Integration Security
Aventora integrates with third-party providers for telephony, AI inference, identity, calendar, CRM, and infrastructure services. This document describes security controls applied to external integrations.
For the current subprocessor list, see the Subprocessor Annex. For API integration requirements, see the API Security Policy.
Integrated services
| Category | Providers (configurable per deployment) |
|---|---|
| Telephony / messaging | Configured telephony and messaging providers |
| AI inference | OpenAI, Groq |
| Identity / calendar | Microsoft Graph, Google OAuth |
| CRM | Salesforce, Follow Up Boss, and additional connectors |
| Infrastructure | Amazon Web Services (AWS) |
| SMTP providers, Gmail IMAP (where configured) |
Subprocessors are engaged only as needed for enabled features. Customers evaluate enabled integrations as part of their vendor risk program.
Security controls
| Control | Application |
|---|---|
| HTTPS transport | All third-party API communication uses encrypted channels |
| Least-privilege credentials | Provider API keys and OAuth scopes limited to required capabilities |
| Webhook signature validation | Inbound provider webhooks validated cryptographically where supported |
| Credential protection | Integration secrets stored in environment configuration or application databases — not in source code |
| Vendor evaluation | New integrations require Engineering Leadership approval before production use; Personal Data vendors require completed due-diligence and contract-review checklists per the Vendor Management Policy |
| Contractual protections | Subprocessor agreements include the Standard Vendor and Subprocessor Contractual Requirements (confidentiality, security, purpose limitation, no unauthorized re-identification, Further Subprocessor authorization, data subject rights assistance, international transfer controls, deletion, and breach notification) |
AI provider handling
When AI features are enabled, conversation content is sent to configured providers only during active sessions and only as necessary for the customer-configured function. Customer data is not used to train general-purpose AI models unless explicitly agreed in writing.
Customers should review enabled AI features and provider terms as part of their privacy assessment. See Engagement Hub Features — AI and Customer Data.
Resilience
Aventora designs integrations with operational resilience in mind:
- Timeout and retry behavior for external API calls
- Error handling and logging for provider failures
- Health monitoring for critical integration paths
- Configurable provider selection per deployment (telephony, AI)
Provider outages may affect features that depend on that provider. Customers with strict availability requirements should discuss deployment architecture with their Aventora account team.
Customer-enabled integrations
Customers may configure additional third-party integrations (CRM systems, calendar providers, custom webhooks). Data disclosed to those providers is directed by customer configuration. Customers remain responsible for their relationship with customer-selected third parties.
Related documentation
Changelog
| Date | Change |
|---|---|
| 2026-07-20 | Linked Vendor Management Policy; clarified contractual protections for Personal Data vendors. |
| 2026-07-06 | Initial publication of integration security overview. |