Docs · Claude connector · Security
Security and administration
Each member connects their own SimpleSend account over OAuth 2.1. There is no shared service credential, no member can reach another member’s data, and every member can revoke their own connection at any time. There is no administrator console for those connections yet. This page says precisely what that does and does not give you.
Setting the connector up is covered on the connector docs page.
How a member connects
SimpleSend’s connector is an OAuth 2.1 resource server at https://simplesend.tech/api/mcp. Authentication is delegated to our identity provider (named in our privacy policy), which is the authorization server for SimpleSend accounts. It issues the tokens; SimpleSend verifies every one of them with it on every call. SimpleSend does not run its own authorization server and does not issue tokens.
- We publish protected-resource metadata (RFC 9728) at
/.well-known/oauth-protected-resource/api/mcp, naming that authorization server. A request without a valid token is answered 401 with aWWW-Authenticateheader pointing at it. - The authorization code flow uses PKCE, and redirect URIs must match exactly. Both are enforced by the authorization server.
- The member approves the connection on a SimpleSend consent screen while signed in to their own account. An authorization request expires after ten minutes.
- Loopback redirect URIs are not accepted, so Claude Code and other local clients authenticate with a personal access key instead of OAuth.
What a connection can do
The connector exposes 50 tools. Twenty-five are read-only and twenty-five write; none deletes your data (saving drafts replaces only the steps you resend, and stopping a LinkedIn send or an email sequence ends it without removing anything). The tools that send, launch or reply reach real people, and the ones that pause, resume or stop can end a run: they are marked that way to Claude and need the member’s go-ahead in the conversation.
A connection can read the member’s lead lists, campaigns, drafts, sequences and LinkedIn campaigns, see which SimpleSend features the member’s plan includes, and create lists, campaigns and saved briefs. Against the member’s credit balance it can research companies, have SimpleSend draft a campaign (draft credits per email), and search for new leads and enrich lists with work emails and phone numbers (Find Leads, which queries our data provider). It can save the drafts Claude writes and export campaigns. When the member has connected a LinkedIn account and their plan includes LinkedIn outreach, it can build, launch, pause, resume and stop LinkedIn campaigns sent from that account, and read and answer the conversations in its LinkedIn inbox. When the member’s plan includes email sending and they have set up mailboxes in the web app, it can also write email sequences, enroll leads, send a test to the member’s own address, run pre-flight, launch sequences from those mailboxes (always through a two-step confirmation in which the member gives their go-ahead in the conversation), and pause, resume or stop them. It cannot buy domains or mailboxes, set the business mailing address or edit the suppression list (web app only), connect a LinkedIn account (that needs the member’s LinkedIn credentials, in the web app), see billing details, change a plan, or read credentials for any other connected application.
Re-consent. The sequence tools were added after the connector first shipped. A connection approved before that never saw them in its consent text, so those tools answer with a link until the member approves the updated capability list once, on the Profile page. Everything else keeps working meanwhile.
A connector connection has full access to that member’s own SimpleSend data. The capability list on the consent screen describes what the tools do. It is not a set of permissions the member can narrow, and there is no read-only connector connection. Read-only access exists only for personal access keys, which a member can create with a read scope for Claude Code or a custom client. A read-only key is refused by every writing tool before the tool runs.
Tokens and keys
OAuth connections. Access tokens are issued, expired and refreshed by the authorization server. SimpleSend stores no access or refresh token; it verifies each token with the authorization server on every call, so a revoked connection stops working immediately rather than at the end of a cached window. Disconnecting deletes that client’s sessions and refresh tokens.
Personal access keys. A key is 32 random bytes, displayed once at creation and never again. We store only an HMAC-SHA256 digest of it, keyed with a server-side secret that is never written to the database, so a copy of the database alone can neither verify nor forge a key, and the digest is never readable from the browser. A member may hold up to 10 active keys.
