The four Meta permissions we ask for, and the ones we refuse

When you connect a tool to your Facebook Page, you are handing it real power over an asset your business depends on. Most people click through that screen without reading it. You should read it — and any vendor worth using should be able to justify every line.

Here is ours.

What we ask for

• pages_show_list — lists the Pages you manage, so we can ask which one you want to connect. Without it we would have to make you paste a Page ID.
• pages_read_engagement — reads the Page’s Instant Forms and their questions, which is what lets us build the field map for you instead of making you type it.
• pages_manage_metadata — subscribes your Page to the lead webhook. This is the permission that makes real-time delivery possible at all; without it we would be reduced to polling.
• leads_retrieval — fetches the answers someone submitted. This is the actual product.

What we refuse

We do not request ads_management. It would let us create, edit, pause and spend against your ad account. A lead CRM has no business holding that, and if we were ever compromised it would be the most expensive thing an attacker could reach.

We do not request business_management, which would give access to your whole Business Manager — other people’s assets, other Pages, billing. We need one Page’s forms.

We do not request publish_to_groups, pages_manage_posts, or anything else that would let us post as you. INUBIZ CRM never writes to your Page.

How the tokens are held

The access token Meta issues is encrypted with AES-256-GCM before it is written to the database. It is never returned by an API, never rendered into a page, and is stripped from anything we log. Our own app secret lives only in a server-side environment variable — it is not in the JavaScript bundle, because nothing with a browser-visible prefix is ever allowed to hold a credential.

Every workspace is isolated, and each query is scoped to one workspace at a single choke point in the code rather than in every screen. That is a deliberate design choice: a mistake in a new feature fails closed instead of leaking another company’s leads.

Taking it back

You can disconnect from Settings → Integrations at any time, which unsubscribes the Page and deletes the stored token. You can also revoke access from Facebook’s own Business Integrations screen, which is the stronger move because it does not depend on us doing anything. If you signed in with Facebook and want everything erased, our data deletion page explains the route, and we honour Meta’s automated deletion callback.

The full permission list appears on the consent screen every time. Read it — for us and for everyone else.