# Security and consent

OAuth, access keys, data handled, and firm practices for the Fonciq AI connector.

## OAuth consent

When connecting ChatGPT, Claude, or another client, **fonciq.ca** shows the client name, **wallet**, and **Registre accounts** involved.

**OAuth** is a secure sign-in: you authenticate at fonciq.ca and explicitly authorize the assistant to use those resources.

To **revoke** a connection: **Studio → Développeurs → Applications connectées (OAuth)**, select the connection (ChatGPT, Claude, etc.), then **Révoquer**. Active tokens stop working immediately.

## API keys

Create keys in the [developer dashboard](https://fonciq.ca/studio/developpeurs). Use **test** keys in shared threads and screenshots. Revoke any exposed key (**Studio → Développeurs → Clés API → Révoquer**).

Never publish a key in a public prompt.

## Privacy and Law 25

Registry consultations run on **your** organization’s Registre account. Fonciq retains logs needed for billing, support, and security for the period described at [fonciq.ca/confidentialite](https://fonciq.ca/confidentialite) (Québec Law 25).

Your **prompts and answers** also pass through the AI provider you use (OpenAI, Anthropic, etc.). Review retention, training, and confidentiality settings your **firm** applies to those tools — Fonciq does not control third-party AI processing.

## Firm practices

- Train users on the **daily cap** and **Test mode** before switching to the real wallet.
- Confirm the linked Registre account matches the matter you are handling.
- Do not treat assistant text as an official attestation — the **registry PDF** governs.
- Limit who can create OAuth connections and **real-wallet** API keys in Studio.

## Support

Questions about the connector or billing: [support@fonciq.ca](mailto:support@fonciq.ca).

Français : [Sécurité](/securite).