What Management OS does with your Salesforce data.

Management OS reads CRM data from your Salesforce org — specifically: Accounts, Contacts, Opportunities, Leads, Tasks, Events, and any custom objects the connecting user can already see. Access is gated by that user's Salesforce profile, permission sets, and sharing rules. We do not access Chatter feeds, Marketing Cloud assets, Service Cloud cases, Commerce Cloud orders, Experience Cloud content, files, or any object the connecting user cannot read.

Per-instance: Salesforce returns an instance_url at token exchange (e.g. https://acme.my.salesforce.com). All REST and SOQL calls target only that instance — we never read across orgs.

Why: Management OS is the leadership execution layer above the revenue stack. We synthesize CRM data into a Weekly Intelligence Brief that develops the leader, their team, and their business. We can't synthesize what we can't read.

We do not write to your Salesforce org. Management OS is a read-only consumer of your Salesforce data. We do not create, modify, or delete any Salesforce records — no Accounts, no Contacts, no Opportunities, no Leads, no Tasks, no Events, no Notes, no custom objects, no flow triggers.

All Management OS outputs (Account Plans, Coaching Briefs, Forecast Locks, Meeting Prep dossiers, Pitch Decks) are generated and stored in Management OS's own database and surfaced through the Management OS application — not pushed back into your Salesforce org.

Every scope below maps to a specific feature. We requested the minimum scope set needed to deliver the Management OS feature surface; we did not request scopes that we don't currently use.

Required scopes (3)

These scopes are requested on every connection. Without them, the core Management OS feature surface does not function.

Object-level granularity: Unlike HubSpot (which exposes one scope per object type), Salesforce's api scope is a single grant covering all readable objects. The practical limit on what Management OS can read is the connecting user's Salesforce profile and permission sets — not the OAuth scope set. If you want to further limit what Management OS can see, create a dedicated Salesforce user for the integration with a profile scoped to the exact objects and fields you want exposed.

Application database: Supabase Postgres (Management OS's production database, US East). Encrypted at rest (AES-256), encrypted in transit (TLS 1.3). Workspace-scoped row-level security (RLS) means one customer's data is never visible to another.

OAuth tokens: Stored in the same Supabase database under workspace-scoped RLS. Access tokens, refresh tokens, and the per-instance instance_url are encrypted at rest and never returned to client browsers. Only the Management OS server-side runtime has access via service-role credentials.

Inference layer: Anthropic API (Claude models). CRM data required for a specific brief generation is passed to Anthropic; outputs are returned to Management OS and stored in our database. Anthropic does not train on customer data per their API terms.

Retention: We retain Salesforce-sourced data while your subscription is active. On disconnect we delete OAuth tokens immediately. On subscription cancellation, customer data is retained for 30 days for restoration, then permanently deleted. Data subject deletion requests are honored within 30 days per our Privacy Policy.

1. Sign up at mgmt-os.ai and complete onboarding to your workspace
2. Open Management OS → Settings → Integrations
3. Find Salesforce in the integration directory and click Connect Salesforce
4. You'll be redirected to Salesforce's authorization screen on your org's login host (production or sandbox). Sign in with the Salesforce user you want Management OS to read as
5. Review the requested scopes (api, refresh_token, offline_access). You'll see an orange Security Warning panel on the consent screen. That's expected for any app not yet verified through Salesforce's ISV Security Review program. Section 6 below explains what it means and why it's safe to proceed when you initiated the connection yourself. Click Allow to continue.
6. You'll return to Management OS with a confirmation that the integration is connected. The initial CRM sync starts immediately and typically completes within 5-15 minutes depending on org size

Sandbox connections: To connect a sandbox instead of production, the Management OS Connected App needs to point at https://test.salesforce.com as the login host. Contact support@mgmt-os.ai before connecting if you want sandbox setup.

If you administer Salesforce on behalf of an organization: Some orgs require admin pre-approval for new Connected Apps. If you encounter an approval prompt, your Salesforce admin can pre-approve Management OS via Setup → Apps → Connected Apps OAuth Usage → Install.

After you sign in to Salesforce during the Connect flow, Salesforce displays an "Allow Access?" consent screen with a prominent orange Security Warning panel that reads (verbatim):

Why this warning appears: Salesforce displays this panel on the consent screen for every external application that has not yet completed Salesforce's ISV Security Review — a multi-week verification process that runs through the AppExchange partner pipeline. Management OS is currently working through that process. Until verification is complete, the warning appears on every connection regardless of who is connecting.

Why it's safe to proceed when you initiated the connection: The warning is designed to protect against social engineering. The specific risk it warns about is an attacker contacting a Salesforce user via phone or email and instructing them to authorize a malicious app, then using that authorization to extract data. Because you initiated the connection yourself from inside Management OS (not in response to an outside party telling you to), the warning's caution does not apply to your situation. Click Allow to continue.

What changes after Salesforce ISV Security Review: Once Management OS completes the review, the orange Security Warning is replaced by a Salesforce-verified publisher badge. The consent screen still asks you to authorize the scopes (you're still in control), but the warning panel disappears. The verification process is tracked on our public roadmap.

If you administer Salesforce for your organization and have stricter policies: Some enterprise orgs configure a policy that blocks all uninstalled external apps from being authorized by end users. If that applies to your org, your Salesforce admin needs to pre-approve Management OS via Setup → Apps → Connected Apps OAuth Usage → find Management OS → click Install or set App Status to Allowed. This is a one-time, admin-only action.

The Weekly Intelligence Brief is the primary surface. Three pillars synthesize your Salesforce data:

• Develop Your Business — deal scoring (every open Opportunity scored against the Opportunity OS rubric), forecast accuracy, account plans, champion-behavior alerts, renewal cascade
• Develop Your Team — coaching priorities mapped to specific reps and deals, rep-effectiveness rankings, 1:1 prep, GROW conversation planners
• Develop Yourself — leader focus, calendar audit, ninety-day competency focus, decision deadlines you're sitting on

Ask Anything (AMA) — a conversational surface where you can query your Salesforce data in plain English. Examples: "Which Opportunities slipped from this quarter to next?", "Show me the top 5 deals at risk with no activity in 14 days", "What's my coverage ratio against Q4 quota by rep?"

1. Open Management OS → Settings → Integrations
2. Find Salesforce in the connected integrations list
3. Click Disconnect → confirm

On disconnect we immediately delete the stored OAuth tokens (access, refresh, and instance URL) and stop reading any new CRM data. Previously synthesized briefs remain in your Management OS workspace as historical records — they are not deleted automatically because they may contain decisions and context the leader still references.

To remove all historical briefs and data after disconnect, email privacy@mgmt-os.ai with your workspace identifier. We process deletion requests within 30 days.

For the individual user who connected:

1. Sign in to Salesforce as the user who authorized the connection
2. Click your avatar → Settings → My Personal Information → Advanced User Details
3. Scroll to OAuth Connected Apps
4. Find Management OS in the list and click Revoke

For Salesforce administrators (org-wide):

1. Sign in to Salesforce as a System Administrator
2. Open Setup → Apps → Connected Apps → Connected Apps OAuth Usage
3. Find Management OS and click Block to revoke org-wide access

Revoking from Salesforce's side invalidates our access and refresh tokens immediately. Our next API call returns 401 INVALID_SESSION_ID and we surface a re-connection prompt in Management OS Settings.

Security incident reporting: security@mgmt-os.ai
Privacy / data subject requests: privacy@mgmt-os.ai
Integration support: support@mgmt-os.ai

For general questions about Management OS, see our Support page or Manifesto.