Connections

<!-- Reviewed 2026-10-12, later (owner: manage connections the way Claude does): no tool is locked to Always asks any more. A change starts on Ask only when its app marks it destructive, every other change starts on Auto, and the person's own Auto / Ask wins either way. --> <!-- Reviewed 2026-10-09, later (owner: "expand the categories to 14"): the catalog's six categories became fourteen; the old Communication & Business group split up, and the cloud platforms left Code & Change. --> <!-- Reviewed 2026-10-09 (owner: the library grows to ~500 apps): your own connections and the library are now two views — the list, and Add connection. The row test button moved to the connection's page. --> <!-- Reviewed 2026-10-15 (one engine runs a process): the compiled workflow step that sent a Slack message is deleted with the engine that ran it; a procedure's Slack message is sent by its session through the connection, under the person's Auto / Ask choice like any other change. --> <!-- Reviewed 2026-10-12 (owner: drop the hidden apps): an app whose manifest is hidden is not offered, so it has no entry here. That removed Skycloak, SharePoint, monday.com, Taskade, CircleCI, Harness, Aiven, Sumo Logic, Outlook, Checkr, Deel, Remote, Intercom, Kubit, Coupler.io, eSignatures and Figma. --> <!-- Reviewed 2026-10-08 (the first-party Gmail reply retired; owner: no separate email tooling): Gmail is read-only again, its send + modify permissions are no longer requested, and the "two connections can send" section now names only the Slack step. The notes below that describe the reply are history. --> <!-- Reviewed 2026-09-30 (leaving Google Cloud): connector credentials are now sealed with the environment's own key rather than a cloud key service; connecting, using and removing a connection work exactly as described. --> <!-- Updated 2026-09-20 (one Connect, and it is yours): the covered connect route now signs the consent as the person pressing it, and the covered list read answers with THAT person's status instead of the workspace's. Only the resolver half of the 2026-09-12 decision had shipped — every read already ran as the asker — so Connect minted a shared credential and a SECOND "Your account" consent, reachable only from inside a connection's panel, was the one way to finish. The owner hit it on Linear, the single connection in dev carrying both rows: *"I connect my account and that's it."* / *"No need extra personally connect part too."* / *"If I open a new account, I will see connectors un-connected."* So the section below loses the second card and says the list shows a connection as not connected until you connect it. The shared-key paragraph is unchanged and still true. --> <!-- Reviewed 2026-09-12 (your own account on a connection): the covered ConnectionDetailPanel gains one card, Your account, with Connect / Disconnect. It is documented below under Connecting → Your own account. Rewritten 2026-09-12, later, when the credential started being USED: the run engine, the Gmail reply and source pinning all reach the vendor as the acting person now, so the page says so. The one limit it still states is real — chat has not been moved across — and the paragraph naming it goes when it is. 2026-09-13 (owner): connections are PER PERSON. The section moved from Workspace to ACCOUNT, the list narrows to the caller's own rows, and adding/renaming/deleting lost their admin rung — you manage what you added. Rows written before that date have no `created_by` and stay the workspace's, admin-managed, which is the only reason this page still mentions a role at all. Delete that paragraph when no ownerless row remains. 2026-09-14 (the vendor's own connector service links per person too): the last connections that could not carry your own account were the ones served by the vendor's hosted connector service — their consent runs against the vendor's own sign-in rather than ours. They link like any other now, reusing the registration the workspace already made, so the page gains one paragraph under Connecting → Your own account and the sentence about what "cannot be linked" is down to shared-key connectors alone. Delete that sentence if a shared-key connector never ships. 2026-09-13, third (a bring-your-own-app connector links per person): the covered link route stopped refusing the dialects whose consent needs a verifier — it stages one on the consenting person's own row now (fs_to_pg_247) instead of the shared blob. So the page gains a paragraph saying a member is not asked to repeat the workspace's app registration: they sign in through it, and the account is theirs. Nothing else moves — the shared-key paragraph below is unchanged and still true. 2026-09-13, later (the workspace grant retires): the covered sendReply.ts no longer falls back to whichever admin connected the mailbox. Where a connection CAN carry your own account, an unlinked person is refused and told to connect theirs — so the old closing line, "everything you do still runs on the workspace's connection, exactly as it did before", became FALSE and is gone. The fallback survives only where no personal account can exist (shared-key connectors, and the two dialects whose consent is not per person yet), which is what the last paragraph now says. Chat is no longer a limit either: it acts as the speaker and is offered only their own connections. --> <!-- Reviewed 2026-09-10 (the permission mode is retired): the covered gmail/send/route.ts changed by one comment naming the gate that guards it. NOTHING HERE MOVES, and it is worth saying why rather than leaving it to be re-derived: sending a reply from your connected mailbox is a PROTECTED action, and protected actions never depended on the permission mode — they waited for a person even on its widest setting. Retiring the mode does not open them. A reply still leaves the mailbox only when a person says so; what changed is that they say so in words rather than by pressing Apply, which this page never described. --> <!-- Reviewed 2026-09-04 (vendor tool renames, caught by the refresh tick's drift escalation): Google's hosted Drive connector renamed its tools and dropped folder listing, and Sentry's dropped its release list — the catalog and recipe manifests were reconciled to the servers' current tool sets, and the Google Drive and Sentry sections below now describe the surviving evidence shapes (a pinned folder verifies through its own record, the picker drill-in unchanged; no release evidence). --> <!-- Reviewed 2026-08-30 (Asana SHIPPED): the `hidden: true` recorded in the 2026-08-29 note is gone — the OAuth pair is installed on all four surfaces — so the card is browsable and connectable, and the customer-facing Asana entry the earlier note promised is now in the Tickets & Projects section below, with the paragraph naming what its consent screen asks for. --> <!-- Reviewed 2026-08-17 (versions are a COUNT — owner ruling): the covered label code now mints plain numbers (v1, v2, v3) through the shared version core instead of its own decimal bump. A connection label's version is not described on this page — it is an internal fact about a binding, and nothing this page documents changed. --> <!-- Reviewed 2026-08-24 (full remote-MCP conversion, owner call — wave 2 the same day): thirteen connectors now connect through the vendors' own hosted connector services (Linear, Sentry, Notion, GitHub, Box, Google Drive, Gmail, Jira, Confluence, the combined Atlassian card, GitLab and Slack — plus Datadog, still hidden from browse). The Connect button and consent popup are unchanged for the person clicking them. Evidence authoring for Linear, Notion, Sentry, Jira, Confluence, GitLab and Slack is temporarily unavailable (their pinned resource shapes retired with the conversion and return when the vendors' tool names are reconciled) — the affected sections below say so honestly, following the Gmail precedent. --> <!-- Reviewed 2026-08-25 (Salesforce setup verification): walked the real customer setup in a live Salesforce org and verified each step against Salesforce's own hosted-MCP documentation. Added the two propagation waits (ECA up to 30 min, server activation up to 2 min) — the page promised "about five minutes" with no mention of them, which is the shape of a support ticket ("I followed the steps and it refuses"). The rest of the section held up: the org DOES have to register its own app and activate the read-only server, both by Salesforce's design. --> <!-- Reviewed 2026-08-25 (Salesforce server-URL correction): the catalog's default hosted-MCP URL gained its missing /platform/ namespace segment. Nothing this page states changes — it never quotes the URL, and the connect dialog still walks the same setup — reviewed rather than labeled so the check stays honest. --> <!-- Reviewed 2026-08-25 (the reconciliation): evidence authoring is back for the converted connectors, rebuilt on the vendors' verified tool vocabularies (live capture provenance in each service manifest). The per-connector bullets now say exactly what each service can and cannot pin — the honest losses (Jira audit log, GitLab directory reads, Slack whole-workspace lists, Salesforce record-by-id) are vendor limitations, stated in place. --> <!-- Reviewed 2026-08-25 (conversion wave 3): Salesforce joins the hosted connector services, authenticated by an External Client App each org registers itself (the Okta advanced-setup pattern — the connect dialog walks through it). Its evidence section follows the same temporarily-unavailable honesty as the others. -->

