Third party software integration services

What an integration inventory records

Credentials belong to the organisation

A common hidden risk is integrations authorised through an individual's personal account. When that person leaves and their account is closed, the integration silently stops. Every connection should use credentials owned by the organisation, such as a dedicated integration user or service account, stored in a shared secrets store, with permissions limited to what the integration needs. The inventory should show which credential each integration uses and when it expires.

Review this whenever someone with administrator access leaves.

Adding and removing products

1. 01

   Before buying

   Integration readiness and data ownership checked.

   Output: Informed choice

2. 02

   Connecting

   Owner, credentials and monitoring set up.

   Output: Managed connection

3. 03

   Running

   Monitored, with vendor changes tracked.

   Output: Reliable flow

4. 04

   Retiring

   Data exported, connections switched off, credentials revoked.

   Output: Clean exit

Finding integrations you did not know about

The first inventory usually uncovers surprises: connectors switched on in product settings, integration platform accounts owned by former staff, scripts running on someone's computer, spreadsheets imported weekly by hand. Finding them means checking each product's integration or connected-apps settings, reviewing integration platform accounts and asking teams how data moves in their area. Each discovery is recorded, given an owner and either kept, improved or retired.

Expect the first inventory to take a little longer than planned; later updates are quick.

When people with admin access leave

Keeping up with vendor changes

Each connected product changes over time: new API versions, retired connectors, altered limits or new pricing. Record which integrations depend on which vendor features, subscribe to their announcements and review changes monthly. When a change is announced, the inventory shows exactly which connections are affected and who should act.

Retiring a product cleanly

When cancelling a product, export its data, update any system that relied on it, switch off connections in both directions and revoke credentials. Leaving connections running to a cancelled product can produce errors, or worse, keep sending data to a service you no longer control.

Integration platform sprawl

Integration platforms make it easy for anyone to connect products, which is useful and risky. Flows built by different people, with different naming, error handling and accounts, become hard to support. Agree simple standards: flows owned by organisation accounts, named consistently, with error notifications going to a monitored address, and recorded in the inventory. Review flows periodically, retire those no longer needed and rebuild fragile ones properly where they have become important.

Decide which kinds of connection staff may build themselves and which need review.

Prioritising monitoring

Not every integration needs the same attention. Those affecting customers, payments, stock or legal records deserve active monitoring and alerts; minor conveniences may need only a periodic check. Recording the impact of each connection in the inventory makes these priorities clear and helps decide where to invest in reliability.

A regular review

Review the inventory every quarter: check owners, expiring credentials, failing connections, vendor changes and products no longer used. A short review prevents the slow drift back to confusion.

A simple map of data flows

Alongside the inventory, a one-page diagram of systems and the data flowing between them helps staff, new providers and auditors understand the whole picture quickly. Keep it updated with each change; an outdated map misleads more than no map.