Your LinkedIn account is not an experiment.
Here’s how Secret AI Agent protects your account and your data. And where data is processed by service providers, including outside the EU.
Works like a human, not a script.
Doing too much too fast on LinkedIn gets noticed. That’s why the agent’s pace is capped by the system, not just a setting you might forget.
Fixed time windows on your business days
The agent only works in the time windows you set for your account. The default is Monday to Friday, 9–12 and 2–4 pm (Europe/Berlin time zone).
Up to two windows of 1 to 3 hours each per day, no more than 5 hours in total. A single long block looks the least human to LinkedIn.
Daily limits with hard caps
Every account has daily limits for connection requests, messages, InMails and profile visits. You can adjust them, but not beyond the maximums.
| Per account per day | Default | Maximum |
|---|---|---|
| Connection requests | 20 | 100 |
| Messages | 50 | 200 |
| InMails | 20 | 25 |
| Profile visits | 250 | 500 |
Current platform values. They may change if LinkedIn changes its rules.
Automatic account protection on warning signs
If LinkedIn sends a warning sign, for example by limiting profile lookups, Secret AI Agent halves all daily limits for that account for 14 days. If another signal comes in during that time, the phase is extended.
After that, the account returns to normal limits on its own. You don’t have to do anything.
Throttling kicks in on a real signal. There’s no blanket warm-up phase for every new account.
One fixed IP address per account
Each LinkedIn account connects through its own fixed IP address (proxy infrastructure from IPRoyal, located in the EU per our data processing agreement). This avoids changing addresses that LinkedIn may flag.
Some risk remains
Pace, time windows and limits reduce the risk but don’t eliminate it. Automated use of LinkedIn may conflict with LinkedIn’s terms of service, and LinkedIn alone decides on any action it takes. The rules are set out in § 7 of our Terms.
Your login stays under lock and key.
To stay signed in on your behalf, the agent needs login credentials and session data. That’s the most sensitive part, so we handle it with extra care.
Entered via a separate form
When connecting your LinkedIn account, you enter your credentials in a separate form, not in the chat. The form sends them straight to the login service.
Stored encrypted
So the session can be renewed, Secret AI Agent stores your LinkedIn password and session data (cookies) encrypted with AES-256. They are never stored in plain text in the database.
Your password for Secret AI Agent itself is stored only as a hash (bcrypt): not in plain text and not reversible.
Not readable, not logged
Encrypted fields are excluded from database queries by default and never delivered to the interface via the API. Passwords, tokens and cookies are redacted in technical logs.
You stay in control.
The agent works on its own, but within the limits you set.
Approval before sending
Per campaign, you can require that no message goes out without your okay. Each message then waits in your tasks for approval or rejection, and is only sent after that.
Approval is off by default. Turn it on per campaign if you want to see every message yourself.
Blacklist for companies and people
Exclude anyone you never want to contact once, and the block applies across the whole workspace, so for your entire team. For companies, Secret AI Agent also catches slightly different spellings, such as with and without “GmbH”.
Team roles
The workspace has the roles Owner, Admin and Member. Only owners and admins can invite users and change roles. Data from different customers is kept separate; each workspace sees only its own.
The platform runs in Germany.
Servers, database and file storage are hosted by a German provider. What happens beyond that with service providers is described below.
Data centers in Falkenstein and Nuremberg
The platform is operated by Hetzner Online GmbH (Gunzenhausen), in data centers in Falkenstein and Nuremberg. File storage for raw data is also at Hetzner in Falkenstein.
Export and deletion
If you remove a user or your workspace, the related data is deleted. After your contract ends, you can export your data for 30 days using the software’s features; after that it is permanently deleted. Backups follow the regular backup cycles.
Details are in § 9 of the data processing agreement.
Where AI is involved, we tell you.
The platform is hosted in Germany. AI processing, however, runs at OpenAI, and not exclusively in the EU.
What AI is used for
- Rating and classifying profiles
- Writing messages and follow-ups
- Classifying replies, for example as positive, neutral or negative
- Reading job ads and preparing campaigns
- Running the in-product assistant
Provider and data flow
For this we use the OpenAI API (OpenAI Ireland Ltd. or OpenAI, L.L.C.). According to our data processing agreement, processing takes place in the EU or the US. So we can’t say this data never leaves the EU.
We transmit what each task requires: details from contacts’ LinkedIn profiles, your job ad and guidelines, and reply texts. If a LinkedIn sign-in gets stuck, a screenshot of the LinkedIn login screen may be sent to the AI model so it can suggest the next step.
Safeguards for transfers to the US
Where data is processed in the US, this is based on an adequacy decision (EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses, supplemented by additional safeguards (DPA, § 7).
The in-product assistant calls the model in a way that requests are not stored at OpenAI for later retrieval.
Who processes data on our behalf.
These sub-processors are listed in our data processing agreement. We notify you of changes in writing four weeks in advance.
| Company | Service | Place of processing |
|---|---|---|
| Hetzner Online GmbH | Hosting, server and database infrastructure | Germany |
| Google Ireland Ltd. / Google Cloud | Content Delivery Network | EU (possibly US) |
| Stripe Payments Europe, Ltd. | Payment processing, billing data | Ireland (possibly US) |
| OpenAI Ireland Ltd. / OpenAI, L.L.C. | AI-assisted creation and classification of message texts | EU / US |
| Resend, Inc. | Sending transactional e-mails to users | US |
| IPRoyal | Network/proxy infrastructure for accessing professional networks | EU |
LinkedIn is not our sub-processor but an independent controller. Your relationship with LinkedIn is governed by LinkedIn’s terms.
Data processing agreement included.
As a business, you need a contract under Art. 28 GDPR for the data processing we do. You get it automatically.
Data processing agreement (DPA)
The DPA is Annex 1 to our Terms. It becomes part of the contract when you accept the Terms and needs no separate signature. It also contains the technical and organizational measures (§ 6).
Privacy policy
How we handle data when you visit this website is described in our privacy policy.
Terms and conditions
The Terms govern the use of Secret AI Agent, including how LinkedIn is handled as a third-party platform.
Still have a question about privacy or security?
Write to us, even if your IT team or data protection officer wants more detail.
14-day free trial · Servers in Germany