Permissions and security

What you allow

• You log in to DMFast yourself and press Allow. The AI app never sees your Instagram or Facebook password, and gets no key it could reuse elsewhere.
• It works only on the one account you pick when you allow it, with your plan's limits.
• It can do what the tools allow, and nothing else: it can't change your plan, billing, payout details or connected accounts.

Teammates' apps

On Business, teammates who are managers or admins can connect an app too; viewers can't. Each app works with the role of the person who connected it, checked on every request: if they're made a viewer, removed from the team, or the workspace leaves Business, their app stops at once.

Safeguards on every action

• Everything an app changes goes through the same checks as the dashboard: Instagram's and Messenger's 24-hour rule, your plan's limits, and the demo sandbox, where nothing is sent.
• Each tool tells the app whether it only reads, makes changes or can't be undone (deleting an auto-reply, cancelling a call, refunding a sale), so apps like Claude and ChatGPT ask you before running it.
• Messages from other people are passed to the app as quoted data, with an instruction not to follow anything written inside them, so a DM can't talk your AI into sending things.

Sign-in and tokens

• Connections use OAuth 2.1 with PKCE, the standard for app sign-ins.
• An app's access lasts 1 hour at a time and is renewed in the background; if the app isn't used for 30 days, you sign in again.
• DMFast stores only fingerprints (hashes) of these tokens, never the tokens themselves.

Disconnect an app

Open ChatGPT & Claude in your dashboard to see each connected app, who connected it, when it was last used, and Disconnect it. Its access ends at once. Admins can disconnect any app; managers, the ones they connected. Removing the connector inside the app alone doesn't end DMFast's side, so disconnect here too.

The app itself handles your chats under its own privacy policy. DMFast's is here.