Connections let Alchex work with the systems your organization already uses — your document stores, identity provider, ticketing, code hosting, and monitoring tools. A connection can do what its app's own connector service offers and what the account you sign in with is allowed to do; Alchex adds no read-only limit of its own.

How changes happen:

• A connection holds every tool its app offers, and the assistant can change things when you ask. Like Claude's own connectors, Alchex keeps no list of allowed tools: a connection gets every tool its app's own connector service offers, and the assistant can do more than read: for example open an issue, comment on one, or update it. Which tools only look and which change something is the app's own word. Each change is one of two kinds:

  • Most changes, such as creating or updating an issue, start on Auto: they run when you ask for them.
  • Changes the app itself marks as destructive start on Ask: they wait for your yes in the conversation, and the assistant never makes one in an unattended run while it is on Ask. Which tools those are is the app's own word, never a guess from a tool's name.

  Both are only where a tool starts. You decide: set any tool to Auto or Ask, or the whole connection to Ask (see Auto or Ask below), and your choice is what runs. Nothing is hidden or refused for being a change. A procedure that asks for a Slack message is no exception: the session that runs it sends through the Slack connection under the same Auto or Ask choice.

  Every change is written to your workspace's history: who asked for it, which change it was, and on which connection. Audits and evidence checks only ever read. They can never change the system they are checking.

  Open the connection to see every tool it holds, by name, each with its own Auto / Ask showing where it stands now. A tool that changes something says so under its name, and one its app marks as destructive says that too. Tools that only look — including ones that download a file or fetch its details — change nothing in the app and carry no such note.

Either way, a change is whatever the app offers and the account you signed in with allows.

Every app connects one way: through its maker's own connector service. Connect opens the app's own sign-in and consent screen, the same for every app on this page, the way Claude's own connectors work. Any member of the workspace can connect an app for themselves; no administrator is needed.

Connections live in Settings → Connections, under Account, and the list is yours. You connect the apps you need; a colleague connects theirs. You might have Salesforce where she has only Gmail, and neither of you sees the other's.

Anyone can add one — it is not an admin job — and what you add is yours to rename, disconnect or delete. Nobody else can manage it, and an admin cannot either.

⚠ Connections made before 13 September 2026 belong to the workspace, not to a person. They were added when a connection was shared, so they are still listed for everyone and only an Owner or Admin can rename, disconnect or remove them. Everything added since belongs to whoever added it.

Your connections and the library

Settings → Connections lists only the apps you have connected. Rows that need you — a connection that lost access — come first, a banner above the list counts them, and Needs attention narrows the list to exactly those. Reconnect sits right on the row; click anywhere else on a row to open its page.

Everything you could connect is in the library: press Add connection. Search there looks across every app, whatever category is selected; the categories on the left narrow the list when you browse instead. An app you already connected stays in the library, marked Connected, so searching for it never reads as "not available".

The catalog, by category

Connectors are grouped into fourteen categories by the kind of evidence they hold, in the order most workspaces should connect them — identity and documents unlock the most, so they lead. The library's category list shows only categories that have an app in them.

Every app is shown with its own official logo, in its own colours, exactly as the vendor publishes it — the same in light and dark mode. A custom server you add yourself has no vendor, so it shows a plug.

Identity & Access

Okta, Microsoft Entra ID, Google Cloud IAM, Google Workspace and Microsoft Azure IAM are no longer offered. Alchex reaches an app only through the app maker's own hosted connector service, and none of these has one Alchex can use today. A connection made to one before shows as needing a reconnect, and the reconnect is refused until one exists.

• JumpCloud — users, devices, groups, SSO applications, policies, patch status and alerts through JumpCloud's own hosted connector service.

  What you approve when you connect: JumpCloud's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in JumpCloud administrator can already see.

