[{"data":1,"prerenderedAt":547},["ShallowReactive",2],{"navigation":3,"\u002Fdata-connectors\u002Fsecurity":246,"\u002Fdata-connectors\u002Fsecurity-surround":542},[4,30,61,96,136,171,196,226],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":29},"Getting started","i-lucide-rocket","\u002Fgetting-started","1.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Add Clarify","\u002Fgetting-started\u002Fadd-clarify","1.getting-started\u002F2.add-clarify","i-lucide-bot",{"title":21,"path":22,"stem":23,"icon":24},"Dashboard tour","\u002Fgetting-started\u002Fdashboard-tour","1.getting-started\u002F3.dashboard-tour","i-lucide-compass",{"title":26,"path":27,"stem":28,"icon":6},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":31,"icon":32,"path":33,"stem":34,"children":35,"page":29},"Core concepts","i-lucide-lightbulb","\u002Fconcepts","2.concepts",[36,41,46,51,56],{"title":37,"path":38,"stem":39,"icon":40},"How Clarify works","\u002Fconcepts\u002Fhow-clarify-works","2.concepts\u002F1.how-clarify-works","i-lucide-git-compare-arrows",{"title":42,"path":43,"stem":44,"icon":45},"Tickets & delivery modes","\u002Fconcepts\u002Ftickets-and-modes","2.concepts\u002F2.tickets-and-modes","i-lucide-ticket",{"title":47,"path":48,"stem":49,"icon":50},"Categories & ticket fields","\u002Fconcepts\u002Fcategories-and-inputs","2.concepts\u002F3.categories-and-inputs","i-lucide-tags",{"title":52,"path":53,"stem":54,"icon":55},"Cards & placeholders","\u002Fconcepts\u002Fcards-and-placeholders","2.concepts\u002F4.cards-and-placeholders","i-lucide-layout-panel-left",{"title":57,"path":58,"stem":59,"icon":60},"Roles & permissions","\u002Fconcepts\u002Froles-and-permissions","2.concepts\u002F5.roles-and-permissions","i-lucide-user-cog",{"title":62,"icon":63,"path":64,"stem":65,"children":66,"page":29},"Configuration","i-lucide-sliders-horizontal","\u002Fconfiguration","3.configuration",[67,72,77,81,86,91],{"title":68,"path":69,"stem":70,"icon":71},"Onboarding","\u002Fconfiguration\u002Fonboarding","3.configuration\u002F1.onboarding","i-lucide-wand-sparkles",{"title":73,"path":74,"stem":75,"icon":76},"General settings","\u002Fconfiguration\u002Fgeneral-settings","3.configuration\u002F2.general-settings","i-lucide-settings",{"title":78,"path":79,"stem":80,"icon":50},"Categories","\u002Fconfiguration\u002Fcategories","3.configuration\u002F3.categories",{"title":82,"path":83,"stem":84,"icon":85},"Ticket inputs","\u002Fconfiguration\u002Fticket-inputs","3.configuration\u002F4.ticket-inputs","i-lucide-form-input",{"title":87,"path":88,"stem":89,"icon":90},"Panels","\u002Fconfiguration\u002Fpanels","3.configuration\u002F5.panels","i-lucide-panel-top",{"title":92,"path":93,"stem":94,"icon":95},"White label (your own bot)","\u002Fconfiguration\u002Fwhite-label","3.configuration\u002F6.white-label","i-lucide-badge-check",{"title":97,"icon":98,"path":99,"stem":100,"children":101,"page":29},"Modules","i-lucide-blocks","\u002Fmodules","4.modules",[102,106,111,116,121,126,131],{"title":103,"path":104,"stem":105,"icon":98},"Modules overview","\u002Fmodules\u002Foverview","4.modules\u002F1.overview",{"title":107,"path":108,"stem":109,"icon":110},"Transcripts","\u002Fmodules\u002Ftranscripts","4.modules\u002F2.transcripts","i-lucide-file-text",{"title":112,"path":113,"stem":114,"icon":115},"Feedback","\u002Fmodules\u002Ffeedback","4.modules\u002F3.feedback","i-lucide-star",{"title":117,"path":118,"stem":119,"icon":120},"Escalation","\u002Fmodules\u002Fescalation","4.modules\u002F4.escalation","i-lucide-siren",{"title":122,"path":123,"stem":124,"icon":125},"Opening