Effective: November 10, 2026.
The optional Claude connection is available only when enabled for your account. Connecting requires normal Workflow Inspector sign-in and explicit consent. Publishing this policy does not grant access or connect an account.
This policy describes the optional Claude connection operated by Workflow Inspector, WBZKLLC, LLC. It supplements our general Privacy Policy and specifically covers the data inputs, outputs, processing, recipients, retention, and controls for every tool exposed by this connection.
In customer access mode, you may connect your signed-in Workflow Inspector account and choose the read-only permissions and eligible workspaces you want to share. Each product's existing access requirements still apply; you do not need every product to connect. In pilot mode, access is limited to the separately approved synthetic account and configured workspaces. A separate reviewer sign-in remains restricted to its isolated synthetic account and workspace, regardless of customer availability. Normal sign-in, account access, product entitlements, workspace membership, and department permissions still apply.
When you connect Workflow Inspector to Claude, Workflow Inspector receives OAuth authorization requests and authenticated tool requests from Anthropic/Claude. We process your Workflow Inspector user identifier, the connection/grant identifier, authorized OAuth scopes, the workspace identifiers you selected, and the tool name and tool arguments needed to answer the request. Tool arguments may include workspace ID, workflow ID, report ID, pagination cursor, and optional start/end timestamps. We also process ordinary security and service metadata needed to operate the endpoint, such as request time, network/IP and user-agent information, request status, and rate-limit/security signals.
We do not require you to send passwords, provider API keys, raw prompts, invoices, raw transactions, or raw customer-event payloads as tool inputs. Authentication credentials used for OAuth are handled separately from tool arguments.
| Tool | Inputs processed | Data returned to Claude |
|---|---|---|
| list_workspaces | No tool arguments; authenticated user, grant, scopes, and selected workspace IDs are used for authorization. | Authorized workspace ID, sanitized workspace name, product family, and an access notice. |
| list_onboarding_workflows | Workspace ID and optional pagination cursor. | Workspace ID; workflow IDs, sanitized titles and status; pagination cursor and access notice. |
| get_onboarding_bottlenecks | Workspace ID, workflow ID, and optional start/end timestamps. | Aggregate model/version and measurement-window metadata; event and case counts; aggregate metrics, sample sizes and descriptions; Handoff Reliability Index; coverage, aggregate source-evidence summaries, alerts, notices, and privacy statement. Individual cases, actors, owners, raw events, provider IDs, evidence references, and source secrets are omitted. |
| list_diagnostic_reports | Optional pagination cursor. | Eligible published report IDs, generated dates, revisions, pagination cursor, and access notice. |
| get_diagnostic_report | Report ID. | Report ID, revision, generated date, scoring-model version, stored health and dimension scores, structured finding counts, and explanatory notice. Raw intake, findings prose, evidence references, recommendations, and internal review notes are omitted. |
| get_ledger_status | No tool arguments; authenticated account context is used. | Whether an eligible Ledger Check account is connected; last import date/month/count; aggregate processing-job counts for the last 30 days; and explanatory notice. Invoices, raw transactions, reconciliation findings, and keys are omitted. |
| get_prompt_guard_usage | No tool arguments; authenticated account context is used. | UTC month, saved request count, allowance, remaining requests, and explanatory notice. Prompts, API/provider keys, policy secrets, and customer records are omitted. |
We use the data above only to authenticate and authorize the connection; enforce selected scopes, workspace membership, department and product-entitlement restrictions; retrieve the specific read-only Workflow Inspector information requested through Claude; return that authorized result to Claude; paginate or constrain requested results; prevent abuse and enforce rate limits; protect account and service security; diagnose reliability problems; and maintain connection, expiration, and revocation state. The tools do not buy products, change subscriptions, import records, retry jobs, issue refunds, alter policies, or delete customer records.
Authorized tool outputs are transmitted to Anthropic/Claude because that is the service you chose to connect. Once sent to Claude, Anthropic processes that information under the terms, privacy policy, product configuration, and account settings applicable to your Anthropic service. Workflow Inspector does not use this connection to sell personal information or to send tool outputs to advertising networks or data brokers.
Workflow Inspector's hosting, database, security, and infrastructure service providers may process the minimum information necessary to host the service, store authorized Workflow Inspector records, transmit requests, maintain security, and provide operational reliability, subject to their service-provider obligations. We may also disclose information when required by law or necessary to protect rights, safety, and security.
We store the connection grant, selected scopes and workspace references, and creation, expiration, and revocation state so the connection can function and be revoked. Access, refresh, and authorization-code credentials are stored as hashes; confidential OAuth client secrets, when used, are encrypted. Access tokens last at most ten minutes. An ordinary connection grant expires after thirty days and must be reauthorized to continue. A reviewer connection can expire sooner at its separate credential cutoff, which is displayed before consent. Revoking, disabling, rotating, or expiring that reviewer credential blocks its reviewer connections without revoking independent owner connections. Registered client records are configured to expire after ninety days. Expiration and revocation prevent use of credentials; they do not automatically erase database records. Revoked or expired grants cannot be used for future tool reads.
Workflow Inspector source records queried by these tools, such as workspace/workflow records, published diagnostic records, aggregate onboarding measurements, Ledger Check account/job status, and Prompt Guard usage, remain subject to the retention and deletion rules for the underlying Workflow Inspector account and product described in our general Privacy Policy and applicable agreements. Revoking Claude access does not itself delete those underlying account records.
Security and operational request metadata may be retained for security, abuse prevention, troubleshooting, audit, and legal obligations. This connection does not implement a separate automatic deletion schedule for operational request logs. Revoking or expiring a connection does not itself delete these records. We do not retain a separate copy of Claude conversation content through these MCP tools. Information already delivered to Claude is outside Workflow Inspector's ability to delete from an Anthropic conversation.
You choose whether to connect, which requested read-only scopes to approve, and which eligible workspaces to share; no workspace is selected automatically. Workspace selections apply to workspace and onboarding tools. Diagnostic reports, Ledger Check status, and Prompt Guard usage are account-level information controlled by their separate permissions. You can deny consent instead of connecting. You can revoke future access at any time from AI connection management. Removing Workflow Inspector account, workspace, department, or product access also restricts subsequent tool requests. Connection expiration also stops future access until you reconnect.
You may request access, correction, or deletion of eligible Workflow Inspector account information through Workflow Inspector support, subject to legal, security, contractual, and record-retention requirements. To delete information already present in a Claude conversation, use the controls provided by Anthropic for that conversation/account; Workflow Inspector cannot delete content from Anthropic systems.
Workspace and workflow names are user-provided data and may be returned after sanitization; avoid putting secrets or sensitive personal information in names. Limited name sanitization does not guarantee that user-entered secrets or personal information are removed. The connection excludes the source fields for raw diagnostic submissions, full report narratives, individual customer events, invoices, raw transactions, prompts, stored provider credentials, evidence references, and source secrets from its structured tool outputs. Missing measurements remain unavailable rather than being guessed.
For questions, privacy requests, access requests, deletion requests, or concerns about this connection, contact Workflow Inspector support. Workflow Inspector is operated by WBZKLLC, LLC. Our Terms of Service also apply.