INTEGRATIONS — READ-ONLY BY DEFAULT
42 CONNECTORS
READ-ONLY
OAUTH 2.0 + SCIM
01 — CONNECTORS
Each connector declares what it reads, how often, and what it will never touch.
Model registries
MLflow, SageMaker, Vertex AI and Azure ML. Inventories, versions and approval states.
MODELS · VERSIONS
Cloud accounts
AWS, Azure and GCP. Encryption posture, logging configuration and network boundaries.
CONFIG · POSTURE
Repositories
GitHub, GitLab and Bitbucket. Review approvals, test results and deployment records.
PRS · PIPELINES
Ticketing
Jira, Linear and ServiceNow. Control tests, exceptions and their remediation history.
ISSUES · EXCEPTIONS
Identity
Okta, Entra ID and Google Workspace. Joiner, mover, leaver evidence for access reviews.
SSO · SCIM
Documents
Notion, Confluence and Drive. Policy versions, approvals and the dates they took effect.
POLICIES · VERSIONS
Monitoring
Datadog, Grafana and CloudWatch. Uptime, alert routing and incident timelines.
UPTIME · INCIDENTS
HRIS
Workday, Personio and HiBob. AI training completion and role-based attestations.
TRAINING · ROLES
Security tooling
Snyk, Wiz and CrowdStrike. Findings, severity and time to remediation.
FINDINGS · SLA
Data catalogues
Collibra, Atlan and DataHub. Lineage, classification and dataset ownership.
LINEAGE · OWNERS
Communication
Slack and Teams. Approvals captured where the decision actually happened.
APPROVALS
Your systems
A documented REST API and webhooks for anything not on the list.
REST · WEBHOOKS
02 — HOW IT CONNECTS
01
Read-only unless you explicitly grant more
Connectors request the narrowest scope that answers the control. Write access is never requested by default and is visible in the access log.
SCOPE DECLARED · LOGGED
02
Every artefact keeps its source
Evidence is stored with a pointer to the record it came from, the account that read it and the moment it was read. Nothing is transcribed by hand.
SOURCE · ACCOUNT · TIMESTAMP
03
Disconnect without losing the record
Revoking a connector stops collection. Evidence already gathered remains available, with its last-read date clearly marked.
REVOKE · RETAIN · MARK