Keys expire after 365 days by default. A member can shorten that, or set a key not to expire, so key lifetime is a member’s choice rather than an organization policy. Revoking a key takes effect immediately. Rotating a key is different: the previous key stays valid for 24 hours so configuration can be updated without an outage. Use revoke, not rotate, when a key may be compromised.
Isolation
- Every query is scoped to the connecting member. No tool accepts an account identifier, so there is no parameter through which one member could request another member's data.
- A web session token is refused. The connector accepts only tokens issued to a registered client, so a stolen browser session cannot drive it.
- Connector tokens are refused by our database API; the connector works only through SimpleSend's server, scoped to the member.
- No token passthrough. We never forward a member's Claude token to any third party; calls to our own providers use SimpleSend's credentials.
Limits
Limits are enforced per member and per IP address. Paid plans get the larger tool-call pool because drafting in Claude is itself a loop of tool calls. They are not configurable per organization; on Teams, the per-member credit cap is the spending control.
| What | Limit |
|---|---|
| Tool calls, free trial | 60 per member per 5 minutes, 1,000 per 24 hours |
| Tool calls, paid plans | 180 per member per 5 minutes, 3,000 per 24 hours |
| Tool calls, per IP address | 300 per IP address per 5 minutes |
| Protocol traffic | 300 per member per 5 minutes, 6,000 per 24 hours |
| Failed authentications | 60 per IP address per 5 minutes |
| Company research | 200 companies per member per day |
| Homepage lookups | 100 companies per member per day |
| Email sequence launches | 10 per member per day |
| Leads enrolled in sequences | 5,000 rows per member per day |
| Test emails | 3 per member per 5 minutes, 15 per day |
| Personal access keys | 10 active per member |
| Delegated tool calls (an administrator operating a member's account with their permission) | 600 per administrator per 5 minutes across every account they operate, 20,000 per 24 hours; the member's own limits still apply |
Logging and retention
We write one record per tool call: the tool name, the time, whether it succeeded, an error code if not, the credits consumed, how long it took, the caller’s IP address, which feature tip the reply carried if any, and a short one-way digest of the arguments. The arguments themselves are never stored — the digest is enough to answer a support question without the log becoming a second copy of your data. These records are deleted after 90 days by a scheduled job.
What the connector sends us, what we send back, which third parties are involved, and how long each kind of data is kept is set out in section 9 of the privacy policy.
What an administrator controls
SimpleSend Teams has seats, invitations, admins and per-member credit caps. The caps apply to connector usage too, but the connections themselves sit outside the team: today the connector is a per-member, self-service feature. Being direct about that is more useful than implying otherwise.
What you can do today
- Cap each member's monthly credits on Teams. The connector enforces the same cap as the web app, so research, SimpleSend drafting and Find Leads through Claude stop at it too.
- Remove a member from your team: they lose the seat and the shared pool at once, but their own account and connections remain. Deleting the account, with every key and connection, is done by the member, or by us on a verified administrator request.
- Decide whether the connector is available at all. Whether your organization can enable a connector is settled in Claude, not in SimpleSend, and your Claude administrator owns that decision.
- Ask us. On a verified request from an administrator we will revoke a member’s connection or produce their connector audit history. Write to ethan@simplesend.tech and we will respond within two business days.
What is not available
- Single sign-on (SAML or OIDC) and SCIM provisioning.
- Domain capture, so members of your domain are not automatically bound to an organization.
- An administrator view of which members have connected, or of their activity.
- Administrator revocation of another member's connection or key.
- An organization policy to disable the connector, require approval before connecting, or restrict which clients may connect.
- An administrator-visible audit log, log export, or SIEM feed.
- A spend cap for connector usage alone. A member's monthly credit cap covers everything they spend, in the web app and through the connector alike.
Security contact
Security questions, vulnerability reports and administrator requests go to ethan@simplesend.tech. Please include the word “security” in the subject line.