Documents & Knowledge

Your policies, procedures, and records — the documents your reviews cite.

• Google Drive — find and read Drive files. Evidence: a file, or a folder. A Drive folder can be pointed at whole, or the file inside it; a pinned folder is verified through its own record (Google's connector service retired its folder-contents listing, so the folder proves access to the folder — pin the file inside when the content is what matters). A typed search phrase is never evidence: the field's search finds the real file, and that file is what gets pinned.

• Box — search and read files and folders. Evidence: a file, a folder's contents, or a shared link. A Box folder can be pointed at whole, the same way a Drive folder can.

• Dropbox — browse and search Dropbox content, read a file's revision history, and list the shared links that expose it outside the account, through Dropbox's own hosted connector service.

• Notion — search and read workspace pages, now through Notion's own hosted connector service. Evidence: a page or database — paste its link or id — and the workspace user list. (Evidence authoring returned 2026-08-25, reconciled to the service's verified abilities.)

• Confluence — search and read pages in your Confluence spaces, now through Atlassian's own hosted connector service. Evidence: a page (paste its link, or give your site plus the page id), a space's page list, or your space list — each addressed by your site (for example acme.atlassian.net). The same organization-administrator setting as Jira applies.

• Egnyte — files and folders, document content, metadata, projects, comments and share links through Egnyte's own hosted connector service.

  What you approve when you connect: Egnyte's own sign-in and consent screen for its hosted connector service; the connection can read only the files and folders the signed-in Egnyte user can already access.

• Perfect Wiki — knowledge bases and their pages through Perfect Wiki's own hosted connector service.

  What you approve when you connect: Perfect Wiki's own sign-in and consent screen for its hosted connector service; the connection can read only the knowledge base you approve.

• Lumin — workspace details, templates and signature request status through Lumin's own hosted connector service.

  What you approve when you connect: Lumin's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Lumin user can already see.

• Jotform — forms, submissions, teams and the signing status of documents through Jotform's own hosted connector service.

  What you approve when you connect: Jotform's own sign-in and consent screen for its hosted connector service, asking for read-only access; the connection can read only what the signed-in Jotform user can already see.

• Mintlify — documentation project settings, Git sources, workflows, analytics and branches through Mintlify's own hosted connector service.

  What you approve when you connect: Mintlify's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Mintlify user can already see.

• Contentful — entries, content types, assets, releases, spaces, environments, locales and tags through Contentful's own hosted connector service.

  What you approve when you connect: Contentful's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Contentful user can already see.

What a Dropbox access review does and does not cover. Shared links are listed as the connected account owns them — a link another member created for the same file is not visible to this connection, so treat the list as a lower bound on external exposure rather than the complete picture. The connection does not list who is a member of a file or folder; check membership in Dropbox itself. Dropbox's search runs on an index that catches up after a change, so a just-added file can be missing from a search that finds everything else — Alchex says so in the answer rather than letting an empty result read as proof that nothing is there.

Not every connected system can produce evidence yet. Gmail cannot: writing a fetch means naming the exact call and the exact details it needs, and for Gmail those details are not yet known here — so rather than guess at a mailbox, Alchex says so and asks you to point at another source. You are always told which case you are in.

Tickets & Projects

Change-management and incident trails.

• Jira — issues and projects, now through Atlassian's own hosted connector service. Evidence: an issue (paste its link, or give your site plus the issue key) and the visible-projects list, each addressed by your site (for example acme.atlassian.net). Audit-log evidence does not return: Atlassian's service offers no audit-records read, so that older evidence shape asks you to pick a different source. Your Atlassian organization's administrator controls which AI tools may connect (Administration → AI settings); if a connection is refused there, that setting — not Alchex — is the door to open.

• Asana — the work itself, through Asana's own hosted connector service. Projects, portfolios and tasks with their assignee, dates, custom fields, subtasks and comments; who is in a team; status overviews and attachments. Evidence: a project, a task, or a portfolio's status.

  What you approve when you connect: Asana's own consent screen for its hosted connector service. Asana does not split this access into permissions: the screen grants access to what the signed-in Asana user can already see and do. What the assistant then does with it follows the connection's Auto / Ask setting below, tool by tool. A connection made before this change is on Asana's older access and asks you to reconnect once.

  Two limits worth knowing. Task search is an Asana Premium feature; on a free workspace Asana refuses it, and Alchex says that is a plan limit rather than letting it read as a broken connection. And an activity stream is what Asana chose to record and keeps under your workspace's retention — an absent entry is not proof the action did not happen, which is the difference between an activity stream and an audit log.

• Linear — issues and projects, now through Linear's own hosted connector service. Evidence: an issue (paste its link or key), a project, and the team, member, document and comment lists. (Evidence authoring returned 2026-08-25, reconciled to the service's verified abilities.)

• Pylon — support issues, accounts, contacts, knowledge base articles, surveys and triggers through Pylon's own hosted connector service.

  What you approve when you connect: Pylon's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Pylon user can already see.

• Ybug — bug and feedback reports with their logs, requests, comments and tags through Ybug's own hosted connector service.

  What you approve when you connect: Ybug's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Ybug user can already see. Ybug offers this service on its Basic plan and above.

• Fibery — work records, documents, views, reports, automations and the workspace change history through Fibery's own hosted connector service. Evidence of how your organisation plans, tracks and changes its work.

  What you approve when you connect: Fibery's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Fibery user can already see.

• Todoist — tasks, projects, comments, collaborators and the activity log through Todoist's own hosted connector service. Evidence for who is working on what and what was completed.

  What you approve when you connect: Todoist's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Todoist user can already see.

• Unthread — customer satisfaction surveys, their analytics and responses through Unthread's own hosted connector service. Evidence for how customers rate the support they receive.

  What you approve when you connect: Unthread's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Unthread user can already see.

• Jam — bug recordings with their console logs, network requests, user events and metadata, plus folders and members, through Jam's own hosted connector service.

