Your tools, connected. Only as far as they need to go.

Sixteen live integrations. Every one of them asked for the smallest permission that does the job — and we can show you the ones we gave back.

Most AI tools ask for everything and call it convenience. We went the other way: nine Google permissions down to five, mail.google.com dropped entirely, full Drive access retired in favour of per-file access. Below is the whole catalogue, and then the receipts.

The catalogue

Google & Microsoft

Social

Productivity

E-commerce & payments

Connect several stores across several platforms at once — the connection is keyed per store, not per platform.

Coming soon

OneDrive · Google Business Profile · TikTok · WhatsApp Business

These four are marked coming-soon in the app and have no connect flow. The blocker is platform approval — a TikTok Content Posting audit, Meta business verification, a Google quota request — not our code. We'd rather show you a grey card than a broken button.

The receipts: scopes we asked for, and scopes we gave back

Anyone can write "we only request what we need". Here is what that actually cost us.

Google: nine scopes down to five

What's left is five: gmail.modify, email, profile, calendar, drive.file. gmail.modify is the only restricted scope we hold.

Scopes we were offered and refused

Shopify is read-only by grant

All seven Shopify scopes are read_*: read_products, read_orders, read_inventory, read_customers, read_price_rules, read_discounts, read_locations. Zero write scopes requested. No agent can change your store, because the grant itself doesn't permit it.

Stripe is read-only by construction

We're going to be precise here, because the precise version is less flattering and more useful.

Stripe puts its read_only OAuth scope behind a support request. The ungated option is read_write, and that's what the connect flow requests. So the grant is not read-only.

The implementation is. Our Stripe client exposes exactly four tools — get_revenue_summary, list_recent_charges, get_balance, list_payouts. There is no charge, refund, or payout-creation code path anywhere in Unyo. It doesn't exist to be called, hallucinated into, or exploited. When Stripe enables read_only for us, narrowing the grant is a one-line change.

What happens to your tokens

• Encrypted at rest, verified at the byte level. As of 16 July 2026, all 17 populated OAuth token columns are AES-256 encrypted. Zero plaintext tokens exist.
• The master key is unreachable by any client. It lives in a singleton table with a FOR ALL USING (false) policy, readable only by a privileged server function.
• Never logged, never leaked. A token is decrypted transiently to make one outbound call to the provider, then dropped. It never enters a log, a job payload, an error message, or a response.
• Row-level security on every connection. 109 of 109 public tables have RLS, across 291 policies, verified live on 16 July 2026. Your connection rows are yours.
• CSRF-signed state. Meta, Slack, Notion, LinkedIn, X, Shopify, Stripe and Trello all carry an HMAC-SHA256-signed state with a 10–15 minute expiry; the Meta flows verify it with a timing-safe comparison. The Google flows bind the callback to your authenticated session instead — the exchange rejects any state whose user id isn't the signed-in user, and expires it after 15 minutes. Outlook adds PKCE and validates the identity token's nonce against the state nonce, so an identity token can't be replayed across sessions.
• Our Meta publishing calls carry an appsecret_proof — an HMAC of the token with our app secret. It's a Tier 2 audit requirement most integrations skip.

An independent CASA Tier 2 dynamic security test (TAC Security, 6 May 2026) returned 0 Critical, 0 High, 0 Medium findings.

Connecting is where most tools waste your time

Connect from wherever you hit the wall. Ask Ashley for an Instagram post before Instagram is connected and you don't get an error — you get a Connect button that fires the OAuth flow the instant you land. Twelve providers are wired for one-click connect this way.

The run resumes itself. This is the part that matters. When an agent needs a connection it doesn't have, it doesn't fail and it doesn't lose your work: it pauses with a Waiting for connection notice, holds the exact pending action, and replays it the moment you're back. You land back in the conversation you left. You retype nothing.

Connections that heal themselves. Meta tokens roll on a daily job. If a refresh genuinely fails, the card flips to Reconnect required instead of failing silently in the background. If you revoke Unyo from Meta's own settings, the card updates itself with no page refresh.

You always know who you're connected as. Your Gmail address, your @handle, your Page name, your LinkedIn organization, or whether Stripe is in Live or Test mode — shown on the card.

Disconnect any integration, any time. One button on the card.

The boundary is the feature

Maya is the only agent with your inbox. Not by prompt — by runtime access control. Ashley literally cannot see an email tool; it's never mounted into her session. Ask her to check your inbox and she can't, because there's nothing there to call.

The same logic runs through the whole catalogue:

• Stripe is Blake's alone. No other agent can reach your payments data.
• Shopify reaches Sam, Alex and Blake — the agents who need orders and catalogue.
• 17 irreversible actions are confirmation-gated by database configuration, not by a prompt an agent could talk itself out of. Sending an email, scheduling one, deleting a calendar event, posting to Slack.
• Nothing publishes or sends by voice. The voice agent can draft the post. You tap the card. That boundary is deliberate and it isn't configurable.
• Automations draft, never send. Unattended send does not exist in Unyo.

Any agent will answer that one with a live status list — provider, account label, connected or expired. Never a token.

FAQ