What the assistant may do — and how you check it yourself.
This page is the public reference for security reviews, procurement questionnaires and directory listings. It describes what the product does today. For every control it also says how you can verify the control yourself, in your own account, without asking us.
Control inventory
Every control below is enforced on our side, not merely suggested to the assistant. Deny is the default: whatever is not explicitly allowed does not run.
| Control | What it prevents | How you check it yourself |
|---|---|---|
| ControlRoles, read switch, entity scopes | What it preventsPeople — and their assistants — seeing data that is not theirs. Viewer, Editor and Admin set the frame; a read switch per person and entity scopes decide which data is readable at all. The read axis also covers previews, and entity scopes also apply to data pulled in from linked records and to reference lists. | How you check it yourselfUsers page in your account: switch a test user's read access off, then ask a question as that user. The request is refused before it reaches weclapp. |
| ControlAction allowlist per person | What it preventsA write nobody granted. Write rights are not one general "may write" flag but a list of named actions per person. Read-only is the default for a new user. | How you check it yourselfTake one action off a user's allowlist and let the assistant attempt exactly that action. It is refused — and the refusal shows up in the audit log. |
| ControlPreview before every write | What it preventsSilent changes. Every write action returns a preview first — field by field, line by line — and changes nothing by itself. | How you check it yourselfAsk for a change, read the preview, then stop. Open the record in weclapp: unchanged. |
| ControlPayload-bound one-time approval (SHA-256) | What it preventsAn approval being reused, widened or applied to different values. It is bound via SHA-256 to exactly this action, this record and this payload — valid once, then spent. | How you check it yourselfApprove an action, then submit the same approval a second time: rejected. Alter a value after the preview and the approval no longer matches. |
| ControlAudit log per call | What it preventsActivity nobody can reconstruct afterwards. Every call is recorded with who, when, which action and which outcome — refused calls included. For writes to records the audit log also keeps the operation (create, update, delete, status change), and for calls that run a specific route of a tool, such as a time booking or a PDF, which route ran. | How you check it yourselfAudit log in your account: the question you just asked and the change you just approved are both in it. |
| ControlDeletion only after your explicit approval | What it preventsRecords vanishing unnoticed. The assistant never deletes on its own: a deletion only happens when you ask for it, after a preview that names the record and your explicit one-time approval in the chat — and every deletion is logged, refused attempts included. Production orders cannot be deleted through this connection at all. House rules are deleted in the dashboard, supply sources in weclapp. | How you check it yourselfLook at the tool list your AI client shows after connecting: none of its tools is a delete tool. Ask for a deletion, read the preview, then stop: the record is still there. In the user policy, an entity scope without "Delete" rejects every deletion of that entity for that person. |
We hold no ISO 27001 or SOC 2 certification and do not claim one. What this page lists are technical controls in the product that you can check yourself.
Where your data goes
Three stations, no fourth. Each one is named, so a review can follow the path end to end.
- Your AI client
Claude, ChatGPT, Copilot Studio, Cursor or another MCP-capable client — running under your own account with your own AI provider.
- mcp.ai.wals.pro (EU, europe-west1)
Our hosted execution layer in Belgium. It authenticates the connection, applies roles, read switch, action allowlist and entity scopes, and passes on only the call that survives all of them.
- Your weclapp workspace
The call runs against your own weclapp installation with your own API credentials. Reads answer straight away; writes only after your approval.
What that means in plain terms
- We run no language model of our own.
wals.pro AI 4 weclapp is the execution layer between your AI client and weclapp. It does not generate answers — it checks calls and carries them out.
- Content your assistant reads is processed by your AI provider.
That happens under your contract with that provider, and depending on the provider it can involve processing outside the EU. That relationship stays yours; we are not a party to it.
- We keep no ERP content beyond the request.
Results pass through and are not stored. What remains is audit metadata — who, when, which action, which outcome — not the content of your records.
- Feedback from the chat contains only what you confirm.
A chat report or support request sent from the chat contains only what the preview shows you — a short description you confirm and your contact address — never the chat transcript. Before the preview is created, our server replaces e-mail addresses, IBANs, card and phone numbers and access tokens.
Access and connection
- OAuth 2.1 with PKCE
A client connects via OAuth 2.1 with PKCE. Your weclapp API credentials stay in your account and are never handed to the AI client. Every connection can be revoked on its own without affecting the others.
- One connection, one workspace
You choose the workspace while connecting, and the connection stays bound to it. Working in a different workspace means connecting again — there is no switch inside the conversation. If your workspace is moved to a different weclapp system, every earlier connection has to be approved again.
Connections from the Claude and ChatGPT directories
- Directory connection: read-only
A connection created through a public directory listing is capped to reading. It carries a small, fixed set of read tools and no preview, approval or execution tool at all — so a reviewer, or a curious first-time user, cannot change anything in an ERP.
- Preview and approval: your own connection
Write actions with preview and approval run over a connection you set up in your own account, under your roles and action allowlists. That is a deliberate second step, never an upgrade that happens by itself.
Contact and reporting
Security findings, questions from a review, or anything that simply looks wrong: reach us through support, or use the machine-readable contact file.