Connectors

Connectors keep a memory current without anyone uploading anything.

Two tiers

First-party connectors — Gmail, Google Drive, Google Contacts, Notion, Confluence and HubSpot. Direct integrations, the deepest extraction, the ones to reach for first.

Catalog connectors — 350+ additional sources through the managed connector catalog: Slack, Salesforce, Jira, GitHub, Dropbox, SharePoint, Outlook, Teams and the long tail behind them.

Connections and grants

A connection is one authorisation, held at tenant level. A grant binds a connection to a specific workspace.

Authorise once, share deliberately. A team that should not see Notion content simply does not get a grant — you do not need a second OAuth authorisation to withhold it.

How credentials are held

Connector credentials are envelope-encrypted: a per-record key encrypts the payload and is itself wrapped by a master key held separately. The database stores only ciphertext and the wrapped key.

The practical consequence is that a database leak alone is not enough — an attacker would need both the database and the key store to decrypt anything.

Sync

Syncs run on a schedule and can be triggered manually. Progress is reported per grant, with indexed-document and graph-node counters that the console polls, so a long sync shows progress rather than appearing to hang.

Everything a connector delivers goes through the same pipeline as a manual upload: perimeter scan, classification, chunking, embedding, entity extraction, coherence and contradiction detection.

What arrives is not raw

A connector does not merely copy documents. By the time a synced document is searchable it has been classified into a department, had its entities resolved against everything already in the graph, and had any conflicts with existing facts flagged. That is the difference between syncing a wiki and integrating it.