Trust

What Soil can see, and what it can do

Soil reads your company's tools so it can warn you before something slips. This page is the whole of what that means: what it reads from each tool, who at your company can see it afterwards, and the 6 tools it can write back to — never without your approval.

Generated from the connectors in this build · 15 tools

Three promises, and what makes each one true

Your own email and calendar are visible only to you.

An email is shown only to the person whose verified Soil login matches the mailbox it was read from. A meeting is shown to whoever's calendar it came from and to the people Google itself lists on it. Admins included — there is no bypass, and the permission check does not look at who is an admin at all.

This is true of Gmail, Google Calendar, Outlook Calendar and Slack, and of no other tool. For the rest, Soil has one workspace-wide login and no way to prove which person at your company may see what — the table below says which is which, tool by tool, rather than leaving you to assume.

Nothing goes out without your tap.

Soil can take 19 kinds of action, 17 of which reach outside Soil. Every one of them is proposed first: you see the exact message, label or change, and approving is what sends it. Proposing sends nothing, approving twice sends once, and what goes out is the payload you approved rather than one recomputed afterwards.

Every action outside Soil needs your approval each time. Automatic execution is available only for internal actions. Optional scheduled notifications stay separate from these sends.

Soil never deletes anything in your tools.

Of those 19 kinds of action, not one deletes. Each adds or moves a single item — a comment, a label, a reviewer, an issue, a draft — and you see which one before it runs.

What Soil reads, tool by tool

Every tool Soil can connect is in this table, because the table is built from the same list the product connects from. 9 of them Soil only reads. 6 it can write to, with your approval.

