> For the complete documentation index, see [llms.txt](https://docs.kosmoslabs.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kosmoslabs.ai/product-documentation/integration-permissions.md). # Integration Permissions *** Kosmos uses read-only API connections to analyze your data. We never install code in your environment or modify your systems. ### Our Security Approach **Zero-Install Architecture** Kosmos operates entirely outside your infrastructure. We connect via standard OAuth APIs—the same secure method used by thousands of enterprise integrations. **Read-Only Access** We request only the minimum permissions needed to analyze your data. Kosmos cannot create, update, or delete records in your systems. **No Code Deployment** Nothing is installed in your Salesforce org, Jira instance, or GitHub repos. This means: * No security reviews of deployed packages * No impact on your system performance * No maintenance burden on your team *** ### Permissions by Integration #### Salesforce Service Cloud **Setup Required:** Salesforce requires installing our managed package before connecting. See [Connecting Salesforce](/product-documentation/connecting-salesforce.md) for step-by-step instructions. | Permission | Why We Need It | | ------------------ | ---------------------------------------------------- | | Read Cases | Analyze incident and support ticket patterns | | Read Case Comments | Understand resolution context | | Read Case History | Reconstruct incident timelines | | Read Incidents | ITSM correlation (if Service Cloud Incident enabled) | | Read Users | Attribute incidents to teams | **What we DON'T access:** Opportunities, financial data, custom objects (unless mapped), attachments, or files. *** #### Jira | Permission | Why We Need It | | ----------------------- | ----------------------------------------- | | Read Issues | Analyze bugs, incidents, and tasks | | Read Projects | Understand team structure | | Read Comments | Context for root cause analysis | | Write Issues (optional) | Create follow-up tickets from RCA Reports | **What we DON'T access:** Confluence pages, admin settings, user passwords, or billing information. **Note:** Write access is only used when you explicitly click "Create Jira Ticket" from an RCA. Kosmos never creates tickets automatically. *** #### GitHub | Permission | Why We Need It | | ---------------------------- | --------------------------------------------------------------- | | Read Commits | Correlate deployments with incidents | | Read Pull Requests | Identify changes linked to issues | | Read Repositories (metadata) | Understand codebase structure | | Read Branches (metadata) | Detect your default branch to prefill production branch mapping | **What we DON'T access:** Source code contents, secrets, Actions logs, or admin settings. **Production branches:** During setup, after you select repositories, Kosmos asks you to confirm which branches represent production for each repo. The detected default branch (usually `main`) is prefilled, and you can adjust it if your team ships from a differently named branch such as `develop`. This mapping tells Kosmos which deployments reached production. Kosmos uses the strongest signal available for each deployment event: an explicit environment from the GitHub Deployments API if present, otherwise your branch mapping. Getting the mapping right means Risk Events reflect changes that actually reached your customers rather than treating every merge as a production deploy. You can revisit the mapping later from Settings → Integrations → GitHub. *** #### Bitbucket | Permission | Why We Need It | | ---------------------------- | --------------------------------------------------------------- | | Read Commits | Correlate deployments with incidents | | Read Pull Requests | Identify changes linked to issues | | Read Repositories (metadata) | Understand codebase structure | | Read Branches (metadata) | Detect your default branch to prefill production branch mapping | **What we DON'T access:** Source code contents, pipeline secrets, or admin settings. **Production branches:** Bitbucket setup includes the same production branch confirmation step described under GitHub above. For Bitbucket, Kosmos will also use a pipeline deployment step name when one is present, before falling back to your branch mapping. *** #### ServiceNow | Permission | Why We Need It | | -------------------- | -------------------------------- | | Read Incidents | Analyze ITSM incident patterns | | Read Change Requests | Correlate changes with incidents | **What we DON'T access:** CMDB data, knowledge articles, admin settings, or user credentials. **Field Mapping:** After connecting, you can map your custom ServiceNow fields to Kosmos. This ensures RCAs include context from your organization's specific incident data. **Sandbox Support:** You can connect a sandbox instance (dev/test/uat) for evaluation before granting production access. *** #### Zendesk | Permission | Why We Need It | | ------------------ | ------------------------------------------- | | Read