# Third party data access

One setting per project decides how much of your audience data anything outside the dashboard actually receives — your own integrations, a connected assistant, or a third-party app. This page is where that setting is explained.

**Language:** en
**Audience:** platform
**TLDR:** Each project has an access type — Full access, Anonymized or Blocked — that decides how much of its data leaves it through the Product API, MCP connections included. Anonymized keeps counting, segmenting and measuring working while hiding who anyone is; Blocked serves nothing at all and rejects both reads and writes, without disconnecting anything. It does not affect the Ingest API, the A2P Messaging API, outbound webhooks, or exports and reports. It applies on top of the permissions each connection was granted, and the same setting governs your own integrations, connected assistants and third-party apps.
**Translation key:** platform.developers-and-apps.third-party-data-access
**Search keywords:** third party data access, data access, access type, data policy, anonymized, anonymised, blocked, full access, personal data, pii, privacy, what an app can see, permissions, scopes, verified app, security
**Related pages:** /platform/es/developers-and-apps/third-party-data-access, /platform/en/developers-and-apps, /platform/en/developers-and-apps/managing-connected-apps, /platform/en/consent
**Docs index (every page):** https://docs.instasent.com/llms.txt
**This zone's index:** https://docs.instasent.com/platform/en/llms.txt
**This page:** https://docs.instasent.com/platform/en/developers-and-apps/third-party-data-access/ (HTML) · https://docs.instasent.com/platform/en/developers-and-apps/third-party-data-access.md (Markdown)
**Other language (es):** https://docs.instasent.com/platform/es/developers-and-apps/third-party-data-access.md

Everything that reaches your project from outside — your own integration with an
API token, an assistant you connected, a third-party app — is limited twice. The
first limit is what you approved when the connection was created. The second is
this page: a setting **per project** that decides how much of that project's
data actually leaves it, whatever anyone was granted.

You'll find it in **Settings → Project → Third party data access**, and it is
called the **access type**.

## The three access types

- `Full access` — `default`
  Contact data is read the same way you see it in the dashboard: emails, phone
  numbers, names, your custom attributes and the contents of events. The right
  choice for your own tools, and for providers you trust like your own team.
- `Anonymized`
  It can still work with your audience, but it cannot tell who anyone is.
  Counting, segmenting, measuring and sending keep working; emails, phone
  numbers, names, your custom attributes and event contents are hidden, and it
  cannot look someone up by email or phone. In short: it keeps working with
  groups, and stops being able to identify people.
- `Blocked`
  No data from this project is served at all, and requests made for it are
  rejected — reads and writes alike. It **does not disconnect anything**: an
  app that is already connected simply stops receiving data from here, and
  starts receiving it again if you change the setting back.

> **Tip**: **Anonymized is the interesting one**, and the reason it exists: a connection
> can end up perfectly able to tell you that 4,300 customers bought last month
> and haven't come back — without ever being able to tell you *who they are*.
> Most of the work people want from an assistant survives it.

## What it governs, and what it doesn't

This setting governs what is read **through the Product API, MCP connections
included**. It does not affect the Ingest API, the A2P Messaging API, outbound
webhooks, or exports and reports, which follow their own permissions.

Two things are never anonymized, because hiding them would break the work
without protecting anybody: the **filters** of your campaigns and segments, and
your **company configuration**.

## The permissions underneath

Before the access type applies, a connection only ever holds the permissions it
was granted, over the projects it was granted them on. Those permissions cover
your **audience** (contacts, attributes, events and segments), your **campaigns
and automations** and how they performed, your **data sources**, and your
**messages** — each one readable, and some of them writable, depending on what
was approved.

> **Note**: Granting access to a project always includes that project's **overview and
> analytics** — the baseline needed to make sense of anything else — and that
> part can't be removed from a grant.

How the permissions are approved differs by what is connecting: an assistant
connected over MCP takes them **as a package**, while a third-party app shows
them as a list you can trim before approving. Both are covered where they
belong — [Connect your AI](/platform/en/developers-and-apps/connect-your-ai) and
[Third-party apps](/platform/en/developers-and-apps/third-party-apps).

## Verified apps

Instasent reviews and verifies applications, and every connection shows whether
its app is verified. When you authorize one that isn't, you are warned and asked
to confirm explicitly before continuing.

A project can also be set to **only allow verified apps**, and this is worth
reading carefully:

> **Warning**: **Turning it on stops new connections; it does not remove the ones you already
> have.** An unverified app can no longer be authorized on that project from
> then on — but an unverified app that was already connected keeps working until
> an administrator disconnects it, in
> [Connected apps](/platform/en/developers-and-apps/managing-connected-apps).
> If your reason for turning it on is a connection you already regret, revoke
> that connection too.

## Where this sits in the bigger picture

The access type is about **what leaves your project**. What a contact has agreed
to receive is a different question, answered by your subscription and consent
model — see [Consent](/platform/en/consent). And the record of which
connections exist at all, with what permissions, is
[Connected apps](/platform/en/developers-and-apps/managing-connected-apps).

Building your own app on Instasent? The technical contract for OAuth, tokens and
scopes is in
[Connected apps (OAuth)](/developers/product-api/connected-apps-and-oauth).

---

This is one page of the Instasent documentation. For the complete machine-readable index of every guide and API reference, fetch https://docs.instasent.com/llms.txt — start there for full context.