  What you approve when you connect: Jam's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Jam user can already see.

• ClickUp — tasks, lists, spaces, docs, comments and time entries through ClickUp's own hosted connector service.

  What you approve when you connect: ClickUp's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in ClickUp user can already see.

• Trello — boards, lists, cards, members and activity through Trello's own hosted connector service.

  What you approve when you connect: Trello's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Trello user can already see.

Jira and Confluence are separate cards; connecting either asks only for that product's read permissions on Atlassian's consent screen. Workspaces that connected the older combined Atlassian (Jira + Confluence) card before the split keep their connection listed; reconnecting it goes through Atlassian's hosted connector service like the product cards, and it no longer appears for new connections.

Code & Change

• GitHub — organization members, teams, and the org audit log.

• GitLab — connected through GitLab's own hosted connector service. Evidence: a merge request, pasted by its link. Group, membership and audit-event evidence does not return: GitLab's service reads issues, merge requests and pipelines only, so those older evidence shapes ask you to pick a different source.

• Hugging Face — the models, datasets and Spaces your organisation keeps on Hugging Face, with their model cards and files, through Hugging Face's own hosted connector service. Evidence for an inventory of the AI models you use and their documentation.

  What you approve when you connect: Hugging Face's own sign-in and consent screen; Alchex asks only to read your profile and repositories.

• LaunchDarkly — projects, environments, feature flags and their health, segments, approval requests, release policies, members and the change history through LaunchDarkly's own hosted connector service.

  What you approve when you connect: LaunchDarkly's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in LaunchDarkly user can already see.

• DevCycle — feature flags, variables, each flag's change history and evaluation counts through DevCycle's own hosted connector service. Evidence for how your organisation controls and changes what runs in production.

  What you approve when you connect: DevCycle's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in DevCycle user can already see.

• Replicate — models, predictions, deployments, collections and account details through Replicate's own hosted connector service.

  What you approve when you connect: Replicate's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Replicate user can already see.

Cloud & Infrastructure

• Supabase — organizations, projects, tables, migrations, extensions, edge functions, logs and Supabase's own security and performance advisors through Supabase's own hosted connector service.

  What you approve when you connect: Supabase's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Supabase user can already see in the Supabase dashboard.

• Neon — projects, branches, compute endpoints, database roles, project members and permissions, snapshots and table schemas through Neon's own hosted connector service.

  What you approve when you connect: Neon's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Neon user can already see.

• Railway — projects, services and feature flags through Railway's own hosted connector service. Evidence for what runs where, and how releases are controlled.

  What you approve when you connect: Railway's own sign-in and consent screen for its hosted connector service, where you choose which workspaces and projects the connection can reach.

• Cloudflare — the account's configuration and change history through Cloudflare's own hosted connector service: zones, DNS records, firewall and WAF rules, TLS certificates, Zero Trust access policies, members, and the audit log of who changed what and when. Evidence: the settings in force and the change log for a period.

  What you approve when you connect: Cloudflare's own sign-in and consent screen for its hosted connector service. The connection can do what the signed-in Cloudflare user can do.

• Control Plane — workloads, deployments, logs, metrics, traces, audit events and quotas through Control Plane's own hosted connector service. Evidence for how your infrastructure is run, monitored and changed.

  What you approve when you connect: Control Plane's own sign-in and consent screen for its hosted connector service; you choose which organisations the connection may access, and it can read only what you can already see.

• Heroku — the apps in a Heroku account and their platform settings through Heroku's own hosted connector service.

  What you approve when you connect: Heroku's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Heroku user can already see.

• PlanetScale — organizations, databases, branches, schemas and query insights through PlanetScale's own hosted connector service.

  What you approve when you connect: PlanetScale's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in PlanetScale user can already see.

Monitoring & Security

• Datadog — monitors, incidents, metrics, logs and dashboards through Datadog's own hosted connector service.

  What you approve when you connect: Datadog's own sign-in and consent screen; there is no key to paste. The connection can read only what the signed-in Datadog user can already see.

• Sentry — issues and projects from your Sentry organization, now through Sentry's own hosted connector service. Evidence: an issue (paste its link, or give the organization slug plus the issue id), and the organization and project lists. The release list retired with Sentry's own connector update — a release is no longer offered as evidence. Reconnecting an existing Sentry connection asks for a fresh consent — the old installation-based link is retired.

• incident.io — incidents with their timelines and post-mortems, follow-ups, alerts, escalations, on-call schedules and response-time metrics through incident.io's own hosted connector service. Evidence for how your organisation detects, handles and learns from incidents, and for the incident reports some laws require.io.

  What you approve when you connect: incident.io's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in incident.io user can already see. incident.io offers this service on its Team, Pro and Enterprise plans.

• Rootly — incidents, alerts, on-call shifts and handoffs through Rootly's own hosted connector service. Evidence for how your organisation detects, handles and learns from incidents, and for the incident reports some laws require.

  What you approve when you connect: Rootly's own sign-in and consent screen; Alchex asks only for read permissions on incidents, alerts and on-call schedules.

• Braintrust — projects, experiments, datasets, monitoring views, automations and recorded patterns through Braintrust's own hosted connector service.

  What you approve when you connect: Braintrust's own sign-in and consent screen for its hosted connector service; the connection acts with the permissions of the signed-in Braintrust user.

• LangSmith — projects, traces, prompts, datasets, experiments and usage through LangSmith's own hosted connector service.

  What you approve when you connect: LangSmith's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in LangSmith user can already see.

• New Relic — entities, dashboards, alert policies and conditions, open issues, change events, error groups and synthetic monitors through New Relic's own hosted connector service.

  What you approve when you connect: New Relic's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in New Relic user can already see.

• Grafana Cloud — dashboards, folders, data sources, incidents, on-call schedules, teams and roles through Grafana Cloud's own hosted connector service.

  What you approve when you connect: Grafana Cloud's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Grafana Cloud user can already see.

