connectors
The IAM surface area, in one place.
First-class connectors for the systems most teams live in. Generic SCIM and webhook adapters for the rest. Nothing browser-automated unless a vendor refuses to ship an API.
live now
Production-ready integrations.
These connectors run real API calls against live tenants. Each one ships with documented permissions scope, rotation runbook, and integration tests.
Okta
Identity
provision · reconcile roles/groups · deactivate · revoke sessions · deferred delete · reinstate
live
Slack
Seat · HITL approvals
deactivate seat · post approval messages · DM notifications
live
Zoom
Seat
deactivate · reinstate · deferred hard delete · reclaim seat
live
Salesforce
Seat · License
provision · reconcile permission sets · deactivate · reinstate · break-glass freeze · reclaim seat
live
GitHub
Org · Seat
provision/invite · reconcile teams · surgical team/repo revoke · reinstate · deferred org eviction · break-glass block
live
beta
In active validation.
Code-complete and unit-tested. They issue real API calls, but haven't cleared the end-to-end validation against a live vendor tenant that we require before calling anything GA.
Microsoft 365 / Entra ID
Identity · Licenses
block sign-in · revoke sessions · delete user · reclaim license
beta
BambooHR
HRIS · source of truth
termination lookup · employee status verify
beta
Workday
HRIS · source of truth
termination lookup · status verify · manager-aware approval · authoritative effective date
beta
Google Workspace
Identity · Licenses
suspend · revoke sessions · delete user · reinstate
beta
Jira Cloud
Service desk · intake
signed issue webhooks · tenant routing · policy-driven workflow intake
beta
Atlassian Cloud
Organization access
suspend account access · restore access · break-glass containment
beta
on the roadmap
Coming when a customer asks.
Scoped, designed, not yet built. We prioritize by which customer signs first.
Rippling
HRIS · source of truth
termination lookup · status verify
planned
AWS IAM Identity Center
Cloud · permission sets
disable · remove from permission sets
planned
lifecycle coverage
Not just leavers.
Okta, Salesforce, and GitHub are validated end-to-end against live tenants for the joiner / mover / leaver lifecycle. Slack is live for seat offboarding and HITL notifications, while Zoom is live for leaver and seat operations. Governance capabilities remain in active validation.
Offboarding (Leaver)
Lifecycle
soft-deactivate · reclaim licenses · deferred hard delete · reinstate window
live
Provisioning (Joiner)
Lifecycle
Okta · Salesforce · GitHub — provision/invite from birthright templates · privileged grants force HITL
live
Role change (Mover)
Lifecycle
Okta roles/groups · Salesforce permission sets · GitHub teams — live-read diff · surgical reconciliation
live
Access reviews (UAR)
Governance
roster snapshot · Slack attestation · surgical revoke · CSV evidence
beta
Scheduled offboarding
Governance
future-dated, held at the gatekeeper · HRIS re-verify before it fires
beta
Data transfer + SIEM export
Governance
Drive/OneDrive/mailbox handoff before delete · stream audit chain to your SIEM
beta
how a new integration works
What it takes to add yours.
A connector is a small Python module that exposes three verbs: soft_revoke, hard_revoke, and reinstate. We add one to the codebase, write an integration test against the vendor's sandbox, register it in the Vault credential schema, and ship. A typical first-class connector takes 1–2 days. SCIM-based connectors are essentially free.
design partners · q3 2026
Need a connector that's not listed?
Tell us your stack on the pilot form. If we already build one in the next two weeks anyway, you get it free. If not, we'll quote it.
