API integration in Checkgrow is built around the following principles: - **Least Privilege:** Each integration only receives access to the data it needs to perform its specific function. No integration has broad access to your account or company data. - **User-Initiated:** All third-party API calls are triggered by an explicit action you take in the platform. Data is not sent to external services passively or in the background without your knowledge. - **Authenticated Calls Only:** All calls to external APIs are made server-side through Checkgrow's edge functions, meaning your data never goes directly from your browser to a third-party API. Requests are always proxied and authenticated through our backend. - **DPA-Covered:** Every API service we use has signed a Data Processing Agreement with Checkgrow, defining exactly how they may and may not use data shared with them. ## How API Calls Are Made When you use a feature that requires an external API (for example, asking the AI agent to research a competitor), the following happens: 1. Your request is sent from the browser to **Checkgrow's edge function** over an encrypted HTTPS connection 2. The edge function **validates your authentication** — requests without a valid token are rejected immediately 3. The edge function **calls the external API** on your behalf, using Checkgrow's own API keys stored as secure environment secrets 4. The response is processed and **stored in your company's data scope** before being returned to you > Your personal credentials are never sent directly to third-party APIs. Checkgrow acts as the authenticated intermediary, using its own API keys to make calls on your behalf. You never need to provide your own API keys for core platform features. ## AI Providers (OpenAI, Google Gemini, Perplexity AI) When you use AI features — whether the Knowledge Assistant, AI Agents, or content generation — your input is sent to one of our AI provider partners. **Key protections:** - **No model training:** Your data is never used to train AI models. We use the OpenAI API with **zero data retention**, meaning prompts and responses are not stored by OpenAI beyond the immediate API call. - **You choose the model:** Where multiple AI providers are available (OpenAI vs. Google Gemini), you select which one to use. This gives you control over which provider receives your input. - **Input scoping:** Only the specific content you are working with (the page, the prompt, the knowledge entry) is sent to the AI. Your entire company database is not exposed. - **Temporary context only:** AI models receive only the context needed for the current task. They do not retain memory between sessions. ## LinkedIn Integration The LinkedIn integration enables features including post searching, profile discovery, and engagement automation. **Zero-Storage Architecture:** Your LinkedIn password is **never stored** in Checkgrow's database at any point. Authentication happens directly with LinkedIn using your credentials, and the session token is used transiently for API operations. Once your session ends, no credential data persists. **Public Data Only:** The LinkedIn integration operates exclusively on publicly available LinkedIn data. Checkgrow does not access private messages, private profile data, or any content that the account owner has not made publicly visible. **Data processed by LinkedIn integration:** - Post content (public posts in your feed or search results) - Public profile information of LinkedIn members - Your account's ability to interact with public content > The LinkedIn integration requires connecting your LinkedIn account through the Integrations settings. You can disconnect your LinkedIn account at any time from the **Integrations** page, which immediately revokes Checkgrow's ability to perform LinkedIn actions on your behalf. ## Website Research & Analytics When you request competitor analysis, website structure analysis, or conversion research, Checkgrow uses Firecrawl to access publicly available web pages. - **What is scraped:** Only public-facing pages — homepage, landing pages, and URLs you explicitly provide. - **What is not scraped:** Login-protected content, private areas, or data behind authentication walls. - **When it runs:** Only when you explicitly trigger a scan or research request. No automatic background crawling occurs without your action. The Google Analytics integration allows you to connect your GA4 property and pull performance data into Checkgrow. - **Authentication:** Uses the official Google OAuth 2.0 flow. You grant permission through Google's own consent screen, and a refresh token is stored securely in our database linked to your account. - **Scope:** Read-only access to your Google Analytics data. Checkgrow never writes data to your GA4 property. - **Revocation:** You can disconnect Google Analytics at any time from the **Integrations** page, and your credentials are immediately removed. ## Email (Resend) & Admin Security Resend is used exclusively for **transactional emails** — these are emails the platform sends you for functional purposes: - Password reset links - Email magic link authentication - Account invitation notifications - Data export notifications - Consent withdrawal confirmations Resend does not receive any of your company content, AI generations, or business data. The only information shared is your email address and the specific transactional message content. > We do not use Resend or any external service for bulk marketing email. Marketing communications require your separate, explicit opt-in consent and are managed independently. If you are a **Company Admin** or **Master Admin**, you should be aware of the following: - **Webhook integrations (n8n, Notion):** Custom webhook connections allow data to be sent to external endpoints you configure. You are responsible for the security of your configured webhook URLs and destination services. - **Integration management:** All connected integrations for a company are visible under the Integrations section. Review these regularly and remove any connections that are no longer needed. > **Important** > > Checkgrow does not audit the security of external services you connect via webhooks. Ensure that any third-party automation tools or databases you connect have appropriate access controls and encryption.