< and [Organizations](/en/guide/organizations.md).
- Each [organization](/en/guide/organizations.md) has its own set of credentials, kept separate from the others.
## How the AI and gems use them
**Neither of them ever sees the secret itself.** When the AI or a gem wants to call an external service, all it receives is permission to "make a request through this connection". Notochord sends the request, and adds the secret only at the moment it goes out. As a result:
- Secrets never appear in the AI's conversation or in tool-call records.
- Even if a gem's code is faulty, it cannot get the secret; it can only make requests through connections that were granted to it.
- A connection can only reach the sites it was registered for, so the secret cannot be carried elsewhere.
## Who gets access
By default, nobody. A gem can use an account only after you select it on the gem's page; gems working in a project can use an account only if you tick it in the project's settings. Requests through an account that has not been granted are refused. See [Gems: installing and using them](/en/guide/gems.md) and [Organizing work with projects](/en/guide/projects.md).
## Deleting
Delete an account under "Settings › Accounts" and the stored secret is deleted with it. Gems that relied on it stop working until you give them another account.
]]>