Ask your IT admin to add Haechy

Why your colleague is asking

They built something that works: a tracker, a form, a calculator. Now other people need to use it. A shared Claude artifact covers part of that, but only people with Claude can save data in it. Without a place to run it, the other options are keeping it on one laptop and sharing a screen, pasting a copy into a personal account, or signing up for a hosting service nobody in IT has looked at. Haechy is a connector you can see in your assistant's admin settings and remove at any time.

On Claude Team and Enterprise, members can't add connectors themselves. Only Owners and Primary Owners can on Team, and on Enterprise also anyone with a custom role that includes Manage access to Libraries. ChatGPT Business, Enterprise and Edu and GitHub Copilot Business and Enterprise have similar switches, off by default. That is why the request reached you.

What the connector can do

When your colleague connects, Haechy's consent screen lists three abilities, in these words:

• "Create, deploy and manage your apps (including their settings, databases, backups and logs)."
• "Share apps with people you choose (add or remove people and teammates)."
• "Ask for outside connections (you approve each one yourself in Haechy)." Here "you" is the person building the app.

It acts as that one person, in the Haechy workspaces they belong to. Read-only and write tools are marked separately, so in Claude you can set individual actions to Always allow, Needs approval or Blocked for everyone using the connector. For example, you could block the action that deletes an app.

The assistant can ask for an outside connection, for instance to an accounting service, but it can't approve one. Only the workspace owner or an admin, signed in to Haechy, can. The assistant also can't take payment or change billing. Payment happens only on a page the person opens.

Anthropic's own advice for custom connectors applies, and we'd repeat it: only connect Claude to servers built and hosted by organizations you trust. Haechy is a custom connector that Anthropic hasn't verified.

Where the data lives

Each app lives in one region that your colleague picks: US (Northern Virginia), EU (Ireland), UK (London) or Australia (Sydney). The app, its database, its backups, the files it stores and the earlier versions of its code are stored in that region. Some services we use to send email, verify phone numbers and take payments process data outside your chosen region. See our sub-processors at https://haechy.com/trust/sub-processors.

Account details and app settings (email address, sign-in records, members, approvals) sit on Haechy's control plane in the US, whatever region the app is in. The servers in every region are run by a US cloud provider. The full table is at https://haechy.com/regions.

Anything a person pastes into their assistant, or asks it to read, goes to the company behind that assistant (Anthropic, for Claude) under their own account and its terms. Haechy's terms don't cover it.

Haechy is operated by DT Global Ventures Ltd, a UK company. Data-processing terms for app data are clause 7 of the terms of service (https://haechy.com/legal/terms). They cover UK GDPR, EU GDPR and Swiss law. There is no separate agreement to sign.

To leave: email privacy@haechy.com to delete the account, which we complete within 30 days. There is no one-click export yet. Before leaving, ask the assistant to read your data out of the app's database, or tell us in your request that you need a copy.

How it is secured

We describe controls, because that is what you can check.

• Private by default. A new app is open only to its owner and the people they add.
• Sign-in on every app. Haechy checks who someone is before a request reaches the app. People sign in with a one-time link sent to their email, and can add a passkey after the first sign-in. They need no Haechy account and no password.
• Ways in without sign-in, and the review before public. Apart from public mode, which the owner chooses on a paid plan, no way in lets someone who hasn't signed in reach the app's code. Scheduled jobs and the check after going live come only from Haechy's own server. File links the app creates are signed and expire after 5 minutes by default, 1 hour at most. Webhooks into private apps aren't possible. Before an app goes public, Haechy lists the pages and endpoints anyone could open without signing in (and says so if it can't list them all), plus the outside services it is approved to call, and it goes public only after the owner or an admin confirms in the console. Claude can't confirm it.
• Outside services closed until approved. An app has no route to the internet of its own. It can reach a service only if the owner or a workspace admin has approved that host for that app. Everything else is refused and logged. Each app has a Connections page in the Haechy console that lists every outside service it can reach, why it was asked for, who asked (Claude, the check after a change, or the owner), who approved it and when, and the recent attempts that were blocked. The owner or an admin can approve, deny or switch off a service from there.
• Apps kept apart. Each app runs in its own sandboxed container with its own private network and its own database login.
• Backups. Nightly, and a restore takes a safety copy first. The Free plan keeps 7 days and paid plans 30, plus weekly copies for 90 days. Backups cover the app's database, not stored files.
• A check on every deploy. On every plan it looks for keys or passwords written into code, uploaded .env files, packages with known vulnerabilities or flagged as malicious (from the lockfile, checked against the OSV database), and risky code such as request input run as code, a shell command, SQL or a template, secrets returned in a response, TLS checks turned off, open CORS, debug mode and unprotected admin or debug routes. It also lists the outside services the code calls. Keys and .env files always stop a deploy. So do a malicious package, a critical vulnerability in a package the app runs with, input passed straight to code, a shell, SQL or a template, and a route that returns every secret, unless the workspace owner or an admin allows that exact finding; Claude can't. Everything else is a warning. It checks known vulnerabilities and named patterns, doesn't find every bug, and does not replace a careful look at what the app does.
• Encryption. App settings, including keys, are encrypted. Databases and backups are encrypted in storage.

