> ## Documentation Index > Fetch the complete documentation index at: https://docs.getmodus.com/llms.txt > Use this file to discover all available pages before exploring further. # Security > How Modus protects your data — automatic data classification, group-based access to sensitive data, scope permissions, token scoping, and platform security. Modus is designed so it only ever sees what it should: access is layered from the organization down to the individual context item. This page covers the security features you can see and configure, and the platform guarantees underneath them. ## Data classification Modus automatically scans the context it mines from your connected sources and classifies sensitive data — personal information, financial data, health records, and more, across 100+ built-in detection types. Every finding is assigned one of three levels: | Level | Meaning | Examples | | ----------------- | ---------------- | -------------------------------------------------------- | | **Sensitive** | High-risk data | Social security numbers, credit card numbers, health IDs | | **Flagged** | Medium-risk data | Email addresses, phone numbers | | **Non-sensitive** | Everything else | Public business information | Owners and admins review this on the **Security** page in the app: * **Overview cards** — counts of sensitive and flagged findings, total assets scanned, and distinct data classes detected. * **Data classifications** — a searchable table of every detected type with its match count. You can **override the default level** of any type — for example, treat email addresses as non-sensitive for your org, or promote an internal identifier to sensitive. Changes save automatically. * **Findings charts** — interactive breakdowns of where sensitive data lives (integration → asset) and what kind it is (category → type), so you can spot a risky source at a glance. ## Controlling who sees sensitive data Classification becomes enforcement through **group access**. On the Security page, the **Group access** panel is a simple matrix: for each member group, an owner or admin checks which sensitivity levels it may access. A group without access to a level doesn't get that data in answers, context, or tools. This lets you, for example, give the finance group access to sensitive financial fields while everyone else sees only non-sensitive context — without touching individual scopes or integrations. ## Groups and roles Access in Modus is built on two layers: * **Roles** control what a person can do in the product. Members of your organization are **Owners**, **Admins**, **Members**, or **Viewers** — owners and admins manage security settings, integrations, and the org; members build and use scopes and workflows; viewers can use but not change things. * **Groups** control what a person can access. Admins create named member groups (for example *Engineering*, *Finance*) and assign people to them. Groups drive two things: which **scopes** a person can use, and which **sensitivity levels** of data they can see. A built-in **Everyone** group covers all members of your organization. ## Scope and workflow access Every [scope](/guides/scopes) and [workflow](/guides/workflows) carries its own access configuration, set on its **Access** tab: * **Shared** — visible to the groups you pick, with separate **Use** (chat with it, run it) and **Manage** (edit, publish, delete) permissions per group. * **Private** — visible only to the owner and people invited by email. Ownership can be transferred, and safety **guardrails** written on the Access tab travel with the scope — they apply in the Modus app, in workflows, and over [MCP](/guides/mcp) alike. Access is enforced the same way everywhere: an external AI tool connected over MCP sees only the scopes and workflows that user could already use in Modus. ## Scoping what integrations share Connecting a source never means sharing all of it: * **Per-connection scoping** — when you connect an app or data source, you choose exactly what Modus may access: Slack channels, Jira projects, GitHub repositories, specific databases and schemas, BI folders and dashboards. Anything outside the selection is invisible to Modus. See [Connecting apps](/guides/connect-apps). * **Per-scope connections** — each scope is additionally limited to the integrations (and schemas within them) you enable on its **Connections** tab, so one scope can see your warehouse while another sees only Slack. ## API tokens and connected apps **Personal Access Tokens** (Settings → **API Tokens**) authenticate scripts and CLI tools. Tokens are scoped and can't exceed your own role's permissions: * Choose a preset — **Read-only**, **Run scopes & workflows**, **Full access** — or pick individual scopes like `scopes:invoke` or `context:read`. * Set an optional **expiry**; the token value is shown once, at creation. * Anyone in the org can see the token list; owners and admins can **revoke** any token, and revocation takes effect within seconds. **Connected apps** (Settings → **Connected apps**) lists every external AI tool connected over [MCP](/guides/mcp) with OAuth. Each connection shows what it was granted and when it was last used. Users can revoke their own connections, and admins have a **kill switch**: disabling a client immediately revokes every token it holds across the organization. ## Platform security * **Credentials are isolated.** Integration credentials — database passwords, API keys, OAuth tokens — are stored encrypted in a dedicated secrets vault, namespaced per organization. App connections use OAuth through our managed-auth provider, so Modus never sees your passwords. * **Encryption everywhere.** Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). * **Tenant isolation.** Each organization's data lives in its own isolated database schema and storage prefix; a request for one org can never read another's data, and tokens are bound to a single organization. * **Least-privilege access to your sources.** Integration guides walk you through read-oriented, minimally-privileged roles — see each guide's setup steps, and [IP allowlisting](/guides/ip-allowlist) for restricting network access to Modus's fixed egress IPs. * **Single Sign-On.** Enforce your identity provider with [SSO](/guides/google-sso); MFA follows your IdP's policy. Have a security question or need our security documentation for a review? Contact us at [support@getmodus.com](mailto:support@getmodus.com).