Integrations

Integrations have separate authorization and verification boundaries. Source configuration is not proof an external provider is receiving or delivering traffic.

• Supabase: auth, database/RLS, storage, realtime, and Edge Functions.
• Vercel: static SPA deployment and previews.
• Wix: webhook/cutover integration; verify signed request handling through approved evidence.
• HubSpot: browser integration/export-related workflows; inspect scope before sharing data.
• Resend: delivery and webhook handling; diagnose read-only unless a specific send is authorized.
• PostHog and AI: analytics/AI features require privacy-aware review; do not put sensitive participant content into prompts or event properties.

Credentials, webhook secrets, endpoints with capabilities, and provider-console recovery steps do not belong in this site.

Purpose and ownership

Identify the owner and verification boundary before changing an integration. Engineering owns implementation/security; Product owns scope; Communications/Sponsor Success approve data sharing. A source import or configured environment variable is not evidence the provider is active.

Change procedure

1. Name the integration, data direction, records involved, and target environment.
2. Trace the boundary in the integration’s user-facing surface first: HubSpot in the browser workflow, Wix and Resend in their provider delivery logs, and Supabase/Vercel in the approved runtime consoles. Use the code references in this page’s metadata only for engineering traceability.
3. Confirm least-privilege authorization, inbound signature/auth validation, data minimization, and rollback before edits.
4. Validate with synthetic/approved test data in non-production where possible.
5. Obtain explicit authority for provider-console work, production configuration, data export, or messages. Record provider evidence separately from deployment.

Failure and escalation

For a failed webhook, preserve timestamp, provider event ID if authorized, and sanitized response; never copy a signature/secret. Unexpected data flow or recipient is an incident. Provider dashboards have blind spots—report them rather than declaring no activity.