• Memfault — devices, issues, metrics and projects through Memfault's own hosted connector service.

  What you approve when you connect: Memfault's own sign-in and consent screen for its hosted connector service; the connection can read only the organization and project the signed-in Memfault user picks.

• Raygun — applications, error groups and occurrences, deployments, backend performance issues, sessions and pages through Raygun's own hosted connector service. Evidence for which errors and slowdowns users hit, and which release introduced them.

  What you approve when you connect: Raygun's own sign-in and consent screen for its hosted connector service; the connection reads one Raygun plan and only what the signed-in Raygun user can already see.

• Better Stack — monitors, incidents, on-call schedules, status pages, logs, metrics and tracked errors through Better Stack's own hosted connector service.

  What you approve when you connect: Better Stack's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Better Stack user can already see.

• Cisco ThousandEyes — tests, events, alerts, outages, agents, network paths and dashboards through Cisco ThousandEyes's own hosted connector service.

  What you approve when you connect: Cisco ThousandEyes's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Cisco ThousandEyes user can already see.

Communication

• Slack — channels, workspace members, and messages you can search, now through Slack's own hosted connector service. A Send a Slack message step does not send yet (see the top of this page). Reconnecting asks for your own read permissions alongside the workspace's — both on Slack's consent screen. Evidence: a channel's member list and a member's profile. Whole-workspace channel and member lists do not return: Slack's service answers name searches, not full listings, so those older evidence shapes ask you to pick a different source.

• Gmail — search and read messages in the connected mailbox. Limited availability: Google classifies mail access as a restricted permission and requires an independent security assessment before an app may offer it broadly, so Gmail currently connects only for accounts we have registered for testing. Ask us to add yours.

• Fellow.ai — meetings with their summaries, transcripts, participants, agendas and action items through Fellow.ai's own hosted connector service. Evidence of how your organisation holds its meetings, records decisions and follows up on them.

  What you approve when you connect: Fellow.ai's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Fellow user can already see. A Fellow workspace admin must have allowed MCP connections.

• Krisp — meetings, notes, transcripts and action items through Krisp's own hosted connector service.

  What you approve when you connect: Krisp's own sign-in and consent screen for its hosted connector service; the connection can read only the meetings the signed-in Krisp user can already see.

• Quo — message history, call history and voicemail transcripts through Quo's own hosted connector service. Evidence for how your organisation communicates with customers.

  What you approve when you connect: Quo's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Quo user can already see.

• Wavix — messages, call records, recordings, verification events, numbers, SIP trunks and billing through Wavix's own hosted connector service. Evidence for what communications ran through the account and what they cost.

  What you approve when you connect: Wavix's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Wavix user can already see.

• Customer.io — automations, segments, people, message content and delivery metrics through Customer.io's own hosted connector service.

  What you approve when you connect: Customer.io's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Customer.io user can already see.

HR & People

• Ashby — candidates, applications, jobs, openings, interview plans and hiring pipelines through Ashby's own hosted connector service.

  What you approve when you connect: Ashby's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Ashby user can already see.

• Workable — jobs, candidates and their activity, offers, requisitions, members, employees, time off, time entries and review cycles through Workable's own hosted connector service.

  What you approve when you connect: Workable's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Workable user can already see.

• Shapes — employees and reporting lines, profile change history, performance reviews, time off, surveys, attendance, and the knowledge base and helpdesk through Shapes' own hosted connector service.

  What you approve when you connect: Shapes' own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Shapes user is already allowed to see.

• Factorial — HR policies, contracts, reports, the knowledge base and performance reviews through Factorial's own hosted connector service.

  What you approve when you connect: Factorial's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Factorial user can already see.

• Greenhouse — jobs, candidates, applications, interview stages, scorecards, rejection reasons and users through Greenhouse's own hosted connector service.

  What you approve when you connect: Greenhouse's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Greenhouse user can already see.

• Gusto — payroll runs, employees, contractors, payment deadlines and tax liabilities, within the data categories the admin allows through Gusto's own hosted connector service.

  What you approve when you connect: Gusto's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Gusto user can already see.

• Leapsome — employees, teams, goals, feedback, reviews, surveys, learning, absences and people analytics through Leapsome's own hosted connector service.

  What you approve when you connect: Leapsome's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Leapsome user can already see.

Finance & Payments

• Stripe — the Stripe account's details and its payment metrics, and search Stripe's own documentation through Stripe's own hosted connector service.

  What you approve when you connect: Stripe's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Stripe user can already see.

• Mercury — accounts, balances, statements, transactions, cards, recipients, users, approval requests and invoices through Mercury's own hosted connector service.

  What you approve when you connect: Mercury's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Mercury user can already see.

• Brex — users, departments, cards, spend limits, expenses, bank accounts, vendors, accounting records and travel through Brex's own hosted connector service.

  What you approve when you connect: Brex's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Brex user can already see.

• Digits — businesses, transactions, departments, locations, categories and users through Digits' own hosted connector service.

  What you approve when you connect: Digits' own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Digits user can already see.

• Privacy.com — virtual cards with their spend limits and states, and the transactions on them, through Privacy.com's own hosted connector service. Evidence for who can spend, on which cards and limits.

  What you approve when you connect: Privacy.com's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Privacy.com user can already see. Privacy.com offers this service on its paid plans.

• Checkout.com — payment details and the entities behind them through Checkout.com's own hosted connector service.

  What you approve when you connect: Checkout.com's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Checkout.com user can already see.

• GoCardless — payments, customers, mandates, subscriptions, payouts, refunds and events through GoCardless's own hosted connector service.

  What you approve when you connect: GoCardless's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in GoCardless user can already see.

• Mollie — payments, payment links, customers, subscriptions, balances, settlements, invoices and terminals through Mollie's own hosted connector service.

  What you approve when you connect: Mollie's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Mollie user can already see.

• Paddle — products, prices, customers, subscriptions and transactions in a Paddle billing account through Paddle's own hosted connector service.

