Trust

Security at B77.

Installing an app in your assistant is like installing an app on your phone: you decide what it can reach, you can see what it does, and you can remove it whenever you like. B77 is the App Store for your AI assistant — Claude, ChatGPT and Cursor ship with built-in abilities, and B77 apps extend them with your tools and data. This page explains the mechanisms that keep that access safe.

OAuth 2.1, not API keys

Every connection between your assistant and a B77 app is authorized with OAuth. The app publishes RFC 9728 protected-resource metadata, the client uses PKCE, and the token it receives is yours alone — scoped to your account, never shared between users.

You never paste a long-lived key into a chat window. Tokens are revocable from your B77 account at any time, and revoking one cuts that assistant off without touching your other connections.

Per-user credential vault

Some apps need a credential of yours to do their job — a Nightscout token, Google Ads access. Those are encrypted per user with a data-encryption key held in the platform’s secret store. Nobody else on B77 can see them, and they are never returned to the assistant.

The app uses your credentials server-side, on your behalf, only for the calls you make. Delete the connection and the stored credential goes with it.

Usage audit

Every authenticated tool call is logged: who made it, when, which tool, and from which client. App owners can read a 30-day usage view for the apps they operate.

When a connection is shared, each call is logged with both identities — the person who made the call and the person whose access it ran under. Nothing runs unattributed.

EU hosting

The platform and the apps it operates run in EU data centres — the Frankfurt and Helsinki regions named on each app page. Data handling is GDPR-aligned, and there is no silent retention: what an app stores, and for how long, is stated on its page.

What an app can see

Each app page carries a "What this app can see" block: what it reads, what it writes, what it never sees, and what it stores. Read it before you install, the way you would read an app’s permissions on a phone. Browse the catalog at /apps.

Browse apps

Sharing without sharing secrets

Connection sharing lets you give a teammate the same access you have — the app runs with your credentials for them, but they never see those credentials, cannot change them, and cannot pass the access on. You can withdraw the share at any time; their calls stay in your audit log.

FAQ

Security questions, answered.

Does B77 see my passwords?

No. You sign in to apps through OAuth, so the app never receives your password, and neither does B77. Credentials that some apps need (tokens, service keys) are encrypted per user and used server-side only.

Can an app read everything in my account?

Only the scope shown on its page. The "What this app can see" block lists reads, writes, what it never sees and what it stores — that is the whole surface the app has.

How do I revoke access?

Open the app’s Manage page in your B77 account and disconnect. You can also remove the connector from your assistant’s own connector settings; either action ends access.

Where is my data stored?

In EU data centres (Frankfurt and Helsinki regions, as stated on each app page). Each app page also says what it stores and for how long.

Is MCP secure?

MCP is a transport — it carries tool calls between your assistant and an app. Security comes from what sits around it: OAuth authorization, per-user scoping and credentials, and a full usage audit. That is what B77 adds on top of the protocol.