> ## Documentation Index
> Fetch the complete documentation index at: https://docs.surfaice.pro/llms.txt
> Use this file to discover all available pages before exploring further.

# Connectors

> Connect Surfaice to systems of record with consent, role controls, and inherited permissions.

Connectors let Surfaice read (and, when you enable it, write back to) systems your team already uses. A **connector** is a consented link from your Surfaice workspace to one of those systems — Hugo then uses it under **your** permissions.

| Kind of system           | Examples you may already run   |
| ------------------------ | ------------------------------ |
| Lease administration     | Lucernex                       |
| Files / DMS              | SharePoint, Google Drive       |
| Email                    | Outlook (per-user mailbox)     |
| Market / deals data      | CoStar                         |
| Construction / projects  | Procore, Smartsheet, Sitefolio |
| Facilities / work orders | ServiceChannel, FEXA           |

Exact availability depends on your workspace configuration. New to Surfaice? Read [What is Surfaice?](/concepts/what-is-surfaice) first.

## Principles

<AccordionGroup>
  <Accordion title="Nothing connects without consent">
    Administrators approve Surfaice in your Microsoft 365, Google Workspace, or other tenant. Each system of record follows the same rule: no silent tenant-wide grabs.
  </Accordion>

  <Accordion title="Email is per user">
    Mailbox access is granted by the individual user to their own mailbox. There is no tenant-wide mailbox read. A user can only reach email they could already open themselves.
  </Accordion>

  <Accordion title="Roles gate who even sees a connector">
    Connector availability is governed by role inside Surfaice. Roles that should not use a connector never see the option.
  </Accordion>

  <Accordion title="Permissions are inherited, never expanded">
    A signed-in user sees exactly the data their existing role in Lucernex, SharePoint, or another system already grants. Surfaice does not grant new access.
  </Accordion>

  <Accordion title="Exclusions apply across skills">
    Keywords, senders, domains, and folders can be excluded instance-wide (for example HR or legal topics). Those exclusions apply to every email-touching skill by default.
  </Accordion>
</AccordionGroup>

## Typical setup sequence

<Steps>
  <Step title="IT approves the application">
    Your identity / SaaS admins consent to Surfaice in the relevant tenant.
  </Step>

  <Step title="Surfaice roles are assigned">
    Only intended roles (for example lease admin) get connector entitlements.
  </Step>

  <Step title="Users connect their own accounts">
    Users complete OAuth for personal connectors such as Outlook.
  </Step>

  <Step title="Rollout stays staged">
    Connectors go live one at a time on explicit sign-off and can be revoked in your IdP at any time.
  </Step>
</Steps>

## What you should see in the app

<Steps>
  <Step title="Connectors settings">
    Each integration shows connected / not connected. OAuth connectors display the signed-in account email.
  </Step>

  <Step title="Consent screens">
    Microsoft or Google consent lists the exact permissions Surfaice requests — no broader than needed for lease and project workflows.
  </Step>

  <Step title="Role visibility">
    If you do not see Lucernex or Outlook at all, your Surfaice role may not include that connector — contact your admin.
  </Step>
</Steps>

## Related

* [Working with Hugo](/guides/working-with-hugo) — access denied and connector troubleshooting
* [Permissions](/concepts/permissions)
* [Data handling](/concepts/data-handling)
* [Security overview](/security)