Menu
Articles in this section
Security, Data, and Privacy for the Insightly CRM MCP Server
How does authentication work?
The Insightly CRM MCP Server uses OAuth to connect your Insightly account to a supported AI assistant. You sign in through Insightly's own login screen and authorize the connection yourself. You can sign in with your Insightly email and password, or your Google or Microsoft login. SSO sign-in, such as Okta, is not supported yet.
Do I need to share my Insightly password with the AI assistant?
No. You sign in through Insightly's own authentication screen, and the AI assistant never receives your Insightly password.
What can the assistant see and do in my CRM?
The MCP Server respects your existing Insightly account permissions. If you don't have access to a record or object directly in Insightly, you won't have access to it through the assistant either.
| Action | Supported |
|---|---|
| Read / search records | Yes |
| Create new records | Yes |
| Update existing records | Yes |
| Delete records | No |
| Link / relate records to each other | Yes |
| View activities, notes, and comments | Yes |
| Change account or system settings | No |
Can the assistant change my CRM data without asking me first?
Confirmation before an update or addition is written to your CRM is handled by your AI assistant, not by Insightly. Claude and ChatGPT prompt for confirmation, and settings within the assistant can affect this. Review each proposed change before you confirm it.
Is my Insightly data used to train AI models?
Insightly does not use CRM data accessed through the MCP Server to train AI models. When you connect an AI assistant, it receives the CRM data it requests to answer your questions, and that data is handled under your AI provider's terms. Whether it is used to train the provider's models depends on the provider and plan you use. Review your chosen provider's privacy and data use terms before connecting.
Is the MCP Server SOC 2 / GDPR compliant?
Insightly maintains a SOC 2 Type II report. The MCP server was launched after the most recent audit window and is not within the scope of that report. A copy of the current report is available on request under a mutual NDA. Contact security@unbounce.com. To request a Data Processing Agreement, contact legal@unbounce.com. Customers should also consider how connecting an AI assistant affects their own obligations. Responsibility for evaluating the chosen AI assistant rests with the customer. Insightly has no visibility into, or control over, how a connected AI assistant handles, processes or retains the data it receives.
Is the MCP Server HIPAA compliant?
The Insightly CRM MCP Server is not currently covered by Insightly's Business Associate Agreement. If your organization is subject to HIPAA, do not use the MCP Server with protected health information. For questions about HIPAA and Insightly, contact legal@unbounce.com.
How do I disconnect the assistant from my Insightly account?
You can disconnect the Insightly connector from within your AI assistant's settings. Disconnecting stops the assistant using the connection, but does not immediately revoke the underlying authorization on Insightly's side. The refresh token expires after 30 days. To end a user's access immediately, for example when they leave your organization, an admin can disable or delete the user in Insightly. See the How to connect section of What Is the Insightly CRM MCP Server? for setup steps.