---
title: "Permissions and data"
description: "What Indent can access, how database access and secrets are handled, and who can see a session."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.indent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and data

Indent works with your systems the way a teammate does: only through the tools you connect, with the
access you grant.

## What Indent can access

Indent can only use integrations your organization or you have connected — GitHub, Slack, databases,
and MCP servers such as Notion, Linear, HubSpot, Datadog, and Sentry. Nothing is reachable until
it's connected, and Indent acts within the access that connection grants. To add or remove access,
manage the connection under
[**Settings → Integrations**](https://app.indent.com/settings/integrations). See
[Connecting MCP servers](/connecting/mcp-servers).

## Database access is read-only

When Indent queries a connected database, it runs read-only queries. It can read and analyze your
data but cannot modify it. Supported engines are PostgreSQL, BigQuery, and ClickHouse.

## Secrets are provided through the app

When a task needs a secret, such as an API key or a database password, you provide it through the
app. Indent never sees the value — only whether it's available. Environment secrets work the same
way: values are stored for the build and runtime, and Indent knows a secret exists without reading
it. See [Setting up environments](/getting-started/environments).

## Organization and personal scope

Every integration connects at one of two scopes:

- **Organization** — shared with your team. Indent connects with a shared account, and anyone in the
  organization can use it.
- **Personal** — yours alone. Indent connects as you, and only you can use it.

Only MCP servers can be personal. GitHub, Slack, and databases are always organization-scoped. A
personal integration works only in a private session. See
[Private sessions](/collaborating/personal-and-private).

## Who can see a session

By default, a session is visible to everyone in your organization, so teammates can follow the work
and pick it up. To keep a session to yourself, open the share control in the session header and make
it private.

> **Caution**
>
> Making a session private is permanent. You can't make it organization-visible again.

Direct messages with Indent in Slack and any session on your computer in the
[desktop app](/working-locally/desktop) are always private. Slack channel threads stay visible to
your organization.

Source: https://docs.indent.com/administration/permissions-and-data/index.mdx