hours","\u002Fmodules\u002Fopening-hours","4.modules\u002F5.opening-hours","i-lucide-clock",{"title":127,"path":128,"stem":129,"icon":130},"Webhooks","\u002Fmodules\u002Fwebhooks","4.modules\u002F6.webhooks","i-lucide-webhook",{"title":132,"path":133,"stem":134,"icon":135},"Assignment","\u002Fmodules\u002Fassignment","4.modules\u002F7.assignment","i-lucide-user-check",{"title":137,"icon":138,"path":139,"stem":140,"children":141,"page":29},"Integrations","i-lucide-plug","\u002Fintegrations","5.integrations",[142,146,151,156,161,166],{"title":143,"path":144,"stem":145,"icon":138},"Integrations overview","\u002Fintegrations\u002Foverview","5.integrations\u002F1.overview",{"title":147,"path":148,"stem":149,"icon":150},"Stripe","\u002Fintegrations\u002Fstripe","5.integrations\u002F2.stripe","i-simple-icons-stripe",{"title":152,"path":153,"stem":154,"icon":155},"PayPal","\u002Fintegrations\u002Fpaypal","5.integrations\u002F3.paypal","i-simple-icons-paypal",{"title":157,"path":158,"stem":159,"icon":160},"Tebex","\u002Fintegrations\u002Ftebex","5.integrations\u002F4.tebex","i-lucide-shopping-cart",{"title":162,"path":163,"stem":164,"icon":165},"Patreon","\u002Fintegrations\u002Fpatreon","5.integrations\u002F5.patreon","i-simple-icons-patreon",{"title":167,"path":168,"stem":169,"icon":170},"GitHub","\u002Fintegrations\u002Fgithub","5.integrations\u002F6.github","i-simple-icons-github",{"title":172,"icon":173,"path":174,"stem":175,"children":176,"page":29},"Data connectors","i-lucide-share-2","\u002Fdata-connectors","6.data-connectors",[177,181,186,191],{"title":178,"path":179,"stem":180,"icon":173},"Data connectors overview","\u002Fdata-connectors\u002Foverview","6.data-connectors\u002F1.overview",{"title":182,"path":183,"stem":184,"icon":185},"Build a connector","\u002Fdata-connectors\u002Fbuild-a-connector","6.data-connectors\u002F2.build-a-connector","i-lucide-wrench",{"title":187,"path":188,"stem":189,"icon":190},"Discord auto-detect","\u002Fdata-connectors\u002Fdiscord-auto-detect","6.data-connectors\u002F3.discord-auto-detect","i-lucide-scan-face",{"title":192,"path":193,"stem":194,"icon":195},"Connector security","\u002Fdata-connectors\u002Fsecurity","6.data-connectors\u002F4.security","i-lucide-shield",{"title":197,"icon":198,"path":199,"stem":200,"children":201,"page":29},"Security & trust","i-lucide-shield-check","\u002Fsecurity","7.security",[202,206,211,216,221],{"title":203,"path":204,"stem":205,"icon":198},"Security overview","\u002Fsecurity\u002Foverview","7.security\u002F1.overview",{"title":207,"path":208,"stem":209,"icon":210},"Encryption & secrets","\u002Fsecurity\u002Fencryption","7.security\u002F2.encryption","i-lucide-lock",{"title":212,"path":213,"stem":214,"icon":215},"The relay & your privacy","\u002Fsecurity\u002Fthe-middleman","7.security\u002F3.the-middleman","i-lucide-eye-off",{"title":217,"path":218,"stem":219,"icon":220},"Access & permissions","\u002Fsecurity\u002Faccess-control","7.security\u002F4.access-control","i-lucide-key-round",{"title":222,"path":223,"stem":224,"icon":225},"Data & retention","\u002Fsecurity\u002Fdata-and-retention","7.security\u002F5.data-and-retention","i-lucide-database",{"title":227,"icon":228,"path":229,"stem":230,"children":231,"page":29},"Reference","i-lucide-book-open","\u002Freference","8.reference",[232,237,241],{"title":233,"path":234,"stem":235,"icon":236},"FAQ","\u002Freference\u002Ffaq","8.reference\u002F1.faq","i-lucide-circle-help",{"title":238,"path":239,"stem":240,"icon":185},"Troubleshooting","\u002Freference\u002Ftroubleshooting","8.reference\u002F2.troubleshooting",{"title":242,"path":243,"stem":244,"icon":245},"Glossary","\u002Freference\u002Fglossary","8.reference\u002F3.glossary","i-lucide-book-a",{"id":247,"title":192,"body":248,"description":535,"extension":536,"links":537,"meta":538,"navigation":539,"path":193,"seo":540,"stem":194,"__hash__":541},"docs\u002F6.data-connectors\u002F4.security.md",{"type":249,"value":250,"toc":524},"minimark",[251,260,274,279,287,290,390,396,400,403,410,414,421,425,428,459,469,473,480,484,515],[252,253,254,255,259],"p",{},"Data