Connectors

Platform Coverage Matrix

Authentication Model

PanOps is registered once as an authorized third-party application on each supported platform. Customer administrators grant org-wide OAuth 2.0 consent via their standard admin console — the same flow used to approve any enterprise app integration. No PanOps software is installed in the customer environment.

OAuth tokens are stored in AWS Secrets Manager, encrypted at rest. The token manager handles automatic refresh before expiry; no manual re-authentication is required unless the admin explicitly revokes consent.

OAuth consent flow (per platform, done once):

1. Customer admin opens PanOps onboarding portal
2. Clicks "Connect [Platform]" → redirected to platform OAuth screen
3. Admin grants org-wide permission scope (read messages, read recordings, etc.)
4. Platform issues refresh token → stored in Secrets Manager (customer-scoped)
5. PanOps connector begins polling / listening for webhooks

Token refresh:
- Access tokens refreshed automatically 5 minutes before expiry
- Refresh token rotation handled per-platform per OAuth spec
- Token revocation by admin immediately terminates connector access

Email Connectors

Microsoft 365 — Graph API

The M365 connector uses the Microsoft Graph API /v1.0/users/{userId}/mailFolders/inbox/messages endpoint with delta query support. Each poll fetches only messages changed since the last sync using a delta token stored in DynamoDB. Backfill on first sync retrieves 30 days of history (configurable).

Gmail — Gmail API

The Gmail connector uses the Gmail API users.messages.list with historyId-based delta sync. Each customer user's historyId is tracked in DynamoDB; only messages newer than the stored historyId are fetched on each poll.

Messaging & Video Connectors

Slack

Slack connector uses the Slack Events API and Conversations API. Public and private channels are polled via conversations.history with cursor-based pagination. Direct messages are included for customers on Slack Enterprise Grid. Cursor positions are stored in DynamoDB. The Slack app must be approved by the workspace admin; PanOps uses bot token scopes and does not require user token scopes.

Microsoft Teams — Channels + Video

Teams channel messages are retrieved via Microsoft Graph API /teams/{teamId}/channels/{channelId}/messages/delta. Video recordings are automatically saved to the meeting organizer's OneDrive via Teams recording policy; PanOps downloads via Graph API /drives/{driveId}/items/{itemId}/content when the recording is available, then queues it for Whisper transcription.

Zoom Meetings — Video

Zoom recordings are captured via webhook. When a cloud recording is completed, Zoom pushes a recording.completed webhook event to the PanOps endpoint. The webhook payload includes download URLs with temporary auth tokens. PanOps downloads the recording to customer S3 and queues it for transcription. Cloud recording must be enabled at the Zoom account level.

Video recording data flow:

[Teams / Zoom / Google Meet recording complete]
         ↓
[Webhook or polling detects new recording]
         ↓
[PanOps downloads to customer S3]
  s3://customer-bucket/recordings/{platform}/{meeting-id}/{timestamp}.mp4
         ↓
[S3 event → SQS transcription queue]
         ↓
[Whisper worker picks up job, transcribes]
         ↓
[Transcript written to Aurora (RLS-scoped to customer)]

SMS & Voice Connectors

SMS and voice platforms use webhook-based real-time push rather than polling. When an SMS is sent/received or a call recording is completed, the platform pushes an event to PanOps's HTTPS webhook endpoint. This delivers data in near-real-time with no polling latency.

Connector Framework

All connectors share a common framework that handles auth, scheduling, state management, error handling, and database writes.

Employee Enrollment & Consent

Employee participation is consent-driven. PanOps generates a unique mobile-optimized web consent page per employee. The enrollment link is sent by the customer admin (typically via email or Slack). On the page, the employee confirms their identity (email as primary key, display name as secondary), reviews the channels being monitored, and provides explicit consent.

• Consent is recorded per employee per channel in Aurora (tamper-proof log)
• Employees can revoke consent at any time via a link in their enrollment page
• Identity discrepancies (name mismatches across platforms) are resolved at enrollment
• Enrollment status visible in Admin panel per employee × channel matrix
• Admin can re-send enrollment link, add employees, or remove employees at any time