Authorized, not scraped
Every connection is an official API authorization — OAuth where the platform offers it, a scoped system token where that is the sanctioned path. No passwords are stored, and access is revocable from the platform's own settings.