connectors let you point Clarify at your own systems using a URL you provide. Because ",[256,257,258],"em",{},"you"," choose the address, Clarify treats every connector request as untrusted and runs it through a strict set of guardrails. This page explains, in plain terms, what those guardrails do — so you can connect your own services with confidence.",[261,262,263],"note",{},[252,264,265,266,270,271,273],{},"This page is specific to ",[267,268,269],"a",{"href":179},"data connectors",". For how Clarify protects everything else — logins, the relay, stored ticket data — see the ",[267,272,203],{"href":204},".",[275,276,278],"h2",{"id":277},"where-your-connector-can-reach","Where your connector can reach",[252,280,281,282,286],{},"A connector can only reach ",[283,284,285],"strong",{},"real, public internet endpoints",". Before every request, Clarify looks up the address behind your URL and checks it against a denylist. If the address is internal, private, or otherwise off-limits, the request is blocked before it ever leaves.",[252,288,289],{},"Blocked address types include:",[291,292,293,309],"table",{},[294,295,296],"thead",{},[297,298,299,303,306],"tr",{},[300,301,302],"th",{},"Address type",[300,304,305],{},"Example",[300,307,308],{},"Why it's blocked",[310,311,312,331,350,363,379],"tbody",{},[297,313,314,318,328],{},[315,316,317],"td",{},"Loopback",[315,319,320,324,325],{},[321,322,323],"code",{},"127.0.0.1",", ",[321,326,327],{},"localhost",[315,329,330],{},"Points back at the server itself",[297,332,333,336,347],{},[315,334,335],{},"Private networks",[315,337,338,324,341,324,344],{},[321,339,340],{},"10.x",[321,342,343],{},"172.16–31.x",[321,345,346],{},"192.168.x",[315,348,349],{},"Internal-only addresses",[297,351,352,355,360],{},[315,353,354],{},"Cloud metadata",[315,356,357],{},[321,358,359],{},"169.254.169.254",[315,361,362],{},"Would expose hosting credentials",[297,364,365,368,376],{},[315,366,367],{},"Link-local & CGNAT",[315,369,370,324,373],{},[321,371,372],{},"169.254.x",[321,374,375],{},"100.64.x",[315,377,378],{},"Internal routing ranges",[297,380,381,384,387],{},[315,382,383],{},"Multicast, reserved & test ranges",[315,385,386],{},"—",[315,388,389],{},"Never valid for a real API",[391,392,393],"tip",{},[252,394,395],{},"If your connector needs to reach a service on your own network, put it behind a normal public domain with HTTPS first. Clarify can reach any genuine public endpoint.",[275,397,399],{"id":398},"no-sneaky-redirects","No sneaky redirects",[252,401,402],{},"Some URLs try to bounce a request onward to a second address. A connector could, in theory, be pointed at a harmless-looking URL that redirects into an internal one.",[252,404,405,406,409],{},"Clarify ",[283,407,408],{},"never follows redirects"," on connector requests. It connects to the exact address it validated — nothing more. A redirect toward a private or internal host is stopped at the gate rather than quietly followed.",[275,411,413],{"id":412},"response-size-cap","Response size cap",[252,415,416,417,420],{},"Every connector response is ",[283,418,419],{},"capped at roughly 1 MB"," (headers and body combined). This keeps a runaway or oversized response from overwhelming a ticket. If a response would exceed the cap, it's cut off rather than loaded in full. Connectors are designed for focused lookups — an order, a membership, a customer record — which comfortably fit