Customer Platform Integrations — Secure by Default

1. Authenticate with Standards

Connect your identity provider and billing accounts using OAuth 2.0, SAML, or OIDC, and your mailboxes over IMAP/SMTP (native OAuth for Google & Microsoft in development) — the same authentication protocols used by enterprise security teams. No passwords stored in plaintext. IMAP/SMTP credentials are encrypted at rest. Every integration uses the minimum permissions required to function.

2. Data Flows Automatically

Once connected, data moves between systems without manual intervention. Emails become tickets. Bookings become leads. A won deal or a slipping account health score posts to the Slack channel that should hear about it, and fires a signed webhook to whatever you have built. Each integration operates independently — enable only what you need.

3. Monitor & Control

Audit logs record every integration activity across more than 350 tracked event types. Webhook deliveries are logged with their outcome, so you can see exactly what fired and when. Failed connections raise an alert rather than failing silently. You have full visibility into what every integration is doing and when.

Email Providers

• Gmail & Microsoft 365 (via IMAP/SMTP) — Connect Gmail, Outlook, or any provider over standard IMAP/SMTP, where the mailbox allows IMAP/SMTP access. Inbox sync, send, and email-to-ticket ingestion. Credentials encrypted at rest with Rails ActiveRecord encryption.
• Native one-click OAuth (in development) — Passwordless OAuth for Google Workspace and Microsoft 365 is in active development; Microsoft 365 (via Microsoft Graph) is furthest along.
• IMAP/SMTP — Connect any email provider that supports IMAP and SMTP. Credentials are encrypted at rest using Rails ActiveRecord encryption.

Calendar

• Google Calendar — Two-way calendar sync over OAuth 2.0 with least-privilege scopes
• Microsoft 365 Calendar — Calendar sync via Microsoft Graph with least-privilege OAuth scopes
• Booking pages — Public booking pages write straight into the synced calendar, and the booking becomes a lead in the CRM with no middleware to maintain

Website Platforms

The Engage widget works on any website. Drop a single <script> tag (~200 bytes, async, zero dependencies) into your site header or footer and start capturing leads in 30 seconds. No developer required.

• WordPress — Native plugin (v1.3.0) with shortcode embedding, or universal script embed
• Drupal 10+ — Native module, or script embed via block layout
• Squarespace — Script embed via Code Injection settings
• Webflow — Script embed via Project Settings or custom code block
• Ghost — Script embed via Code Injection in Ghost admin
• Wix — Script embed via Velo developer tools or custom element
• Any HTML Site — Paste the script tag into your header or footer; works on static sites, custom frameworks, and any CMS

Slack

• Event routing — Send new leads, new support tickets, won deals, declining account health, and accepted team invitations to the channels that should hear about them
• Multiple destinations — Add and manage any number of channel destinations, choose which events each one receives, and send a test message to confirm delivery
• Automation actions — Automation rules can post to Slack as an action, conditioned on any attribute, tag, or custom field
• Security — Connections use Slack Incoming Webhooks; webhook URLs are stored encrypted at rest

Phone & SMS

• Bring your own provider — Connect your existing Twilio or Telnyx account; EmpireVault never resells telephony
• Buy or claim a number — Search by area code and buy a new number, or claim one you already own on that provider account. Your provider bills the number fee directly.
• Calls and texts — Label the number, forward calls anywhere, and enable SMS; conversations land in the same unified inbox as email and chat
• Missed-call text-back — Automatically text a caller when a call goes unanswered, with quiet hours, a daily cap, and a per-caller rate limit
• A2P 10DLC compliance — Brand registration, campaign approval, and number attachment tracked in-app with live status
• Deliverability — Per-number send counts and failure rates over a rolling window

REST API & API Keys

• Full data access — Contacts, companies, deals, tickets, notes, tasks, and custom fields
• Built for scripting — Bearer API key authentication, cursor pagination, and idempotent creates
• Scoped keys — Admin-issued keys with read_only or read_write scope, created at Platform > Integrations > API keys
• Rotation and revocation — Regenerate swaps the secret immediately; revoke disables a key permanently. The full key is shown once at creation, masked thereafter.
• REST API documentation

Outbound Webhooks

• Signed events — Push platform events to your own systems with signature verification on every delivery
• Automation-driven — Automation rules can call a webhook conditionally, so you send only the events you care about
• Logged — Every run is recorded, so you can see exactly what fired and why
• Retries — Transient failures retry with exponential backoff; unreachable endpoints raise an alert
• Outbound webhooks documentation

Identity & Single Sign-On

• WorkOS AuthKit — Standards-based authentication supporting OAuth 2.0, SAML, and OIDC protocols
• Azure Active Directory — SSO for Microsoft-based organizations via WorkOS SAML federation
• Okta — SAML and OIDC integration for Okta-managed identity environments
• Google Workspace SSO — OIDC-based single sign-on for Google-managed organizations

Billing & Subscriptions

• Stripe Checkout — Hosted payment pages with automatic plan provisioning
• Self-serve changes — Plan upgrades, downgrades, cancellations, and seat add-ons with automatic proration

AI

• Across the platform — Ticket triage and routing, draft replies, thread and lead summarization, translation, and lead scoring
• Data Privacy — No customer data is used for model training. API calls are transactional and data is not retained by OpenAI.

Cloud Storage

• Civo Object Store (S3-Compatible) — Ticket, knowledge base, and upload attachments stored in S3-compatible object storage. Designed for horizontal scaling.

Email Compliance & Tracking

• CAN-SPAM compliance — Automatic List-Unsubscribe headers (RFC 8058 one-click), physical address footer, and bounce suppression
• Engagement tracking — Open, click, and bounce tracking on every campaign, with failed deliveries added to suppression lists automatically

Least-Privilege by Default

Every integration requests only the minimum permissions required. Microsoft 365 calendar uses least-privilege OAuth scopes. API keys you issue are scoped read-only or read-write and can be regenerated or revoked at any time. Outbound webhooks are signed, so your endpoint can verify every delivery came from us. Stripe webhook endpoints verify signatures before processing. We never ask for admin-level access when read-level access will do.

Full Auditability

Every integration action is logged in the EmpireVault audit trail. AI usage is tracked per-call with feature type, token count, and model version. Webhook deliveries are recorded with their outcome. Email operations log send, open, click, and bounce events. Nothing happens in the dark.

No Vendor Lock-In

Email works with any IMAP/SMTP provider — not just Google and Microsoft. Phone and SMS runs on your own Twilio or Telnyx account, so the number stays yours. Storage uses the S3-compatible protocol supported by dozens of cloud providers. Identity supports SAML and OIDC, the universal enterprise SSO standards. And every account includes a full REST API and data export at no charge — if you switch vendors, your data comes with you.