  What you approve when you connect: Paddle's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Paddle user can already see.

• PayPal — invoices and transaction and payment records in a PayPal business account through PayPal's own hosted connector service.

  What you approve when you connect: PayPal's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in PayPal user can already see.

• Ramp — transactions, vendors, accounting categories, departments, reimbursements, treasury balances and the org chart through Ramp's own hosted connector service.

  What you approve when you connect: Ramp's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Ramp user can already see.

CRM & Marketing

• Klaviyo — account details, campaigns, flows, lists, segments and event metrics through Klaviyo's own hosted connector service.

  What you approve when you connect: Klaviyo's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Klaviyo user can already see.

• Close — leads, contacts, opportunities, activities, notes, tasks, workflows and the people, roles and groups in the organization through Close's own hosted connector service.

  What you approve when you connect: Close's own sign-in and consent screen for its hosted connector service, asking only for read access; the connection can read only what the signed-in Close user can already see.

• Clarify — companies, people, deals, meetings, tasks, comments, lists, campaigns and agent runs in the workspace through Clarify's own hosted connector service.

  What you approve when you connect: Clarify's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Clarify user can already see.

• Attio — CRM records, lists, notes, tasks and comments, and who in the workspace owns them, through Attio's own hosted connector service. Evidence for which customers and partners your organisation tracks and how relationships are followed up.

  What you approve when you connect: Attio's own sign-in and consent screen for its hosted connector service; the connection acts as the signed-in Attio user and can read only what that user can already see.

• Outreach — accounts, prospects, opportunities, sequences, tasks, users, teams, recorded meetings and emails through Outreach's own hosted connector service.

  What you approve when you connect: Outreach's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Outreach user can already see.

• Sybill — sales conversations and meetings, deals and accounts through Sybill's own hosted connector service. Evidence for what was discussed and agreed with customers, and who took part.

  What you approve when you connect: Sybill's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Sybill user can already see.

Data & Analytics

• PostHog — error-tracking issues, product and web analytics, logs and the data schema through PostHog's own hosted connector service. Evidence for which errors users hit and how the product behaves in use.

  What you approve when you connect: PostHog's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in PostHog user can already see.

• Airtable — workspaces, bases, tables, views, records, interface pages and automations through Airtable's own hosted connector service.

  What you approve when you connect: Airtable's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Airtable user can already see.

• ClickHouse Cloud — organizations, services, backups, ClickPipes, database and table structure, and cost data through ClickHouse Cloud's own hosted connector service.

  What you approve when you connect: ClickHouse Cloud's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in ClickHouse Cloud user can already see.

• Scispot — lab data sheets, notebook experiments, protocols and documentation, storage locations and manifests, and sample lists through Scispot's own hosted connector service.

  What you approve when you connect: Scispot's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Scispot user can already see.

• MotherDuck — databases, tables, views, columns, shares and macros through MotherDuck's own hosted connector service.

  What you approve when you connect: MotherDuck's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in MotherDuck user can already see.

• Atlan — data assets, their metadata, owners, tags, users and groups through Atlan's own hosted connector service.

  What you approve when you connect: Atlan's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Atlan user can already see.

• Amplitude — charts, dashboards, experiments, feature flags, the event tracking plan and data-warehouse import and export jobs through Amplitude's own hosted connector service. Evidence for what your organisation measures about its product and how that data is governed.

  What you approve when you connect: Amplitude's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Amplitude user can already see. Workspace admins can switch this service off in Amplitude's organisation settings.

• Pendo — applications, pages, features, guides, surveys, accounts, AI agent analytics and feedback through Pendo's own hosted connector service.

  What you approve when you connect: Pendo's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Pendo user can already see.

• Databox — accounts, data sources, datasets, ingestion history and metrics through Databox's own hosted connector service. Evidence for which systems feed your reporting and how fresh the data is.

  What you approve when you connect: Databox's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Databox user can already see.

• Great Question — research studies, sessions, transcripts, insights, consent forms and teams through Great Question's own hosted connector service.

  What you approve when you connect: Great Question's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Great Question user can already see.

• Hex — projects, notebook cells, run results, analysis threads and data connections through Hex's own hosted connector service.

  What you approve when you connect: Hex's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Hex user can already see.

• Honeydew Semantic Layer — the semantic model, warehouse tables, agents, context items and query history through Honeydew's own hosted connector service.

  What you approve when you connect: Honeydew's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Honeydew user can already see.

• Omni Analytics — dashboards and apps, the saved queries behind them, model branches and saved skills through Omni's own hosted connector service.

  What you approve when you connect: Omni's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Omni user can already see.

• Apaleo — availability and rates, reservations, folios, guest profiles, occupancy and revenue figures, and daily arrivals and departures through Apaleo's own hosted connector service.

  What you approve when you connect: Apaleo's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Apaleo user can already see.

Legal & Signatures

• SignNow — templates, documents, signing invite status and contacts through SignNow's own hosted connector service.

  What you approve when you connect: SignNow's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in SignNow user can already see.

• PandaDoc — documents, templates and their signature status through PandaDoc's own hosted connector service.

  What you approve when you connect: PandaDoc's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in PandaDoc user can already see.

Design & Whiteboards

• Canva — designs, their pages, content and comments, folders, assets, brand templates and brand kits through Canva's own hosted connector service.

  What you approve when you connect: Canva's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Canva user can already see.

• Miro — boards and the items on them through Miro's own hosted connector service.

  What you approve when you connect: Miro's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Miro user can already see.

• Whimsical — diagrams, boards and docs in your Whimsical workspace, and search across them, through Whimsical's own hosted connector service.

  What you approve when you connect: Whimsical's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Whimsical user can already see.

• Eraser — files, documents, diagrams and folders, with search, through Eraser's own hosted connector service. Evidence for which architecture and design documentation exists and what it shows.

  What you approve when you connect: Eraser's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Eraser user can already see.

