Versatl — Connected Services Appendix
Effective Date: June 11, 2026
Last Updated: August 5, 2026
This appendix lists the third-party services that users may connect to the Versatl platform. It is incorporated by reference into the Terms of Service, Privacy Policy, Data Processing Agreement, Acceptable Use Policy, and Marketplace Publisher Agreement.
Maintained as a single source of truth so that adding or removing a service updates every legal document at once.
1. Categories of Connection
Four classes of integration are in scope:
- Direct OAuth: The Platform stores OAuth tokens directly on its infrastructure (Fernet-encrypted). Tool calls are dispatched by the Platform.
- Managed OAuth via Composio: The Platform brokers the OAuth flow through Composio Inc. ("Composio"), a CASA Tier 2-verified application. OAuth credentials are stored on Composio infrastructure; tool calls are dispatched by Composio on the Platform's instruction.
- MCP-brokered: The Platform calls a vendor-hosted tool server over the Model Context Protocol (MCP). OAuth tokens authorize the user's account at the vendor; tool execution happens vendor-side.
- API key / token: The user supplies a service-issued API key, token, or endpoint URL, stored on Platform infrastructure (Fernet-encrypted, same regime as Direct OAuth). Tool calls are dispatched by the Platform.
Three additional labels appear in the inventory for integrations that involve no per-user credential: Platform-managed bot (the Platform operates a shared bot under its own bot token), Platform-key (the Platform calls the service under its own API key), and Platform tool (a built-in capability that uses no external credential at all).
2. Current Service Inventory
The set below reflects the integrations available as of the Last Updated date above. Newly added integrations are reflected in this appendix prior to going live in production.
2.1 Communication and email
| Service | Category | Default Path |
|---|---|---|
| Gmail | Composio (default) / Direct OAuth (fallback) | Composio |
| Slack | Direct OAuth | Direct |
| Slack (shared bot) | Platform-managed bot (Platform's own Slack bot token, issued through a workspace-level Slack app installation; no per-user OAuth) | Platform-managed bot |
| Telegram (shared bot) | Platform-managed bot (Platform's own bot token; no per-user OAuth) | Platform-managed bot |
| Discord (shared bot) | Platform-managed bot (Platform's own bot token; no per-user OAuth) | Platform-managed bot |
| Slack / Telegram / Discord (your own bot) | API key/token (you supply your bot token or signing secret) | API key/token |
| Twilio (SMS) | API key (user's Account SID + auth token) | API key |
For the "your own bot" (BYOB) messaging options, the bot token / signing secret you supply is stored Fernet-encrypted under the same regime as the other API-key/token integrations (§1), decrypted only at the point of use (webhook registration, message delivery, signature verification), and never returned in an API response.
A directly-connected Gmail account may additionally include a standing inbox watch (Google Cloud Pub/Sub push notification of new mail) when the user enables a Gmail-triggered automation or channel; see Privacy Policy §5.3 for the data flow. Standing inbox monitoring requires the direct-OAuth connection and is not available for the Composio-brokered (default) Gmail connection.
2.2 Calendar and scheduling
| Service | Category | Default Path |
|---|---|---|
| Google Calendar | Composio (default) / Direct OAuth (fallback) | Composio |
| Calendly | Direct OAuth | Direct |
2.3 Files and content
| Service | Category | Default Path |
|---|---|---|
| Google Drive | Composio (default) / Direct OAuth (fallback) | Composio |
| Dropbox | Direct OAuth | Direct |
2.4 Social media
| Service | Category | Default Path |
|---|---|---|
| Twitter / X | Direct OAuth | Direct |
| Direct OAuth | Direct |
2.5 Developer and project management
| Service | Category | Default Path |
|---|---|---|
| GitHub | Direct OAuth; the same grant also powers the Platform-curated GitHub MCP integration | Direct + MCP |
| Jira (Atlassian) | API key (API token + account email) | API key |
| Linear | User-registered custom MCP server (see §3) | Custom MCP |
| Atlassian / Confluence (beyond the Jira adapter) | User-registered custom MCP server (see §3) | Custom MCP |
| Notion | Direct OAuth (legacy) / user-registered custom MCP server | Direct |
2.6 Sales, CRM, and commerce
| Service | Category | Default Path |
|---|---|---|
| HubSpot | Direct OAuth | Direct |
| QuickBooks | Direct OAuth | Direct |
| Airtable | Personal access token supplied by the user (API-key category; Airtable retired legacy API keys in 2024) | API key |
| Mailchimp | API key | API key |
Shopify, Stripe (user-connected account), Instagram, Facebook, and YouTube are not currently offered as connectable services; they may be added in a future update to this appendix.
2.7 Search and research
| Service | Category | Default Path |
|---|---|---|
| Brave Search (web search) | Platform-key (no per-user OAuth) | Platform-key |
2.8 Automation and platform tools
| Service | Category | Default Path |
|---|---|---|
| Zapier (and generic webhooks) | API key / token (user-supplied webhook URL; the Platform POSTs data to the endpoint the user configures) | API key |
| Web Browser | Platform tool (no credential; agents fetch publicly reachable URLs named in the user's instructions) | Platform tool |
| Contact Form | Platform tool (no credential; on the user's instruction, agents submit user-supplied details — e.g., name, email, phone, subject, message — to contact forms on third-party websites the user names) | Platform tool |
3. Custom MCP servers
In addition to the integrations above, users may connect custom MCP servers via Dynamic Client Registration (DCR) or pre-provisioned credentials. Under DCR, the Platform registers itself as an OAuth client with the user's chosen MCP server and receives client credentials from that server's registration endpoint (and access tokens from its token endpoint); the Platform then dispatches tool calls to the server using those credentials. The full set of custom servers a given user has connected is private to that user and is not enumerated here.
4. Disconnection behavior
When a user disconnects a service, the Platform:
- Deletes the local credential record (hard delete) — except for Bring-Your-Own-Model (BYOM) LLM provider keys, which are soft-deleted with retention as described in the Privacy Policy §7.
- For Direct-OAuth services, calls the vendor's published revoke endpoint to invalidate the OAuth grant at the upstream provider, where supported. Services that do not expose a public revoke endpoint (Notion, Shopify) skip this step.
- For Composio-brokered Google services, instructs Composio to delete the corresponding connected account on Composio's infrastructure, severing the underlying OAuth grant.
- For MCP-brokered and custom MCP services, deletes the local credential and stops dispatching to the server. For the Platform-curated GitHub MCP integration, the Platform additionally makes a best-effort call to revoke the token upstream. Custom MCP servers expose no standard revoke endpoint, so sessions previously authorized at such a server may persist until they expire on its normal schedule; users wishing to invalidate immediately should also revoke access in that server's own settings.
5. Updates
This appendix is updated whenever an integration is added, removed, or changes category. The Platform publishes appendix changes in the same release notes as the corresponding feature update.