What the assistant may do — and how you check it yourself.
This page is the public reference for security reviews, procurement questionnaires and directory listings. It describes what the product does today. For every control it also says how you can verify the control yourself, in your own account, without asking us.
Control inventory
Every control below is enforced on our side, not merely suggested to the assistant. Deny is the default: whatever is not explicitly allowed does not run.
| Control | What it prevents | How you check it yourself |
|---|---|---|
| ControlRoles, read switch, entity scopes | What it preventsPeople — and their assistants — seeing data that is not theirs. Viewer, Editor and Admin set the frame; a read switch per person and entity scopes decide which data is readable at all. The read axis also covers previews. | How you check it yourselfUsers page in your account: switch a test user's read access off, then ask a question as that user. The request is refused before it reaches weclapp. |
| ControlAction allowlist per person | What it preventsA write nobody granted. Write rights are not one general "may write" flag but a list of named actions per person. Read-only is the default for a new user. | How you check it yourselfTake one action off a user's allowlist and let the assistant attempt exactly that action. It is refused — and the refusal shows up in the audit log. |
| ControlPreview before every write | What it preventsSilent changes. Every write action returns a preview first — field by field, line by line — and changes nothing by itself. | How you check it yourselfAsk for a change, read the preview, then stop. Open the record in weclapp: unchanged. |
| ControlPayload-bound one-time approval (SHA-256) | What it preventsAn approval being reused, widened or applied to different values. It is bound via SHA-256 to exactly this action, this record and this payload — valid once, then spent. | How you check it yourselfApprove an action, then submit the same approval a second time: rejected. Alter a value after the preview and the approval no longer matches. |
| ControlAudit log per call | What it preventsActivity nobody can reconstruct afterwards. Every call is recorded with who, when, which action and which outcome — refused calls included. | How you check it yourselfAudit log in your account: the question you just asked and the change you just approved are both in it. |
| ControlNo delete tools for your business records | What it preventsRecords vanishing through the assistant. The tool surface offers no way to delete customers, articles, quotations, orders, invoices, shipments or bookings. | How you check it yourselfLook at the tool list your AI client shows after connecting. The only removals in it are narrow ones — a supply source on an article, one of your own stored house rules — and both take the same preview-and-approval path. |
We hold no ISO 27001 or SOC 2 certification and do not claim one. What this page lists are technical controls in the product that you can check yourself.
Where your data goes
Three stations, no fourth. Each one is named, so a review can follow the path end to end.
- Your AI client
Claude, ChatGPT, Copilot Studio, Cursor or another MCP-capable client — running under your own account with your own AI provider.
- mcp.ai.wals.pro (EU, europe-west1)
Our hosted execution layer in Belgium. It authenticates the connection, applies roles, read switch, action allowlist and entity scopes, and passes on only the call that survives all of them.
- Your weclapp workspace
The call runs against your own weclapp installation with your own API credentials. Reads answer straight away; writes only after your approval.
What that means in plain terms
- We run no language model of our own.
wals.pro AI 4 weclapp is the execution layer between your AI client and weclapp. It does not generate answers — it checks calls and carries them out.
- Content your assistant reads is processed by your AI provider.
That happens under your contract with that provider, and depending on the provider it can involve processing outside the EU. That relationship stays yours; we are not a party to it.
- We keep no ERP content beyond the request.
Results pass through and are not stored. What remains is audit metadata — who, when, which action, which outcome — not the content of your records.
Access and connection
- OAuth 2.1 with PKCE
A client connects via OAuth 2.1 with PKCE. Your weclapp API credentials stay in your account and are never handed to the AI client. Every connection can be revoked on its own without affecting the others.
- One connection, one workspace
You choose the workspace while connecting, and the connection stays bound to it. Working in a different workspace means connecting again — there is no switch inside the conversation.
Connections from the Claude and ChatGPT directories
- Directory connection: read-only
A connection created through a public directory listing is capped to reading. It carries a small, fixed set of read tools and no preview, approval or execution tool at all — so a reviewer, or a curious first-time user, cannot change anything in an ERP.
- Preview and approval: your own connection
Write actions with preview and approval run over a connection you set up in your own account, under your roles and action allowlists. That is a deliberate second step, never an upgrade that happens by itself.
Contact and reporting
Security findings, questions from a review, or anything that simply looks wrong: reach us through support, or use the machine-readable contact file.