Integration Permissions
How Kosmos connects to your systems securely
Kosmos uses read-only API connections to analyze your data. We never install code in your environment or modify your systems.
Our Security Approach
Zero-Install Architecture Kosmos operates entirely outside your infrastructure. We connect via standard OAuth APIs—the same secure method used by thousands of enterprise integrations.
Read-Only Access We request only the minimum permissions needed to analyze your data. Kosmos cannot create, update, or delete records in your systems.
No Code Deployment Nothing is installed in your Salesforce org, Jira instance, or GitHub repos. This means:
No security reviews of deployed packages
No impact on your system performance
No maintenance burden on your team
Permissions by Integration
Salesforce Service Cloud
Setup Required: Salesforce requires installing our managed package before connecting. See Connecting Salesforce for step-by-step instructions.
Read Cases
Analyze incident and support ticket patterns
Read Case Comments
Understand resolution context
Read Case History
Reconstruct incident timelines
Read Incidents
ITSM correlation (if Service Cloud Incident enabled)
Read Users
Attribute incidents to teams
What we DON'T access: Opportunities, financial data, custom objects (unless mapped), attachments, or files.
Jira
Read Issues
Analyze bugs, incidents, and tasks
Read Projects
Understand team structure
Read Comments
Context for root cause analysis
Write Issues (optional)
Create follow-up tickets from RCA Reports
What we DON'T access: Confluence pages, admin settings, user passwords, or billing information.
Note: Write access is only used when you explicitly click "Create Jira Ticket" from an RCA. Kosmos never creates tickets automatically.
GitHub
Read Commits
Correlate deployments with incidents
Read Pull Requests
Identify changes linked to issues
Read Repositories (metadata)
Understand codebase structure
Read Branches (metadata)
Detect your default branch to prefill production branch mapping
What we DON'T access: Source code contents, secrets, Actions logs, or admin settings.
Production branches: During setup, after you select repositories, Kosmos asks you to confirm which branches represent production for each repo. The detected default branch (usually main) is prefilled, and you can adjust it if your team ships from a differently named branch such as develop.
This mapping tells Kosmos which deployments reached production. Kosmos uses the strongest signal available for each deployment event: an explicit environment from the GitHub Deployments API if present, otherwise your branch mapping. Getting the mapping right means Risk Events reflect changes that actually reached your customers rather than treating every merge as a production deploy.
You can revisit the mapping later from Settings → Integrations → GitHub.
Bitbucket
Read Commits
Correlate deployments with incidents
Read Pull Requests
Identify changes linked to issues
Read Repositories (metadata)
Understand codebase structure
Read Branches (metadata)
Detect your default branch to prefill production branch mapping
What we DON'T access: Source code contents, pipeline secrets, or admin settings.
Production branches: Bitbucket setup includes the same production branch confirmation step described under GitHub above. For Bitbucket, Kosmos will also use a pipeline deployment step name when one is present, before falling back to your branch mapping.
ServiceNow
Read Incidents
Analyze ITSM incident patterns
Read Change Requests
Correlate changes with incidents
What we DON'T access: CMDB data, knowledge articles, admin settings, or user credentials.
Field Mapping: After connecting, you can map your custom ServiceNow fields to Kosmos. This ensures RCAs include context from your organization's specific incident data.
Sandbox Support: You can connect a sandbox instance (dev/test/uat) for evaluation before granting production access.
Zendesk
Read Tickets
Analyze support ticket patterns
Read Custom Fields
Include your organization's ticket metadata
What we DON'T access: User passwords, billing information, admin settings, or Guide/Help Center content.
Pylon
Read Issues
Analyze support issues and tasks
Read Messages (optional)
Include conversation context for deeper analysis
Authentication: Pylon uses API key authentication. You provide your Pylon API key when connecting.
What we DON'T access: Internal notes marked private, billing data, or admin settings.
Linear
Read Issues
Analyze bugs and tasks as incident signals
Read Issue State
Understand resolution status and workflow stage
Read Issue Labels
Classify issues by type and priority
Read Teams
Scope sync to selected teams; understand team structure
Read Assignees
Attribute issues to team members
Read Relations
Link related issues for cross-reference correlation
Read Attachments
Extract linked Jira and GitHub issue keys
Read Comments (optional)
Include conversation context for deeper analysis
Authentication: Linear uses OAuth 2.0. You'll be redirected to Linear to authorize the connection.
What we DON'T access: Cycles, roadmaps, projects, documents, admin settings, or billing information.
Note: You can restrict sync to specific teams from Settings → Integrations → Linear after connecting.
Azure DevOps
Read Work Items
Analyze bugs, issues, and tasks as incident signals
Read Work Item Types
Understand item classification across process templates
Read Work Item Comments (optional)
Include conversation context for deeper analysis
Read Projects
Scope sync to selected projects; understand team structure
Read Teams
Attribute work items to teams
Authentication: Azure DevOps uses OAuth 2.0 via Microsoft Entra. You'll be redirected to Microsoft to authorize the connection.
What we DON'T access: Source code, repositories, pipelines, test plans, wiki pages, admin settings, or billing information.
Note: You can restrict sync to specific projects and work item types from Settings → Integrations → Azure DevOps after connecting.
OpenTelemetry (Preview)
Setup Guide: See Connecting OpenTelemetry for step-by-step configuration instructions.
Kosmos can ingest OpenTelemetry data to correlate observability signals (traces, logs, metrics) with your incidents and deployments.
Traces
Correlate service errors with incidents
Logs
Identify error patterns and anomalies
Metrics
Detect performance degradation
Authentication: API key authentication. Generate a unique API key from Settings → Integrations → OpenTelemetry.
Setup: Configure your OpenTelemetry Collector to export to the Kosmos OTLP endpoint. Example configs provided for Grafana Agent, Datadog Agent, and generic OTLP exporters.
Preview Status: This integration is in Preview. Core functionality is stable, but we're actively refining the experience based on customer feedback.
Slack / Microsoft Teams (Notifications)
Post Messages
Send Risk Event and RCA alerts to your configured channel
What we DON'T access: Message history, user data, private channels, or any channel other than the one you configure.
Note: Notification integrations are optional. You can use Kosmos without connecting Slack or Teams. Integration health alerts (disconnect and reconnect notifications) are currently sent via Slack only; Teams support for these alerts is not yet available.
Data Handling
Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
Retention: Data retained only while your account is active
Location: Hosted on Google Cloud Platform (US regions)
Compliance: SOC 2 Type 1 report available on request; SOC 2 Type 2 in progress; DPA available upon request
Revoking Access
You can disconnect any integration at any time from Settings → Integrations. Revoking access immediately stops data sync. To request data deletion, contact support@kosmoslabs.ai.
Questions?
If your security team needs additional documentation, we're happy to provide:
Security questionnaire responses
Data Processing Agreement (DPA)
Architecture diagrams
Contact your Kosmos team or email security@kosmoslabs.ai.
Questions? Contact support@kosmoslabs.ai | app.kosmoslabs.ai
© 2026 Kosmos AI Labs, Inc.
Last updated
Was this helpful?