• Lucid — diagrams and documents the signed-in user can open, including titles, content, comments and metadata through Lucid's own hosted connector service.

  What you approve when you connect: Lucid's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Lucid user can already see.

Operations & Logistics

No app in this category is offered yet.

• Facilio — work orders, service requests, assets, tenants, purchase orders and inventory through Facilio's own hosted connector service.

  What you approve when you connect: Facilio's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Facilio user can already see.

• Flexport — shipments, container and customs status, contract and spot freight rates, quote requests, ports and addresses through Flexport's own hosted connector service.

  What you approve when you connect: Flexport's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Flexport user can already see.

• Geotab — vehicles, drivers, trips, devices and other fleet-telematics records from a MyGeotab database through Geotab's own hosted connector service.

  What you approve when you connect: Geotab's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Geotab user can already see.

• Harvest — time entries, projects, clients, tasks, team assignments, invoices, expenses and project budgets through Harvest's own hosted connector service.

  What you approve when you connect: Harvest's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Harvest user can already see.

• Katana — stock levels, sales, purchase and manufacturing orders, products, materials, customers and suppliers through Katana's own hosted connector service.

  What you approve when you connect: Katana's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Katana user can already see.

• Medplum — patient records, appointments, lab results and other FHIR resources stored on a Medplum server through Medplum's own hosted connector service.

  What you approve when you connect: Medplum's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Medplum user can already see.

• Motive — vehicle locations and health, driver hours-of-service logs, inspection reports, safety events, geofences and fuel records through Motive's own hosted connector service.

  What you approve when you connect: Motive's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Motive user can already see.

• Productive — projects, tasks, time entries, bookings, invoices, expenses, people and reports through Productive's own hosted connector service.

  What you approve when you connect: Productive's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Productive user can already see.

• Samsara — fleet vehicles, drivers, safety events, hours-of-service compliance, inspections, routes and fuel use through Samsara's own hosted connector service.

  What you approve when you connect: Samsara's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Samsara user can already see.

• ShipBob — orders, inventory, products, shipments and sales channels through ShipBob's own hosted connector service.

  What you approve when you connect: ShipBob's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in ShipBob user can already see.

• Shippo — shipments, carrier rates, labels, tracking, addresses, customs declarations and batches through Shippo's own hosted connector service.

  What you approve when you connect: Shippo's own sign-in and consent screen for its hosted connector service; the connection can read only what the signed-in Shippo user can already see.

Connecting

Every connector connects the same way: press Add connection, click Connect on the app, approve the consent screen in the popup, and the connection appears in your list. Several connectors now run through the vendor's own hosted connector service behind that same button — the only visible difference is whose consent screen appears, and for some vendors the sign-in registers Alchex automatically instead of using a pre-registered app. The account you approve with is the account whose access Alchex inherits — for the two admin account required connectors above, that means connecting with an admin account, or the connection will look healthy but return no directory or audit data.

There is no connector that asks you to paste an API key. Access is always something you grant on the vendor's own consent screen and can withdraw there, which means you can see exactly what Alchex was given and revoke it without going through us.

If your plan meters connections, only completed connections count — an abandoned consent popup never uses up a slot.

Your own account

Your connections are yours, so the account behind one is yours by construction: what you connect, you connect with your own sign-in. There is one Connect, and it gives the connection your account — there is no second step to find afterwards.

That is also why a colleague connecting something does not connect it for you. A connection someone else set up is listed for everyone, and it shows as not connected until you connect it; if you open a new account you will see the list that way, and connecting is what changes it. What that stores is yours alone: nobody else can use it, disconnecting it affects nobody else, and an administrator cannot see through it.

Once you have connected yours, it is the one that gets used. A workflow step that reads a connected source, a message a procedure posts, an app the assistant reads for you in chat — each goes out through your account, so what comes back is what you can already see and what you send carries your name.

Your chat turns use it too. Ask the assistant to read a connected app and it reads as you — and it is offered only the apps you have connected, so it can never reach a colleague's.

If you have not connected, you are asked to. Nothing falls back to somebody else's sign-in behind your back — so a read or a send stops and tells you to connect rather than quietly going out as whoever set the connection up. Connecting takes the same popup as everything else on this page, and once it is done the request goes through.

A connector that runs through the vendor's own connector service — the ones where the consent screen that opens is the vendor's rather than ours — takes your own account the same way, and for the same reason: what the workspace registered with that vendor is reused, and the account you approve with is yours. Connecting yours there does not disturb anyone else's, and it is the account your reads go out through afterwards.

Some connectors have no personal account to connect — one that signs in with a shared key, for instance — so the Your account card does not appear on them rather than offering a button that would fail. Those keep running on the workspace's connection, because that is the only account they have.

Renaming a connection

A connection's name is yours to change. Open it from the list and use Rename beside the title — type the new name and press Save or Enter, or Escape to leave it alone. This is a display name only: it renames nothing in the vendor's system, breaks no label or reference pointing through the connection, and takes effect everywhere the connection is listed. Useful when you connect the same product twice — Drive (Finance) and Drive (Engineering) read better than two rows called Google Drive.

You see Rename on the connections you added. On one that belongs to the workspace — made before 13 September 2026 — only an Owner or Admin does, for the same reason only they can disconnect or remove it: the change lands on everybody.

Auto or Ask: when the assistant uses an app

Each connection has a choice about how the assistant uses it, and so does each of its tools. Open the connection from the list and pick one under When the assistant uses this app:

• Auto — the assistant uses the app directly whenever your conversation needs it. This is where every connection starts.
• Ask — before each use of the app, the assistant asks you in the conversation what it wants to do there. Nothing happens in the app until you say yes; say no and nothing is done.