Tickets | Analyze support ticket patterns | | Read Custom Fields | Include your organization's ticket metadata | **What we DON'T access:** User passwords, billing information, admin settings, or Guide/Help Center content. *** #### Pylon | Permission | Why We Need It | | ------------------------ | ------------------------------------------------ | | Read Issues | Analyze support issues and tasks | | Read Messages (optional) | Include conversation context for deeper analysis | **Authentication:** Pylon uses API key authentication. You provide your Pylon API key when connecting. **What we DON'T access:** Internal notes marked private, billing data, or admin settings. *** #### Linear | Permission | Why We Need It | | ------------------------ | ------------------------------------------------------- | | Read Issues | Analyze bugs and tasks as incident signals | | Read Issue State | Understand resolution status and workflow stage | | Read Issue Labels | Classify issues by type and priority | | Read Teams | Scope sync to selected teams; understand team structure | | Read Assignees | Attribute issues to team members | | Read Relations | Link related issues for cross-reference correlation | | Read Attachments | Extract linked Jira and GitHub issue keys | | Read Comments (optional) | Include conversation context for deeper analysis | **Authentication:** Linear uses OAuth 2.0. You'll be redirected to Linear to authorize the connection. **What we DON'T access:** Cycles, roadmaps, projects, documents, admin settings, or billing information. **Note:** You can restrict sync to specific teams from Settings → Integrations → Linear after connecting. *** #### Azure DevOps | Permission | Why We Need It | | ---------------------------------- | ---------------------------------------------------------- | | Read Work Items | Analyze bugs, issues, and tasks as incident signals | | Read Work Item Types | Understand item classification across process templates | | Read Work Item Comments (optional) | Include conversation context for deeper analysis | | Read Projects | Scope sync to selected projects; understand team structure | | Read Teams | Attribute work items to teams | **Authentication:** Azure DevOps uses OAuth 2.0 via Microsoft Entra. You'll be redirected to Microsoft to authorize the connection. **What we DON'T access:** Source code, repositories, pipelines, test plans, wiki pages, admin settings, or billing information. **Note:** You can restrict sync to specific projects and work item types from Settings → Integrations → Azure DevOps after connecting. *** #### OpenTelemetry (Preview) **Setup Guide:** See [Connecting OpenTelemetry](/product-documentation/connecting-opentelemetry-preview.md) for step-by-step configuration instructions. Kosmos can ingest OpenTelemetry data to correlate observability signals (traces, logs, metrics) with your incidents and deployments. | Data Type | Why We Need It | | --------- | --------------------------------------- | | Traces | Correlate service errors with incidents | | Logs | Identify error patterns and anomalies | | Metrics | Detect performance degradation | **Authentication:** API key authentication. Generate a unique API key from Settings → Integrations → OpenTelemetry. **Setup:** Configure your OpenTelemetry Collector to export to the Kosmos OTLP endpoint. Example configs provided for Grafana Agent, Datadog Agent, and generic OTLP exporters. **Preview Status:** This integration is in Preview. Core functionality is stable, but we're actively refining the experience based on customer feedback. *** #### Slack / Microsoft Teams (Notifications) | Permission | Why We Need It | | ------------- | --------------------------------------------------------- | | Post Messages | Send Risk Event and RCA alerts to your configured channel | **What we DON'T access:** Message history, user data, private channels, or any channel other than the one you configure. **Note:** Notification integrations are optional. You can use Kosmos without connecting Slack or Teams. Integration health alerts (disconnect and reconnect notifications) are currently sent via Slack only; Teams support for these alerts is not yet available. *** ### Data Handling * **Encryption:** All data encrypted in transit (TLS 1.3) and at rest (AES-256) * **Retention:** Data retained only while your account is active * **Location:** Hosted on Google Cloud Platform (US regions) * **Compliance:** SOC 2 Type 1 report available on request; SOC 2 Type 2 in progress; DPA available upon request ### Revoking Access You can disconnect any integration at any time from Settings → Integrations. Revoking access immediately stops data sync. To request data deletion, contact . ### Questions? If your security team needs additional documentation, we're happy to provide: * Security questionnaire responses * Data Processing Agreement (DPA) * Architecture diagrams Contact your Kosmos team or email . *** **Questions?** Contact | [app.kosmoslabs.ai](https://app.kosmoslabs.ai) © 2026 Kosmos AI Labs, Inc.