What Management OS does with your Keap data.

Management OS reads CRM data from your Keap account — specifically: Contacts, Companies, Opportunities, Orders, Subscriptions, and Tasks. We do not access Keap Campaigns (marketing automation sequences), Email Broadcasts, Landing Pages, Files, or any Keap data outside the CRM surface listed above.

Why: Management OS is the leadership execution layer above the revenue stack. We synthesize CRM data into a Weekly Intelligence Brief that develops the leader, their team, and their business. Keap's small-business motion blends CRM and commerce, so we read both the opportunity pipeline and the recurring-revenue (Orders + Subscriptions) surface to produce honest forecasts.

We do not write to your Keap account. Management OS is a read-only consumer of your Keap data. We do not create, modify, or delete any Keap records — no Contacts, no Opportunities, no Orders, no Subscriptions, no Tasks, no Notes, no Campaign triggers, no tags.

Important note on scope: Keap's OAuth implementation exposes a single full scope — there is no narrower read-only scope option. The read-only posture is enforced inside Management OS source code: we only invoke GET endpoints, never POST / PUT / PATCH / DELETE. We can produce code-level verification on request for compliance review.

All Management OS outputs (Account Plans, Coaching Briefs, Forecast Locks, Meeting Prep dossiers, Pitch Decks) are generated and stored in Management OS's own database and surfaced through the Management OS application — not pushed back into your Keap account.

Required scope (1)

Keap exposes a single OAuth scope. Without it, the integration cannot read any CRM data.

User-level granularity: The practical limit on what Management OS can read is the connecting Keap user's role and permissions. If you want to further limit what Management OS can see, create a dedicated Keap user for the integration with a role scoped to the records you want exposed.

Application database: Supabase Postgres (Management OS's production database, US East). Encrypted at rest (AES-256), encrypted in transit (TLS 1.3). Workspace-scoped row-level security (RLS) means one customer's data is never visible to another.

OAuth tokens: Stored in the same Supabase database under workspace-scoped RLS. Access tokens and refresh tokens are encrypted at rest and never returned to client browsers. Only the Management OS server-side runtime has access via service-role credentials.

Inference layer: Anthropic API (Claude models). CRM data required for a specific brief generation is passed to Anthropic; outputs are returned to Management OS and stored in our database. Anthropic does not train on customer data per their API terms.

Retention: We retain Keap-sourced data while your subscription is active. On disconnect we delete OAuth tokens immediately. On subscription cancellation, customer data is retained for 30 days for restoration, then permanently deleted. Data subject deletion requests are honored within 30 days per our Privacy Policy.

1. Sign up at mgmt-os.ai and complete onboarding to your workspace
2. Open Management OS → Settings → Integrations
3. Find Keap in the integration directory and click Connect Keap
4. You'll be redirected to Keap's authorization screen (accounts.infusionsoft.com). Sign in with the Keap account you want Management OS to read from
5. Review the requested scope and click Allow
6. You'll return to Management OS with a confirmation that the integration is connected. The initial CRM sync starts immediately and typically completes within 2-5 minutes

The Weekly Intelligence Brief is the primary surface. Three pillars synthesize your Keap data:

• Develop Your Business — opportunity scoring (every open Opportunity scored against the Opportunity OS rubric), forecast accuracy across Opportunities + Orders + Subscriptions, account plans, renewal cascade
• Develop Your Team — coaching priorities mapped to specific reps and opportunities, rep-effectiveness rankings, 1:1 prep, GROW conversation planners
• Develop Yourself — leader focus, calendar audit, ninety-day competency focus, decision deadlines you're sitting on

Ask Anything (AMA) — a conversational surface where you can query your Keap data in plain English. Examples: "Which Opportunities have stalled in the last 30 days?", "What's my recurring revenue against last quarter?", "Show me Contacts with an open Opportunity and no Task scheduled."

1. Open Management OS → Settings → Integrations
2. Find Keap in the connected integrations list
3. Click Disconnect → confirm

On disconnect we immediately delete the stored OAuth tokens and stop reading any new CRM data. Previously synthesized briefs remain in your Management OS workspace as historical records — they are not deleted automatically because they may contain decisions and context the leader still references.

To remove all historical briefs and data after disconnect, email privacy@mgmt-os.ai with your workspace identifier. We process deletion requests within 30 days.

1. Sign in to Keap as the user who authorized the connection
2. Click your avatar → My Profile → Integrations
3. Find Management OS in the authorized applications list
4. Click Revoke

Revoking from Keap's side invalidates our access and refresh tokens immediately. Our next API call returns 401 and we surface a re-connection prompt in Management OS Settings.

Security incident reporting: security@mgmt-os.ai
Privacy / data subject requests: privacy@mgmt-os.ai
Integration support: support@mgmt-os.ai

For general questions about Management OS, see our Support page or Manifesto.