How it works and security

You don't need to read this page to use the connector. But if you want to understand, or need to explain to someone, why it can be trusted, here's how it works, first in plain language and then with technical detail.

The three pieces

When you ask "why was invoice 2026/0142 rejected?", three pieces are involved:

1. Your AI assistant (Claude, or whatever you use): understands the question and decides what information it needs.
2. The B2Brouter connector: a set of query functions the assistant can invoke, "list invoices with errors", "give me the detail of this tax report", "search for this company in the directory".
3. Your B2Brouter account: where the data comes from, with the same permissions you have in the panel.

The assistant translates your question into one or more queries to the connector, receives the data and composes the answer. You don't see this mechanics, only the conversation, but it's all logged (see Audit, below).

For technical profiles.

The connector is a remote MCP server at https://app.b2brouter.net/mcp. It exposes typed query tools that the MCP client discovers on connecting; all of them are read-only. Listing tools carry pagination and filters; detail tools return bodies equivalent to the REST API's. The full list is in the Tools reference.

Identity: the assistant acts on your behalf

There's no "robot user" or special key for the AI. When you connect the assistant, you authorize it to act as your user, and B2Brouter applies to every query exactly the same rules as when you browse the panel:

• Member: only the accounts where you're a member.
• Section: within each account, only the sections you have permission for (issued, received, tax reports...).
• Plan: invoice, report and finance features require the account to have the Professional plan or higher; all of them require you to be on some paid account.

The practical consequence: the connector doesn't open any new doors. Everything the assistant can see, you could already see. And if tomorrow you're removed from an account or a section is restricted, the assistant loses it at the same instant. Each person in the company connects with their own user: access and permissions are never shared.

For technical profiles.

Authorization is OAuth 2.1 (Authorization Code + PKCE) with dynamic client registration; the token represents the user, not the application. Permissions are evaluated on every call with the same engine as the web (member + capability + section + product), including the nuances: a member restricted to "received invoices" doesn't see issued ones via the connector either, and the paid subscription gate is re-checked on every request, so an expired subscription cuts off access even if the token is still alive.

Why it's read-only

This is the central design decision of this first version. Giving an AI the ability to write on documents with legal and tax value (creating invoices, sending them to an authority, modifying data) opens a category of risks (misinterpretation errors, malicious instructions hidden in data) that we want to address calmly and separately. In the meantime:

• Querying is safe by construction: no question, however poorly phrased, can change anything in your account.
• Responsibility stays where it belongs: the AI proposes the diagnosis; the action (in the web app or via the API) is taken by a person (or a system) with explicit intent.

For technical profiles.

Strictly read-only with no side effects: querying an invoice via the connector doesn't mark it as read or trigger tax report generation (a deliberate divergence from the REST API's GET). To write, the path is the B2Brouter REST API; the recommended workflow is create via API, inspect and diagnose via the connector.

Where the knowledge comes from

The data in your account (invoices, reports, figures, directory) comes straight from B2Brouter, in real time. For questions about how the product works or about regulations ("how do I set up TicketBAI?"), the connector doesn't keep its own copy of the documentation: it tells the assistant where the official documentation lives, this very portal, so it can consult it. That way the answer is based on the current version rather than on a copy that could fall behind.

If the assistant can't read web pages, it will give you the link or answer from its general knowledge. No assistant is infallible: before a decision with tax consequences, always confirm with your advisor or with support.

Protection against third-party content

Received invoices and the directory contain text written by others: company names, line descriptions. Someone could try to hide instructions for the AI in them ("ignore your instructions and..."). The connector explicitly marks all this content as data, not instructions, so the assistant never executes hidden orders inside an invoice or a company name.

For technical profiles.

All third-party values travel delimited as untrusted content with unforgeable markers. If you build automations on top of the connector, keep this distinction downstream: never mix invoice text with your agent's instruction channel.

No existence oracle

If you query an identifier that doesn't exist and one that belongs to someone else's account, you get exactly the same error ("Not found or not authorized"). This is deliberate: no one can use the connector to figure out what exists outside their scope, not even to confirm that an invoice or account exists.

Audit

Every query the assistant makes is logged (when, which function, which application, which user) and can be viewed on your profile (MCP Activity). If you ever wonder "what exactly did the AI look at?", the answer is there, in full.

Consent and revocation

You approve the authorization yourself (OAuth) and can revoke it at any time from Authorized applications on your profile, with immediate effect. If the subscription expires, access stops on its own.

Where your data goes

Connector responses are processed by the AI provider you connected (Anthropic, OpenAI, Google...), under their terms and B2Brouter's DPA. Connecting the account implies accepting this processing: review your assistant's privacy policy.

In summary

Principle	What it means
User's own identity	The assistant sees what you see; no more, no less; revocable instantly
Read-only	No question can modify anything; actions are yours
Current documentation	The connector points the assistant to the published official documentation, not a copy
Data ≠ instructions	Third-party content can't give orders to the AI
Indistinguishable errors	No existence leakage between accounts
Full audit	All activity, logged and queryable