Security Overview

How a connection works

1. 1

   You approve access with the provider

   You sign in and grant access on the provider's own screen. The hosted OAuth flow is run by Composio, our credential infrastructure partner.

2. 2

   We store a reference, not your tokens

   For hosted connections, ClawLink keeps only a pointer to your connected account. Your provider OAuth tokens stay with Composio.

3. 3

   Your agent runs a tool you triggered

   When you ask your agent to do something, ClawLink runs that one request against the provider for you. Nothing happens unless you trigger it.

4. 4

   You stay in control

   Disconnect any connection from your dashboard at any time, and revoke access with the provider directly whenever you want.

How we store credentials

Most integrations connect through our hosted Composio flow, where ClawLink keeps only a reference to your connected account, not your provider tokens. When an integration needs a credential we hold directly, such as an API key you enter during setup, we encrypt it with AES-256-GCM before it is written to our database and decrypt it only in memory when your request runs. Encryption keys can be rotated without downtime.

The code on your machine is open

The agent plugins, the CLI and the MCP shim are published in full on GitHub, so you can read exactly what runs on your computer before you install it. They talk to one host, claw-link.dev, and hold one secret: your ClawLink API key. They never see your app passwords or OAuth tokens.

Operational access and data

We request the least provider scope a feature needs. Each tool call is logged with the arguments your agent sent and the response the provider returned, so a failed call can be debugged and support can see what happened. These logs are deleted after 90 days. Product analytics receive only which tool ran, when, and whether it succeeded, never the contents.

Disconnecting integrations

You can disconnect any connection from your ClawLink dashboard at any time. For higher-assurance removal, revoke ClawLink's access from the provider's account directly, and contact us for deletion requests.

What we rely on

ClawLink runs on infrastructure we do not operate ourselves. Hosted OAuth and provider token storage are handled by Composio, which publishes its compliance at its trust center, and the service runs on Cloudflare. To make a request we decrypt your credential in memory at execution time, so encryption at rest does not mean ClawLink never handles the secret. We would rather be precise about these boundaries than imply more isolation than there is.

Reporting Security Issues

Security reports can be sent to security@claw-link.dev. Please include reproduction steps, affected endpoints, and any relevant account or request context.