Leo for IT teams

Somebody in your organisation wants to use Leo, and Microsoft or Google has told them to ask you. This page is everything you need to decide. If it leaves a question open, write to michael@smartleo.ai and a person answers.

What Leo is

Leo is an AI that a business teaches how its work runs. People describe their work to it, attach documents, and connect the tools the business runs on. Leo keeps a written record of how the business works, answers questions from it, and points out where time and money are being lost.

Each business has a private Leo of its own: its own address, its own database and its own record. Nothing is shared between businesses.

What Leo asks for

Connecting a tool is optional and done by a person, for themselves, by signing in with their own account. Leo then acts as that person and can see only what that person can already see. It never asks for an administrator's rights, an application permission, or access to the whole tenant.

Microsoft 365

Permission	Kind	What Leo does with it
Mail.Read	Delegated, read only	Reads the signed in person's mail to answer their questions about customers, suppliers and what was agreed
Calendars.Read	Delegated, read only	Reads their calendar to see where the working week goes
Files.Read.All	Delegated, read only	Reads the files they can open in OneDrive and SharePoint, when they ask about one
User.Read, offline_access	Delegated	Knows which account signed in, and stays signed in without asking again each hour

Microsoft does not require an administrator for any of these. Whether your people may approve an app themselves is your tenant's setting.

Google Workspace

Permission	Kind	What Leo does with it
gmail.readonly, calendar.readonly, drive.readonly	Read only	The same three things as above, for a business on Google
analytics.readonly, webmasters.readonly	Read only	Reads website traffic and search performance
adwords, content	Google offers no read only version	Reads Google Ads campaigns and the Merchant Center product feed. Leo makes no change in either, with one exception: the single registration Google requires before any app may read a Merchant Center account

The two Google sign ins are separate. Somebody can connect the marketing tools and not their mailbox, or the other way round.

What Leo cannot do

• Send, delete, move or change mail, events or files. It holds no permission that allows it.
• Read anything the signed in person cannot read themselves.
• Read another person's mailbox, or act when nobody has signed in.
• Use your organisation's data to train AI models. It does not, and neither does the model provider under its commercial terms.

Where the data sits

What	Where
The sign in tokens Microsoft and Google issue	Encrypted, in that business's own database. Deleted the moment the person disconnects
Conversations with Leo, and what it read to answer	That business's own database, with Neon, in Sydney, or in the US or the UK for a business that needs it
The written record of how the business runs	A private repository for that business, on GitHub, encrypted page by page with AES-SIV and a key held only by that business's Leo. Commit messages are encrypted too; dates and file names are not. Email addresses and phone numbers are kept out of it
The application	Fly.io, in the same region as that business's database
The AI model	Anthropic. What Leo has read is sent to it to write an answer and is not used for training
Email Leo sends, such as sign in links	Resend

People sign in to Leo with a link sent to their email address, which works once. Leo stores no passwords. The privacy page has the rest, including Google's Limited Use commitment.

How to approve it

Microsoft 365

If your tenant does not let people approve apps themselves, they see Need admin approval. To approve Leo for the organisation:

1. In the Microsoft Entra admin centre, open Enterprise applications. Leo appears there once somebody has tried to sign in. Its application (client) ID is 4fa6afc4-a053-4a33-894a-d10e5c69bd39 and its publisher domain is smartleo.ai. If your tenant has the admin consent workflow switched on, their request is waiting under Admin consent requests.
2. Open Leo, then Permissions, and review the four permissions listed above.
3. Press Grant admin consent.

To allow only some people: on the same application, open Properties, set Assignment required to Yes, then add those people under Users and groups.

Google Workspace

1. In the Google Admin console, open Security, Access and data control, API controls, then Manage app access.
2. Add an app by its OAuth client ID: 1091145861349-kpu935npdoq2hvoocphiqlomgjsa74f4.apps.googleusercontent.com
3. Choose who it applies to, and set it to Trusted or to the specific Google data you allow.

How to remove it

• One person: they press Disconnect on the Connections page in Leo, and the token is deleted at once.
• Microsoft 365, everybody: delete Leo under Enterprise applications, or remove its permissions there. Every token stops working.
• Google Workspace, everybody: set the app to Blocked under API controls.
• Everything Leo holds for the business: write to the address above. The database, files and record are deleted within 30 days.

What is not in place yet

Leo is in beta, and you should weigh that.

• Google has not yet verified Leo, so Google shows people a warning before its consent screen. The submission is being prepared.
• Microsoft has not yet verified Leo as a publisher, so its consent screen shows Leo as unverified, and in most organisations only an administrator can approve it.
• Leo has no SOC 2 or ISO 27001 report.
• Sign in to Leo is by emailed link. Single sign on through your identity provider is not built.