Starter apps are normal apps: same sign-in, same approvals, same region. See the starter apps.

Be aware of the limits too. Our staff can technically reach customer data on our servers. We fix what vulnerability reports find, but we make no claim that Haechy can't be breached. An approved outside service can receive anything the app holds. Haechy doesn't catch logic mistakes in an app, such as one person seeing another's records. We provide the service as it is and as available, with no uptime guarantee.

Report a concern to security@haechy.com. Details: https://haechy.com/security.

How this sign-in compares with Cloudflare Access, Tailscale or an auth service: https://haechy.com/guides/give-colleagues-access-without-accounts.

What it costs

The Free plan is $0 with no card: 2 apps and 5 people. Paid plans are priced per workspace, paid by bank Direct Debit, and the price and renewal terms are shown before anyone pays. Your colleagues who open the app don't need an assistant seat or a Haechy account, so adding them costs nothing extra within the plan's people limit. If an app reaches a limit, the next new thing (a new app, invite or outside connection) is refused and the assistant says which limit it was. Apps that are already running keep running.

Current plans and limits: https://haechy.com/pricing.

How to add it

Claude Team and Enterprise. An Owner (or, on Enterprise, a role with Manage access to Libraries) does this once:

1. Go to Organization settings > Connectors.
2. Click Add, hover over Custom, and select Web.
3. Name it Haechy and enter https://mcp.haechy.com/mcp.
4. Leave the sign-in choice on Claude's published identity. Haechy accepts it, so there is no client ID or secret to enter.
5. Click Add.

Each person then opens Customize > Connectors, finds Haechy (usually labeled Custom), clicks Connect and signs in with their own Haechy account. Claude connects to Haechy from Anthropic's cloud, so nothing changes on your company network.

ChatGPT Business, Enterprise and Edu. Members can add a custom MCP server only with the Create plugins with MCPs permission, which is off by default. In the workspace's permissions and roles settings, grant it to the people who need it, or add Haechy yourself (address above) and publish it to the workspace. Admins also choose per plugin whether write actions are allowed. Haechy needs them, because deploying an app is a write. Each person signs in with their own Haechy account.

GitHub Copilot Business and Enterprise. An organization or enterprise owner turns on the MCP servers in Copilot policy, which is off by default. If MCP access is restricted to Registry only, Haechy also has to be allowed in that registry. People then add Haechy in their editor (in VS Code, the command MCP: Add Server) and sign in with their own Haechy account. The Copilot cloud agent on GitHub.com can't use Haechy, because it doesn't support remote servers that sign in with OAuth.

Setup steps for each assistant, including Codex and Cursor, are in https://haechy.com/docs.

To remove it. An admin can remove the connector from the same settings, and members lose the Haechy tools. Apps already online keep running, because Haechy hosts them apart from any chat. To shut the apps down, ask the owner to delete them before you remove the connector, or have the workspace owner email privacy@haechy.com.

Questions

Security questions: security@haechy.com. Anything else: support@haechy.com.