Your bank, email and CRM stay between you and your agent

Why doesn't Economico ask for my bank or inbox?

Finance tools usually start by asking for standing access: a bank feed, your inbox, a CRM sync, a shared drive. Every one of those is a key to a private system, held by one more company. Economico has none of those integrations, so it has nothing to ask for.

You already decided which agent you trust, and which of your systems it can reach. Economico does not second-guess that choice or add to it.

Your agent connects your systems

When your agent reads an invoice in your inbox or a payment in your bank, it records that fact in Economico: the customer, the amount, the date, and the source document if you want it kept. Economico receives the fact and the document your agent submits. It never gets access to the inbox or the account the fact came from.

The permissions on your bank, email and CRM stay where you set them, with the agent and the providers you chose. Change them there and nothing at Economico needs changing. Economico's permissions cover only your books.

Your agent's provider handles the data your agent reads, and Economico does not control that. Check the provider's data policy before you point it at company finances. If it does not meet your policy, you can still review your books in the read-only browser workspace without connecting that agent.

The one connection you approve

Your agent connects to Economico through a standard OAuth 2.1 sign-in. You see which application is asking and pick the businesses it may reach. The connection gets full access to them, up to your own permissions; it can never change members or transfer ownership. Every request names its business and is checked against both your current membership and what you approved. Joining another business later does not give an existing connection access to it.

Revoking it is yours. Sign in and open Connections. It lists every application you have authorized and every headless agent you have registered, with what each may do in each business. Remove one business, or revoke the whole connection. The change applies on the next request, and your connection security history records it.

The sign-in uses PKCE (S256 only). Access tokens expire after an hour. Refresh tokens rotate on every use and expire after seven days. One limit we want you to know about: rotating a refresh token does not revoke the tokens issued before it, so a stolen refresh token is not detected; it simply expires. That is a limit of the authorization-server library we run, and it is why the refresh window is seven days rather than the library's default thirty.

Agents retry. A repeated request never posts the same entry twice, so a flaky network or an agent's retry does not double your books.

Your books are private

Nothing about your business is visible outside it until you choose. No one sees your books unless you make them a member, approve their agent, or share with them.

Going public is a separate, deliberate step. The Public access page can list the business in the directory, showing only its public name, slug and a minimal identity document, or publish reports you have reviewed. Commands, members and permission history cannot be published, and every change is recorded with who made it and the policy before and after.

Share your numbers with investors, on your terms

When an investor, advisor or accountant needs to see the numbers, create a share link for exactly the reports, invoices and contracts they need. They open it without an account and see only what you chose: not the rest of the books, and no way to change anything. Set it to expire, or revoke it and it stops working immediately.

Share links are part of the Startup plan, $29 a month per company. What someone sees through a link is your recorded books, not an audit or an accountant's sign-off.

How do I stay in control?

Use the agent you already trust, and approve only the application you recognize, and connect it only to the businesses it works on. For an automated or headless agent, register a dedicated client and signing key for that job, with exactly the permissions it needs, and revoke it on the Connections page when the work ends. Rehearse a new workflow in a disposable business before you run it on your real books.