One tool at a time. Under Tools on the same page, every tool the connection offers has its own Auto / Ask. A tool follows the connection's choice until you set it on its own — except that a tool its app marks as destructive starts on Ask even when the connection is on Auto. For example, keep a connection on Auto but set the one tool that closes tickets to Ask, and only that tool waits for you; or set a destructive tool you trust to Auto, and it runs without asking. Changing the connection's own choice sets every tool back to where it starts. A connection checked before 12 October 2026 learns which of its tools are destructive at its next check; until then every one of its changes starts on Auto.

The choice covers that one connection's use in your conversations and nothing else: your other connections, your documents and your processes behave exactly as before. A process that runs on its own has nobody to ask, so it uses the app as it always has — except a destructive tool still on Ask, which it does not run. You see the choice on the connections you added; on one that belongs to the workspace, only an Owner or Admin changes it.

Finding a connection in the list

Every connection is listed under the product's own name — the same name it carries in the catalog above. The filter box above your list matches on that name and on its category, so typing part of a product name narrows the list to it.

If you have previously seen connections listed as Custom MCP server, or found that searching for a product name returned nothing even though the connection was there, that affected connectors added most recently and is fixed. Their names and search now behave like every other connector's. No action is needed on your side — reopen Settings → Connections and the correct names appear.

From the assistant

Everything above can also be asked for in plain words, in Alchex's chat or in your own AI assistant connected to Alchex — and it only ever touches your own connections:

• "Are my connections working?" — checks each of your connections for real, says which one needs attention, whether each is on Auto or Ask, and which apps you could still connect.
• "Connect Jira" — answers with a link to this page that starts Jira's sign-in. You finish it here, so nothing is connected until you approve the consent screen.
• "Rename my Drive connection to Drive (Finance)" and "Set Linear to Ask" — done at once. Ask only ever makes things safer.
• "Let it use Linear without asking" (Auto) and "Disconnect Linear" — in Alchex's chat these wait for you to press Apply on the card. In your own AI assistant, its confirmation is the yes, the same way archiving a document works there.

Trusting what you see

The panel is designed so a broken connection can't hide behind a green dot:

• Verified, with a time. Each connected row shows when its last real health check ran — "Verified 2h ago" means Alchex made an authenticated round-trip to the vendor and it worked, not merely that a token exists.
• Automatic re-checks. Opening the panel silently re-probes connections whose last check is stale; a dead credential flips to Needs reconnecting instead of sitting green for days.
• Test on demand. Test connection on a connection's own page runs the same authenticated probe and reports healthy, needs-reconnect, or couldn't-verify — a momentary blip is never shown as a confident result either way. The same test reads the list of tools the app offers right now, and the connection holds exactly that list from then on — a tool the app adds appears, and one it removes goes. An app that offers no tools at all reads as needs-reconnect. On a connection's own page the answer is written under the buttons and stays there: one sentence naming the connection and what to do next, with Reconnect offered right in it when that is the fix. (It used to be a message that appeared briefly and could be missed entirely, which made pressing Test feel like it did nothing.) The reason a vendor gave is never shown raw — you get the sentence, not the error code.
• New capabilities banner. When Alchex adds abilities to a connector that need permissions your original consent didn't include, the row says so and one reconnect enables them. Where no new permission is needed, new abilities simply appear.
• What a connection may do is listed on its page. Open a connection and its Tools card names every call Alchex can make through it, each with the app's own one-line description — the full extent of the access, spelled out. A tool that changes something says so; the app decides which ones only look, and one that does not say is treated as a change. The Send a Slack message step is named at the top of this page and is not on that card, because it is not a call the assistant can make by itself. If you saw this card read "No tools available yet" on a healthy connection made through a vendor's hosted connector service — Salesforce showed this — that was a display fault, not missing access, and it is fixed: reopen the page and the list appears. No reconnect is needed.

If a connection you added recently kept flipping to Needs reconnect within hours — Dropbox and Asana did this, with "Access expired and couldn't be renewed" — that was ours: the short-lived access these vendors issue was not being renewed even though your consent granted the means to renew it. It is fixed; reconnect once and the connection stays connected from then on.

Labels: naming what a connection reads

A connection is the door; a label is a name for one specific thing behind it — a folder of signed policies, a saved list of open incidents, an access-review sheet. A document that cites connected data cites the label, never the underlying file or query. That indirection is the point: when the source moves, you re-aim the label once and everything citing it keeps working, unchanged.

A label carries a code, numbered under the owning team: CON- plus the team code and a number. Labels numbered before September 2026 carry an EVD- code from a counter that has since retired — those are frozen, never re-minted and never rewritten, and they still find their label. The numbering is one sequence per team, so no two of them can ever be handed the same identifier.

A document does not cite a label — it cites the connection. The reference picker's Connectors row lists the connected apps on this page, by name, and a sentence points at one of those. Nothing has to be made first. See Connectors as references.

Labels are no longer created or managed anywhere in Alchex. The one screen that offered it — the reference dialog's Connected systems section — went in August 2026. Labels you already have are untouched and keep working: documents that cite one still resolve it, and nothing you have written has changed. A workflow's read step no longer reads through one (see Connectors as references). What is gone is the ability to make a new one, rename it, re-point it or remove it.

A chip citing a connection carries a dot for whether that app is answering, and clicking it comes back here — see Connectors as references.

Settings continues to own the connection itself: test it, reconnect it, disconnect it, remove it, rename it.

A label belongs to a team

A connection belongs to a person; the labels on it belong to a team. A label is owned by a team, and you are shown only the labels of the teams you can reach: your own teams, and — for a workspace Owner or Admin, who reach every team here as everywhere else — all of them.

This still governs what an existing label will resolve to for a given reader: a label owned by a team outside your reach answers exactly as one that never existed — not found. The two cases are deliberately identical, because an address is never a way to discover that another team's label exists. Labels that already existed were assigned to the team of whoever created them, so nothing lost its home. See Workspaces and teams.

Removing a connection

Remove a connection from its Configure page. Removal deletes the stored credentials immediately. Revoking Alchex's access from the vendor's side (for example, from your identity provider's app list) has the same effect — the next health check flags the connection as needing attention.