Integrations
Are your integrations the weakest link?
Every app you connect to Xero, Shopify, Salesforce, Google Workspace or Microsoft 365 is given a token that lets it in without a password or multi-factor login. Most businesses have dozens, and nobody remembers what each one can do. Attackers have noticed: stealing one integration's tokens can open many companies' systems at once.
Rather just ask someone? Talk to usIn short
An integration's token is a standing key to your data that skips passwords and multi-factor login. In August 2025, attackers stole Salesloft Drift's tokens and used them to export Salesforce data from hundreds of organisations. Keep integrations safe by listing every connected app, removing unused ones, narrowing each to the access it needs, and watching for unusual exports.
General information, current as at November 2026, not legal advice. A review lowers risk; it can't guarantee a system won't be breached, and it isn't a certified penetration test or a compliance audit.
- What is an OAuth token?
- When you click 'Connect' or 'Allow' to link two apps, the app receives a token: a credential that lets it act on your account within the permissions you approved, often until someone revokes it. It's convenient because nobody re-enters a password. It's risky for the same reason: whoever holds the token has that access.
What actually matters
One supplier's breach can become yours
Google's threat intelligence team found attackers used stolen Drift tokens to export data from many companies' Salesforce instances in August 2025, then searched it for further keys to AWS and Snowflake. In Australia, Qantas's 2025 breach of 5.7 million customers' data began at a third-party customer service platform.
List every connected app
Google Workspace, Microsoft 365, Xero, Shopify, Salesforce and GitHub all show which apps have access. Most businesses find old trials, departed staff's tools and integrations nobody recognises. Remove anything without a clear owner and purpose.
Narrow what each one can do
A reporting tool needs read access, not write. A form that creates contacts doesn't need to read every invoice. Where an app asks for more than its job needs, ask the vendor for narrower scopes or find another tool.
Custom integrations need the same discipline
For integrations your developer built: store tokens encrypted on the server, never in the browser; verify webhook signatures; use a dedicated integration account rather than a person's login; and log what each integration reads and changes.
Watch for bulk exports
The Drift attackers ran large data exports. Most platforms can alert on unusual API volume, new connected apps or large downloads. Turning those alerts on, and having someone read them, is cheap.
Plan how to cut access fast
Know how to revoke an integration's tokens in each system, and who's allowed to. When a supplier announces a breach, the businesses that revoke and reconnect within the hour fare far better than those that wait for details.
An integrations audit in an hour
Do this in each system that holds customer, financial or staff data.
- Export the list of connected apps and API keys
- Remove anything unused, unrecognised or owned by someone who has left
- Downgrade write access to read where the job allows it
- Move integrations off personal logins onto dedicated accounts
- Turn on alerts for new connected apps and large exports
- Write down how to revoke each integration in a hurry
Where we'd point you elsewhere
If you have a handful of well-known integrations and a short list of admins, the audit above may be all you need, and you can do it yourself. A review helps when there are custom integrations, many connected systems, or customer data flowing between them that nobody has mapped.
Tell us what you'd like checked
Describe what you run and what's worrying you. We'll suggest a sensible scope and a fixed price, or tell you plainly if a different kind of specialist would serve you better.
Common questions
They can be, because each holds standing access to your data that bypasses passwords and multi-factor login. The risk is manageable: keep the list short, narrow each app's permissions, use dedicated accounts and watch for unusual activity.
In August 2025 attackers stole OAuth tokens for Drift, a chat tool integrated with Salesforce, and used them to export data from many organisations' Salesforce instances, then searched that data for further credentials. Salesloft and Salesforce revoked the tokens on 20 August.
Each platform has a page for it: third-party app access in Google Workspace, enterprise applications in Microsoft Entra, connected apps in Xero and Salesforce, and installed apps in Shopify and GitHub. Review each one at least twice a year.
Yes. We check how tokens are stored, what scopes are requested, whether webhooks are verified, whether the integration uses a dedicated account, and whether there's a log of what it does. Findings go in the same risk-ranked report as the rest of the review.
See it working
Software we'd build, running with a fictional business and sample data. Use it, then decide.
Also worth a look
- Securing AI Agents, Chatbots and MCP Tools
- Cloud and Hosting Security: What to Check
- Leaked API Keys: How to Check and What to Do
- Already broken or stuck? Fix & rescue
Last reviewed . General information, not legal advice. Figures cited are from the sources named on each page.