What Management OS does with your Common Room data.

Management OS reads community signal data from your Common Room workspace via two surfaces: signed inbound webhooks that push events to our endpoint, and the Common Room API for member and segment enrichment. Specifically: signal event payloads (event type, member, activity, workspace context), member records (email, name, company, segment membership), and segment definitions. We do not access private member messages, billing data, integration credentials Common Room holds for other platforms, or any Common Room data not explicitly listed below.

Why: Community signals are leading indicators that CRM data lags by weeks or quarters — champion job changes, detractor sentiment, ICP-fit intent, ecosystem engagement spikes. Management OS reads those signals so the Brief surfaces relationship triggers and retention risks while there's still time to act.

We do not write to your Common Room workspace. Management OS is a read-only consumer of your Common Room data. We do not create, modify, or delete any Common Room records — no members, no segments, no activities, no tags, no notes, no integration configurations.

All Management OS outputs (Weekly Briefs, Customer Success digests, Account Plan updates) are generated and stored in Management OS's own database and surfaced through the Management OS application — not pushed back into your Common Room workspace.

Common Room uses a per-workspace API key (Bearer) for outbound API calls plus an HMAC-SHA256 webhook secret for inbound signal events. The key inherits workspace permissions. Management OS uses both only for the read operations below; nothing else.

Permissions we use

When you configure the webhook in Common Room, point it at the Management OS webhook endpoint and store the same webhook secret on both sides. Every inbound event is signature-verified before any data is written.

When you generate the Common Room API key, scope it to read-only if your plan exposes that toggle. Management OS does not need write permissions for any feature.

Application database: Supabase Postgres (Management OS's production database, US East). Encrypted at rest (AES-256), encrypted in transit (TLS 1.3). Workspace-scoped row-level security (RLS) means one customer's data is never visible to another.

API key + webhook secret: Stored in the same Supabase database under workspace-scoped RLS. Both are encrypted at rest and never returned to client browsers. Only the Management OS server-side runtime has access via service-role credentials.

Inference layer: Anthropic API (Claude models). Signal payloads required for a specific brief generation are passed to Anthropic; outputs are returned to Management OS and stored in our database. Anthropic does not train on customer data per their API terms.

Retention: We retain Common Room-sourced signal data while your subscription is active. On disconnect we delete the API key and webhook secret immediately. On subscription cancellation, customer data is retained for 30 days for restoration, then permanently deleted. Data subject deletion requests are honored within 30 days per our Privacy Policy.

1. Sign in to Common Room at app.commonroom.io
2. Open Settings → API (or Integrations → API, depending on plan)
3. Click Create New Key, name it "Management OS", select read-only scopes, and copy the key
4. In Management OS, open Settings → Integrations and find Common Room in the integration directory
5. Click Connect Common Room, paste the API key. Management OS generates a webhook secret and displays the webhook URL to register on the Common Room side
6. Back in Common Room, register the webhook URL Management OS displayed, paste the webhook secret, and select the signal events you want forwarded (member.activity, segment.matched, sentiment.detector, intent, job changes)
7. Signal flow starts immediately. Test by triggering a qualifying signal in Common Room and verifying it lands in your Management OS signals layer within seconds

If you administer Common Room on behalf of a team: The API key is workspace-scoped, so a single key serves the whole team. Generate it under an account with workspace admin permissions.

Common Room signals feed the Weekly Intelligence Brief across all three pillars, with a particular weight on the Business pillar:

• Develop Your Business — champion-leaving alerts (job-change signals on key contacts), detractor-sentiment surfacing for CS, intent signals routed to the right AE, ecosystem-engagement spikes at the account level. Each signal carries recommended-action and human-owner so the Brief is directly executable
• Develop Your Team — coaching signals when a rep is missing follow-up on clear community-side intent, or when a CS rep is not engaging with a detractor segment that should be managed
• Develop Yourself — leader-side awareness of relationship triggers (advisor moves, key champion job changes, board-member signals) that warrant a personal note rather than rep delegation

Ask Anything (AMA) — query Common Room signals in plain English. Examples: "Which champions changed jobs in the last 30 days?", "Show me detractor signals on accounts up for renewal in Q3", "Who in our community matches our ICP and has shown intent recently?"

1. Open Management OS → Settings → Integrations
2. Find Common Room in the connected integrations list
3. Click Disconnect → confirm

On disconnect we immediately delete the stored API key and webhook secret and stop processing any new inbound signals (any further webhook deliveries fail signature verification because the secret is gone). Previously synthesized briefs and signals remain in your Management OS workspace as historical records — they are not deleted automatically because they may contain decisions and context the leader still references.

To remove all historical briefs and data after disconnect, email privacy@mgmt-os.ai with your workspace identifier. We process deletion requests within 30 days.

1. Sign in to Common Room at app.commonroom.io
2. Open Settings → API and revoke the API key issued to Management OS
3. Open Settings → Webhooks (or Integrations) and delete the Management OS webhook subscription

Revoking the API key from Common Room's side invalidates outbound enrichment calls immediately; deleting the webhook subscription stops inbound signal delivery. Management OS surfaces a re-connection prompt in Settings when either pathway starts failing.

Security incident reporting: security@mgmt-os.ai
Privacy / data subject requests: privacy@mgmt-os.ai
Integration support: support@mgmt-os.ai

For general questions about Management OS, see our Support page or Manifesto.