1. How do permissions work between OAuth scopes and individual accounts?
When someone connects an integration (Microsoft 365, Google Workspace, Salesforce, and so on) to Caddi, two limits apply at once:
Scopes define the maximum possible access. These are the permissions granted when the integration is authorized.
The user's own account limits it further. Caddi can only reach the data and actions that person already has permission for inside the target system.
For example: if a user authorizes with the Mail.Read scope but only has access to their own mailbox and not a shared one, Caddi cannot see or act on the shared mailbox.
In short: each person gets only the access they personally have, bounded by the scopes IT approves.
2. What's the difference between standard and advanced connectors?
Standard connectors
Run on an OAuth client Caddi owns and maintains, with fixed scopes.
No configuration is required by your IT team. Users grant consent and connect.
Suitable where IT does not need to adjust access on a per-tool basis.
Advanced connectors
Run on an OAuth client, service account, or API key your organization owns — your Entra ID app registration, your Salesforce connected app, and so on.
Your IT decides which scopes to grant, and can reduce them to least privilege.
Your own governance applies: Conditional Access, consent policies, periodic access reviews.
An administrator configures the client once for the firm; other users then connect without further configuration.
The following connectors are advanced only and require a client your organization owns: iManage Work, NetDocuments, Laserfiche, Salesforce, Elite 3E and Relativity. Advanced connectors are included on some plans only. If a connector shows Not on your plan, contact your Caddi account team.
Some plans also allow more than one connection to the same tool — one per office, practice group, or entity, or a sandbox alongside production, each with its own credentials.
3. Can IT limit who can access integrations?
Yes, in two places: in Caddi, and in the tool's own identity controls.
In Caddi. Go to Settings > Integrations, open a connection, and use Who can use this connection:
Everyone in the organization.
Only certain teams and people. Add any mix of teams and individuals. Teams stay in sync as members join and leave them. This option is available on Enterprise plans.
No one — turn it off. Credentials and run history are kept, and every new run is blocked.
A loop can only use a connection its owner is permitted to use. A change applies from the next run onward and does not stop a run already in progress.
This setting controls who may connect and who may run loops through the connection. It does not change what the connected account can do inside the target system, which is determined by the granted scopes and by that person's own permissions — see question 1.
In the tool's own identity controls, for applications that support them. With Microsoft Graph, for example, IT can:
Require user assignment on the Enterprise Application, and assign only approved users or groups.
Apply Conditional Access policies — MFA, device compliance, network location.
Revoke tokens or disable the application at any time.
4. Who owns the data accessed through integrations?
You do. Caddi processes customer data only as directed by the customer and subject to the commitments in your agreement with Caddi. Your organization retains ownership and control of the underlying data.
5. How does Caddi secure integration credentials?
Protected in storage. For how Caddi protects integration credentials, see the Trust Center.
Least privilege. Tokens are scoped to the access actually requested, and with an advanced connector your IT sets that ceiling.
Revocable at any time. A user can disconnect their own connection in Caddi, and your IT can revoke tokens or disable the app upstream.
Documented. Caddi's security and compliance documentation — and the route to a Data Processing Agreement or a completed security questionnaire — is in the Trust Center, or through your Caddi account team.
6. What happens if an employee leaves the company?
When their account is de-provisioned in your identity provider — Entra ID, Google Workspace — the tokens behind their Caddi connections stop working, because those tokens represent that person's access. Your IT can also revoke tokens manually at any time.
7. Should we start with standard or advanced connectors?
Where a standard connector exists, start there. It requires no configuration by your IT team.
Move to advanced when your security team requires scope minimization, your own app registration, or tighter governance.
Plan the app registration into your rollout where a connector is advanced only. The list is in question 2.