ToolWhat Soil reads, and what it can doWho can see it
GitHub
Pull requests, reviews, checks, deployments
Reads, and can open or label an issue — never without your approval.
Can write — with your approval
Everyone here, or nobody
Soil cannot prove which person at your company may see this tool: it is connected with one workspace-wide login. So in Team mode everyone here sees it, and in Strict mode — the default for a new workspace — nobody does, admins included. Soil never guesses in between: where it hides something it says how many and why, rather than leaving a silently empty screen.
Worth knowing. GitHub access is all-or-nothing. Soil connects as a classic OAuth App with the "repo" scope, so the connection can reach every repository the person who connected it can reach — GitHub has no per-repository grant. The selection here only limits what Soil syncs, not what the token could read.
Jira
Tickets, status history, owners
Reads your issues, and can comment, reassign or move one — never without your approval.
Can write — with your approval
Everyone here, or nobody
Soil cannot prove which person at your company may see this tool: it is connected with one workspace-wide login. So in Team mode everyone here sees it, and in Strict mode — the default for a new workspace — nobody does, admins included. Soil never guesses in between: where it hides something it says how many and why, rather than leaving a silently empty screen.
Slack
Decisions and promises in channels
Reads the channels you pick, and can post an alert or an approval request — never without your approval.
Can write — with your approval
Only people in that channel
A Slack-sourced fact is shown only to someone Soil has proved is a member of the channel it came from — a linked Slack account, plus Slack's own membership list. A display name that merely looks like yours proves nothing.
Worth knowing. Slack is the one connector the provider itself limits: the bot can only read public channels it has been added to.
Google Drive
Specs, designs, sign-offs
Reads only. Soil never writes anything back to it.
Read-only
Everyone here, or nobody
Soil cannot prove which person at your company may see this tool: it is connected with one workspace-wide login. So in Team mode everyone here sees it, and in Strict mode — the default for a new workspace — nobody does, admins included. Soil never guesses in between: where it hides something it says how many and why, rather than leaving a silently empty screen.
Worth knowing. Google Drive access is all-or-nothing. The "drive.readonly" scope covers the whole Drive of the person who connected it — Google has no folder-level scope. The folder selected here is enforced by Soil's own code, not by the grant.
GitLab
Merge requests, pipelines
Reads your merge requests, and can comment or request a reviewer — never without your approval.
Can write — with your approval
Everyone here, or nobody
Soil cannot prove which person at your company may see this tool: it is connected with one workspace-wide login. So in Team mode everyone here sees it, and in Strict mode — the default for a new workspace — nobody does, admins included. Soil never guesses in between: where it hides something it says how many and why, rather than leaving a silently empty screen.
PagerDuty
Live incidents and who's on call
Reads only. Soil never writes anything back to it.
Read-only
Everyone here, or nobody
Soil cannot prove which person at your company may see this tool: it is connected with one workspace-wide login. So in Team mode everyone here sees it, and in Strict mode — the default for a new workspace — nobody does, admins included. Soil never guesses in between: where it hides something it says how many and why, rather than leaving a silently empty screen.
Google Calendar
Meetings, launches, deadlines
Reads your meetings, and can create, move or cancel one — never without your approval.
Can write — with your approval
Only you and the people on it
A meeting is shown to whoever's calendar it came from, and to the people Google itself lists on it. Admins included — there is no bypass.
Outlook Calendar
Meetings, launches, deadlines
Reads only. Soil never writes anything back to it.
Read-only
Only you and the people on it
A meeting is shown to whoever's calendar it came from, and to the people Google itself lists on it. Admins included — there is no bypass.
Gmail
Decisions and promises over email
Reads for decisions and promises, and can write a DRAFT reply into your own mailbox — it never sends, and never without your approval.
Can write — with your approval
Only you
An email is shown only to the person whose verified Soil login matches the mailbox Soil read it from. Admins included — there is no bypass — and a row with no recorded mailbox owner is hidden from everyone rather than guessed at.
HubSpot
Deals, their dated stage history, customers
Reads only. Soil never writes anything back to it.
Read-only
Admins only
Deals, invoices and customer accounts are admin-only in both permission modes. Where one of those amounts sits on a row a colleague may see, the amount itself is hidden from them rather than the whole row.
Worth knowing. Soil asks HubSpot for companies, deals, deal stage history and owner names, and nothing else. It does NOT ask for contacts, and emphatically not for the bodies of sales emails — Soil needs the gap between touches, not the correspondence. The activity timeline is requested as an optional scope: a portal that cannot grant it still connects, and the reply-gap check is then switched off and says so.
Freshdesk
Support tickets, first-reply and resolution times
Reads only. Soil never writes anything back to it.
Read-only
Everyone here, or nobody
Soil cannot prove which person at your company may see this tool: it is connected with one workspace-wide login. So in Team mode everyone here sees it, and in Strict mode — the default for a new workspace — nobody does, admins included. Soil never guesses in between: where it hides something it says how many and why, rather than leaving a silently empty screen.
Worth knowing. Soil cannot prove a Freshdesk API key is read-only. A key carries its agent's own permissions and Freshdesk has no scope selector, so create a view-only agent and paste that agent's key. Soil's own restraint is structural: its Freshdesk client has no POST, PUT or DELETE path at all. It never reads a conversation, a ticket description or a requester's phone number.
Stripe (invoices)
Invoices issued and paid, in your own Stripe
Reads only. Soil never writes anything back to it.
Read-only
Admins only
Deals, invoices and customer accounts are admin-only in both permission modes. Where one of those amounts sits on a row a colleague may see, the amount itself is hidden from them rather than the whole row.
Worth knowing. A restricted key (rk_live_…) with read permission on Invoices, Customers and Charges is all Soil needs, and the permission set stays visible to you in your own Stripe dashboard. This is a different account and a different key from the one Soil bills your own subscription with — the two never share a key or a code path. A test-mode invoice is never counted as money.
Razorpay
Invoices issued and paid, in your own Razorpay
Reads only. Soil never writes anything back to it.
Read-only
Everyone here
Soil has no per-person rule for this tool yet. What it reads is scoped once, by the admin who connected it, and is visible to your whole workspace — so connect it only if that is what you want.
Worth knowing. Razorpay has no read-only key. The same key_id:key_secret that reads your invoices can also create payouts and refunds — that is Razorpay's design, not Soil's choice, and it is the reason this one is worth a second thought. Soil's mitigations are that its Razorpay client has no write path at all, the key is encrypted at rest and never logged, and a test key (rzp_test_…) is refused at connect time.
AWS Cost
Monthly cloud spend, by service, for Cash leaks' cloud-spike check
Reads only. Soil never writes anything back to it.
Read-only
Everyone here
Soil has no per-person rule for this tool yet. What it reads is scoped once, by the admin who connected it, and is visible to your whole workspace — so connect it only if that is what you want.
Zoom
Scheduled meetings, their times and who hosts them
Reads only. Soil never writes anything back to it.
Read-only
Everyone here, or nobody
Soil cannot prove which person at your company may see this tool: it is connected with one workspace-wide login. So in Team mode everyone here sees it, and in Strict mode — the default for a new workspace — nobody does, admins included. Soil never guesses in between: where it hides something it says how many and why, rather than leaving a silently empty screen.

Taking your data out, and deleting it

Both of these are in Settings → Organization, both are admin-only, and neither needs to go through us.

Export. Your workspace's synced and derived data, as a zip of one JSON file per table — 56 tables. Two columns are stripped and nothing else is: the encrypted connection credentials and your own model key, left out by the exporter itself rather than filtered afterwards. Tables that exist only to hold a secret — login sessions, password-reset and API tokens — are not in it either, and nor is a kept expense upload.

Delete. Deleting the workspace removes the organization and every synced record in it. It is immediate and permanent: there is no 30-day undo in this product, and this page will not promise one. An audit row recording the deletion is written first, in the same transaction.

The audit log. Every action that leaves Soil — who proposed it, who approved it, and what came back — is recorded per workspace. It has no screen of its own yet; today you read it by exporting, where it is one of the 56 tables.

Two more things, said plainly

Soil never ranks or scores individual people. It shows work and where it is stuck. “Who owns the billing service?” is a question it answers; who the better engineer is, it does not.

Instructions found inside your data are never obeyed. Text in an email, a ticket or a document is treated as something to read about, never as something telling Soil what to do.