# Security Settings Guide The honest version. Read it once, set your rules, get on with it. --- ## 1 · The data retention checkbox At signup there's a checkbox asking to **retain your private data for logs and improvement**. **You can decline it, and the service works exactly the same.** Read it, decide, don't rush past it. If you handle client data of any kind, declining is the obvious call — and it costs you nothing. --- ## 2 · The one-perimeter model All your bots share **one persistent cloud computer**. That's a single security perimeter. **The upside:** adding your tenth bot adds no new risk. It's the same machine, the same basket. You're not widening your exposure every time you create a teammate. **The downside:** it *is* one basket. Every login you hand it lives there. If that one account is compromised, everything you connected is in scope at once. **What follows from that:** - Put a strong, unique password and 2FA on the Grok Bot account itself. It's now the most privileged account you own. - Treat "which bot has access" as a fiction for security purposes — access is shared across the machine. Decide at the level of *"do I want this system to hold this login at all?"* - Don't connect an account you couldn't stand to have compromised. --- ## 3 · Device verification alerts When a bot logs into a website as you, that site sees a **new device signing in — a Linux machine in a data centre**. Expect verification emails. Two rules: 1. **Don't train yourself to click through them.** The whole point of those alerts is that they catch the login you *didn't* expect. If you auto-approve everything, you've disabled your own alarm. 2. **Approve only when you know which bot triggered it.** If an alert arrives and no bot should have been logging in, treat it as a real alert. --- ## 4 · Platforms with strict automation terms Some services — LinkedIn is the usual example — have terms that aren't friendly to automated access at all. **If a platform decides it doesn't like a robot in your account, the account at risk is yours.** Not xAI's. Yours, with your history and your network in it. There's no clever workaround here. It's a judgement call about how much that account is worth to you. --- ## 5 · A simple rule set Copy this, adjust it, and stick to it. ### ✅ The bots may log into - My email and calendar - My project board and notes tools - Analytics and reporting dashboards (read-only in practice) - Documentation and public research sites - Internal tools I own outright ### ⛔ The bots may never log into - Anything that moves money — banks, payment processors, brokerages, crypto - My password manager - Platforms with strict automation terms, where my account is the thing at risk - Shared team accounts I don't personally own - Anything belonging to a client rather than to me, without their written OK ### 🖐 The bots may never do without my click - Send an email, a DM or a message to anyone outside my company - Publish or post anything publicly - Accept terms, agreements or consent banners - Complete a purchase - Delete anything Build the last list into the bot prompts themselves — *"never send anything, leave every reply as a draft"* — so the guardrail lives in the role, not just in your head. --- ## 6 · A note on captchas If a bot hits a captcha it will hand you its computer and ask you to click it. That's the take-over button working as intended. Worth knowing: solving captchas *for* an automated session is exactly the thing a captcha exists to prevent. If a site is throwing them at your bot repeatedly, that's the site telling you it doesn't want automated access. Take the hint rather than fighting it. --- ## 7 · The monthly five-minute audit - [ ] List every connection currently authorized — remove anything you tried once and never used - [ ] Check no routine can send, post or pay without your click - [ ] Skim the run history on your active routines for anything you didn't expect - [ ] Confirm the retention checkbox is still set the way you chose - [ ] Delete bots you stopped using (they still hold context and still cost you usage) --- *Part of the Grok Bot AI Full Course — *