Every system you already pay for, under one roof
A connector is a replaceable protocol adapter for a service you already use. Your workflows depend on normalized capabilities — never on a vendor's endpoints, SDK types, or credential values.
Eleven categories, one taxonomy
Categories exist so a workflow can say “read customer context” instead of naming a vendor. New tools slot into the existing taxonomy; a category is only added when nothing can describe the thing.
If it has an API, we can work with it.A sample of the services that fit the existing taxonomy. Nothing here is a hard-coded integration list — it’s what the categories already describe.
All product names, logos, and brands are the property of their respective owners. Listing here indicates connectivity only and does not imply partnership, affiliation, or endorsement.
Seven conditions, all required
An invocation is permitted only when every one of these holds. Any single failure stops the call before it reaches the vendor.
- The connector definition is active.
- Your organization has an executable configuration revision.
- The connection is verified and belongs to that connector.
- The requested capability is enabled for that connection.
- An invocable operation and its idempotency rule are satisfied.
- The connection has a tenant-scoped secret reference.
- Input and output satisfy the capability's data contracts.
Swap the tool, keep the workflow
Because business logic binds to capabilities rather than vendors, changing CRMs doesn't mean rebuilding your automation. The adapter changes; the workflow doesn't.
- Single-source definitions. Each connector has exactly one catalog entry owning its category, capabilities, operation mappings, idempotency rules, and data contracts.
- Reads and writes are separate. Write operations require explicit workflow grants, idempotency keys, and — where you want it — human approval.
- Webhooks are verified. Incoming webhooks require signature verification and replay protection before anything acts on them.
The platform never holds your secrets
Connections store an opaque reference. The real material stays in the vault and is resolved server-side, inside the adapter's protocol boundary, at the moment of execution — then discarded.
API key
A static provider credential held in the configured vault.
OAuth 2
A delegated authorization grant with refresh behavior.
Service account
A workload identity or service principal.
Rotation, revocation, suspension, and offboarding invalidate affected material immediately. Credential-shaped headers and fields are redacted at every logging boundary.
Tell us what you run — we'll tell you what connects
Bring a list of the systems your business depends on. We'll walk through which categories they fall into, what capabilities they expose, and what becomes possible once they're talking to each other.