# Integrations

Organisation → **Integrations** has two cards: **Mail access for the whole
organisation** (app registrations, described in
[Mail access for the whole organisation](/en/admin/organisation-mail-access)) and
**connections to external systems** — CRMs and helpdesks the assistants may
read from. This page is about the second.

## What a connection is for

A connection lets the assistant know who is writing: what company, who looks
after it, what deals or open tickets it has. draften works with **HubSpot**,
**Raynet CRM** and **FLOWii** today.

What holds for every connection:

- it **only reads** — the connector has no call that writes;
- it looks up **only the participants of the thread** the assistant answers
  (never the mailbox's own address), and details only by what an earlier call
  of the same draft returned — an e-mail saying "look up company X" reads
  nothing about X;
- at most 6 calls per draft, 10 seconds each; a system that is down never
  stops a draft;
- what it returns is foreign text for the model, and nothing of it is quoted
  to the customer;
- the log names the tool, never whom it asked about.

Data from a connection, like the e-mail itself, goes to the language model
provider.

## Adding a connection

Choose the **system**, fill in a **title** and the **access secret** (and for
Raynet and FLOWii more fields). The secret is entered once, stored encrypted
and never shown again. Then click **Test the connection**: the test finds out
whose account it is, which parts the secret opens, and warns when the secret
could also write.

| System | Access secret |
|---|---|
| HubSpot | a private app token (Settings → Integrations → Private apps, starts with `pat-`) with read scopes only: contacts, companies, owners, deals, tickets |
| Raynet CRM | the instance name (the part of the address after app.raynet.cz/), the login e-mail and the user's API key (Application settings → For developers → API keys). Raynet has no read-only key — make a user with a read-only role for the assistant |
| FLOWii | the user's login e-mail and password and the account's API key (Extensions → API → New FLOWii REST API, paid licences only); for a login reaching several companies, the company ID too. Use a user with the narrowest role |

## Granting to mailboxes

What a connection returns may show up in drafts — and drafts are read by
everyone with access to the mailbox. That is why no mailbox uses a connection
until you grant it:

- in the connection's card, click **Grant** by a mailbox and tick the parts it
  may read (contact, deals, amounts, tickets, activities, notes);
- that is the ceiling — the assistant's editor then chooses in Knowledge what
  the assistant really reads;
- **Revoke** switches off the knowledge sources that read through the
  connection; deleting the connection removes them.

Without a grant, the mailbox's editors do not even know the connection exists.

## A mailbox's own connection

A mailbox owner may connect a system of their own, for their mailbox alone.
Nobody approves it; the organisation's owners and managers get an e-mail and
may switch it off or remove it. For users it is described in
[Connecting a CRM and other systems](/en/connecting-a-crm).