within this limit.",[275,422,424],{"id":423},"your-credentials-are-protected","Your credentials are protected",[252,426,427],{},"Whatever a connector needs to authenticate — an API key, a bearer token, a username and password, or OAuth credentials — is handled the same way as every other secret in Clarify.",[429,430,431,443,453],"field-group",{},[432,433,436],"field",{"name":434,"type":435},"Encrypted at rest","always on",[252,437,438,439,442],{},"Connector credentials are encrypted before they're stored, using strong, tamper-evident encryption. See ",[267,440,441],{"href":208},"Encryption"," for how this works across Clarify.",[432,444,446],{"name":445,"type":435},"Never shown back to you",[252,447,448,449,452],{},"Once saved, a credential is never displayed again — the dashboard only shows that a value is ",[283,450,451],{},"set",", never the value itself. That's why editing a connector shows \"leave blank to keep\".",[432,454,456],{"name":455,"type":435},"OAuth tokens minted server-side",[252,457,458],{},"For connectors that use OAuth, the tokens are exchanged and encrypted on Clarify's servers. They never pass through your browser.",[460,461,462],"warning",{},[252,463,464,465,468],{},"Give each connector only the access it needs. If your service offers a ",[283,466,467],{},"read-only"," API key, use that — a lookup connector never needs permission to change your data.",[275,470,472],{"id":471},"optional-extra-layer","Optional extra layer",[252,474,475,476,479],{},"For teams that want defence in depth, Clarify supports an ",[283,477,478],{},"optional egress proxy"," — a separate, independent checkpoint that every connector request can be routed through. It re-runs the same address checks on its own, so even a mistake in one layer is caught by the other. This is a product-operated safeguard; there's nothing for you to configure.",[275,481,483],{"id":482},"the-short-version","The short version",[485,486,487,495,502,509],"card-group",{},[488,489,492],"card",{"icon":490,"title":491},"i-lucide-globe-2","Public only",[252,493,494],{},"Connectors reach genuine public endpoints — never internal, private, or cloud-metadata addresses.",[488,496,499],{"icon":497,"title":498},"i-lucide-shield-off","No redirects",[252,500,501],{},"Requests are never bounced onward into a hidden internal host.",[488,503,506],{"icon":504,"title":505},"i-lucide-gauge","Size-capped",[252,507,508],{},"Responses are limited to about 1 MB, so nothing runs away.",[488,510,512],{"icon":210,"title":511},"Encrypted keys",[252,513,514],{},"Credentials are encrypted at rest and never shown back to you.",[391,516,517],{"to":204},[252,518,519,520,273],{},"Want the full picture — logins, the relay, and what data is stored? Read the ",[283,521,522],{},[267,523,203],{"href":204},{"title":525,"searchDepth":526,"depth":527,"links":528},"",1,2,[529,530,531,532,533,534],{"id":277,"depth":527,"text":278},{"id":398,"depth":527,"text":399},{"id":412,"depth":527,"text":413},{"id":423,"depth":527,"text":424},{"id":471,"depth":527,"text":472},{"id":482,"depth":527,"text":483},"How Clarify keeps user-built connectors safe — only real public endpoints, encrypted credentials, no redirects, and capped responses.","md",null,{},{"icon":195},{"title":192,"description":535},"grW967Tk15Oi6lu4kYPRJxDfH-rAHVTLHE3qPIpJs4U",[543,545],{"title":187,"path":188,"stem":189,"description":544,"icon":190,"children":-1},"Show a member's own record on their ticket automatically — using their Discord ID, with nothing for them to type.",{"title":203,"path":204,"stem":205,"description":546,"icon":198,"children":-1},"How Clarify protects your secrets, keeps staff private, and controls who can see what.",1792666273285]