1. How do permissions work between OAuth scopes and individual accounts?
When a user connects an integration (e.g., Microsoft 365, Google Workspace, Salesforce) to Caddi:
Scopes define the maximum possible access. These are the permissions granted when the integration is authorized.
User accounts limit access further. Caddi can only access the data and actions that the specific user’s account has permission for inside the target system.
Example: If a user authorizes with the Mail.Read scope but only has access to their personal mailbox (not a shared one), Caddi can’t see or act on the shared mailbox.
This means users only get the access they personally have, bounded by the scopes IT/admins approve.
2. What’s the difference between Standard and Custom Enterprise Connectors?
Standard Connectors
Pre-built by Caddi with fixed scopes and supported workflows.
Fastest to deploy—just grant consent.
Great for pilots, SMBs, or when IT doesn’t need to fine-tune access.
Custom Enterprise Connectors
Customer-managed Entra ID or equivalent OAuth application.
IT decides which Graph/API scopes to grant (can reduce to least-privilege).
Supports applying internal governance: Conditional Access, consent policies, periodic reviews.
Best for regulated or large enterprises needing tighter control and have the IT bandwidth to continually update permissions as needed.
3. Can IT limit who can access integrations?
Yes, for applications that support it. For example, with Microsoft Graph, IT can:
Require user assignment to the Enterprise Application and assign only approved users/groups.
Apply Conditional Access policies (MFA, device compliance, network location).
Revoke tokens or disable the app at any time.
4. Who owns the data accessed through integrations?
Caddi processes customer data only as directed by the customer and subject to our security commitments (encryption, access controls, monitoring) . Your organization retains ownership and control of the underlying data.
5. How does Caddi secure integration credentials
OAuth tokens are stored encrypted at rest using AWS KMS.
Tokens are scoped to the minimum requested access.
Access is continuously monitored, and tokens can be revoked by the customer at any time.
Caddi undergoes SOC 2 audits covering logical access, change management, and incident response .
6. What happens if an employee leaves the company?
When a user’s account is de-provisioned in the identity provider (e.g., Entra ID, Google Workspace), their integration tokens immediately stop working. IT can also revoke tokens manually at any time.
7. Should we start with Standard or Custom connectors?
Start with Standard connectors for speed of adoption and to validate use cases.
Migrate to Custom connectors if your security team requires scope minimization, custom app registrations, or tighter governance.