Setup
Connecting services
Employees use your tools through connections. A connection belongs to the company, to a department, or to one person, and one rule decides which account an employee uses.
Employees never see a credential. For each action, Armada picks the right connection, checks trust and approval rules, makes the call, and records it in the audit trail. Manage everything on the Connections page.
Shared by every employee. Only owners and admins connect or disconnect company accounts.
Used by that department's employees before the company one. That department's leads (and admins) manage it. A lead whose team needs HubSpot does not have to wait for an admin: they connect it for their department.
Any member can connect their own accounts. An employee uses one only for work that person asks for: when the request is about their own things ("my inbox", "my calendar"), when nothing shared can do what they asked, an approval they granted, or an employee writing on their behalf (which sends from their own mailbox, and never falls back to another account). There's no switch to remember. Admins see that a personal connection exists, not which account it is, and can remove it when someone leaves.
For each service: the person's own account when they asked for it, else the one the employee is pinned to, else its department's, else the company's. When several accounts of the same service are available, the hire wizard and the employee's Accounts list ask which one to use; "Automatic" follows the order above.
Before you confirm, Armada shows who is affected: employees that switch to another account, and employees that lose the service. Employees pinned to a removed account go back to automatic. Deleting a department removes its connections; a person leaving takes their personal ones with them.
Disconnecting also revokes the access at the service, so it stops working everywhere, not just in Armada. If the same account is still connected elsewhere (Google ends every connection of an account at once), it is kept and Armada says so. API keys, and the few services without a way to revoke, are named with where to remove them by hand.
Every "Connect with" sign-in is signed, expires after 10 minutes, and must come back to the same signed-in person, in the same browser, who must still be allowed to connect at that level. Services that support it also use PKCE, so an intercepted sign-in code is useless. Nobody can attach an account to another workspace.
Every stored token and API key is encrypted (AES-256-GCM) with a key kept outside the database, so a copy of the database alone gives no access to anything. Employees' signing keys and two-factor secrets are encrypted the same way. Keys can be rotated without downtime.
When connecting Google you choose the products employees may use (Gmail, Calendar, Drive and Docs, Sheets, Contacts, Tasks), and Armada asks Google for those only, each with the narrowest access its tools need. Drive is read-only except for files Armada creates. An employee never uses a Google account for a product it wasn't allowed; it uses another allowed account, or says what's missing.
Every connect, change, pin and disconnect is recorded with who did it, and whether the service confirmed the revocation. See it under Company, Connections (its Activity tab), or in Company, Record. Each person sees the activity of the connections they can see; personal accounts stay private to their owner.
The mobile app shows each service's accounts by level, lets you connect at any level you manage (choosing Google products too), and disconnect what you manage. It hands the browser a one-time code valid for 60 seconds, never your sign-in token. Key-based services are connected from the web app.
An employee's own email address is not a connection: it comes with the hire. See Armada Mail.