Reachlee DocsPermissions and security
What an AI assistant can and cannot do through the Reachlee connector, how sign-in and tokens work, and how to revoke access.
Permissions you grant
At sign-in the Reachlee page lists what the app may do. There are three permissions:
| Permission | Allows |
|---|---|
| Read | Analytics, automations, conversations and leads across the accounts you can see |
| Manage automations | Create, edit, pause, resume and retrigger automations |
| Reply in conversations | Send replies inside open conversations, after confirming with you |
A connection without a permission simply cannot use the tools that need it, and the assistant is told so.
Confirmation before anything is sent
Tools that change something are marked as such, so Claude and ChatGPT ask before running them. On top of that, retrigger and reply_to_conversation return a preview and only act on a second call with your confirmation. Reading never needs confirmation.
Instagram rules still apply
The connector goes through exactly the same send path as the Reachlee app. That means replies only inside Instagram's 24-hour window after the person's last message, no first-contact messages, no broadcasts, and every account-level limit or pause still applies.
How sign-in works
Reachlee uses standard OAuth 2.1 with PKCE. The assistant registers itself with Reachlee, opens the browser on our sign-in page, and receives a token only after you click Allow. You never see or handle a key.
- Each token represents you through one app. It cannot be used by another app or another user.
- Tokens are random and stored only as a hash. A copy of Reachlee's database would not contain a usable token.
- Access tokens expire after 30 days and refresh automatically; the connection itself expires after 180 days of inactivity.
- Your Instagram and Facebook tokens never leave Reachlee's servers. The assistant only ever talks to Reachlee.
Revoking access
Open Settings → AI apps in Reachlee. Each connected app shows when it was connected, when it was last used and how many calls it made. Disconnect revokes it immediately; the assistant's next call fails and it will ask you to connect again. You can also remove the connector inside the assistant.
Limits
- At most 10 connected apps per user.
- Per connection: 60 read calls and 10 write calls per minute. The assistant is told to slow down if it exceeds them.
- Analytics tools share the dashboard's caches and timeouts, so a busy assistant cannot slow Reachlee for anyone else.
Data
The assistant receives only what you ask for, in the reply to that request. Reachlee does not send your data to Anthropic, OpenAI or any model provider itself; the assistant you use does, under its own terms. If that matters for your business, prefer an assistant plan whose terms exclude training on your data.