How Does Integuru Keep Your Integrations Compliant?
Every integration runs on your own account, with your own credentials, and Integuru reviews the platform before writing any code.
What Does an Integuru Integration Actually Access?
An Integuru integration accesses exactly what the customer's own account can already see and do, using the customer's own credentials, on platforms that require a login. It does not read other users' data, does not operate logged out, and does not create accounts of its own. Most compliance questions about this work come down to those three boundaries, so they are set out explicitly below.
| Question | How Integuru works | What that means for your review |
|---|---|---|
| Who is logged in | The customer, with credentials they already hold, in the same session boundary a browser would use. | Nothing runs outside an account you already control. |
| What is accessed | The account holder's own data and the actions that account is already permitted to take. | The scope of the integration is the scope of the account, no wider. |
| Whose credentials are used | The customer's own. Integuru never creates fake accounts and never reuses one customer's credentials for another. | No shared or synthetic accounts sit behind your integration. |
| Which platforms are supported | Authenticated platforms only. Integuru deliberately does not build against logged-out, public-facing targets. | Public-data scraping is out of scope by design, not by exception. |
| How requests are made | Direct HTTP requests in the same shape the platform's own web client sends, rather than crawling pages or driving a browser. | The platform receives the same traffic pattern it receives from you. |
| When an official API exists | Integuru recommends it whenever it covers the required workflow, and builds around the gaps it leaves. | Sanctioned access is always the first option we check. |
Does Automating Your Own Account Still Violate a Platform's Terms of Service?
It can. A platform's Terms of Service governs its account holder regardless of whether a human clicks through a browser or an authenticated API call performs the same action, and some terms speak directly to automated access or to sharing credentials with a service provider. Using Integuru does not create a violation where none existed, and it does not erase a restriction a platform has written into its terms either.
What Integuru does is make sure you know where you stand before you commit.
Our team reads the specific platform's policy on automated access during scoping, and we recommend the official API or partner program whenever one covers the workflow you need. If we identify a hard blocker, whether an explicit prohibition we can't honor, anti-bot enforcement we would have to work around, or a target that requires no login at all, we tell you before any engineering time is spent. That is the same policy we apply to any platform we can't integrate with.
For accounts that hold regulated data, read the platform's policy yourself as well, and bring it to the scoping call. The most useful compliance review is one where your counsel, your security team, and our engineers are looking at the same document.
Bring to the scoping call
- The platform's own policy on automated access, read by you as well as by us.
- The account tiers and roles your team actually uses, since permissions differ between them.
- Your counsel's or security team's open questions, so everyone is looking at the same document.
General information, not legal advice. This page explains how Integuru's integrations work and what our team checks before building. It does not cover every jurisdiction or every platform's specific terms, so read the Terms of Service of any platform you plan to connect to, and talk to your own counsel about your specific use case.
How Does Integuru Review a Platform Before Building?
Integuru reviews every requested platform before writing code: it checks for an official API, examines how the platform authenticates and what its policies say about automation, and flags hard blockers during scoping. The integration is then built inside your authenticated account, tried in a sandbox, documented in full, and maintained after launch. Compliance is handled up front and on an ongoing basis, not discovered in production.
- 1
Scoping review of the target platform
Before any code is written, our team checks whether an official API or partner program already covers the workflow, how the platform authenticates, and what its policies say about automated access. If a sanctioned route exists and is practical, we recommend it.
- 2
Hard blockers flagged before engineering time is spent
If a platform's restrictions make an integration one we can't responsibly support, whether anti-bot enforcement we would have to work around, an unauthenticated target, or a restriction we can't honor, we tell you during scoping, with the reason, so you can decide whether a different route makes sense.
- 3
Build inside your authenticated account
The generated integration runs on your own login and covers the branching logic and account states that appear in real usage, so it behaves the way your account behaves rather than probing for paths your account can't reach.
- 4
Sandbox trial before production
You can try each requested integration in a sandbox before using it in production. Your security or legal team can watch exactly what it does, on real requests, before anything is committed.
- 5
Full documentation handoff
Every integration ships with complete request and response schemas. A review has something concrete to read, not a black-box script it has to reverse-engineer a second time.
- 6
Maintained after launch
Production plans include 24/7 on-call maintenance and authentication auto-healing. If the platform changes its login flow or access rules, Integuru's team responds, and the integration is updated to match rather than left to fail silently.
What Can You Hand to Your Legal and Security Team?
Integuru gives your reviewers material rather than assurances: a documented access model, a scoping decision with reasons, a sandbox trial on your own account, complete request and response schemas, a signed BAA where protected health information is involved, and 24/7 maintenance after launch. None of it replaces your own legal review, but that review starts from documentation instead of a black-box script.
A documented access model: your account, your credentials
Integuru builds only against platforms where you hold an account and log in. The integration sees what your account sees and does what your account is permitted to do, so a reviewer can scope it by reading your own account permissions.
Read the access model in the FAQA scoping decision, with the reason
Before your team starts building, you hear whether an official API already covers the workflow and whether the platform is one Integuru can responsibly support. If the answer is no, you get the reason, not a vague decline.
Read who Integuru is and isn't built forA sandbox trial on your own account
Each requested integration can be tried before it goes live. Your team sees the exact requests and responses on your own account and signs off before production traffic starts.
See how the sandbox trial worksComplete request and response documentation
Every generated integration ships with full request and response schemas. A security or legal review has something concrete to read, not a script it has to reverse-engineer a second time.
See what Full Managed Service coversHIPAA compliance and a signed BAA
Integuru is HIPAA-compliant and signs Business Associate Agreements at no additional cost, for any integration that touches protected health information.
See how this works for healthcare platforms24/7 maintenance and auth auto-healing
Production plans include on-call maintenance and authentication auto-healing, so if a target platform changes its access rules or login flow, Integuru's team responds instead of your integration silently breaking.
See how maintenance and auto-healing workFrequently Asked Questions
- Does Integuru scrape public data or access other users’ accounts?
- No. Every Integuru integration runs inside the customer’s own account, authenticated with credentials the customer already holds, to automate actions that account is already permitted to take. Integuru does not scrape public data, does not operate logged out, does not create fake accounts, and does not access other users’ data. Integuru deliberately supports only authenticated platforms, so public-facing scraping is outside what it offers by design.
- What does Integuru check before building an integration?
- Before writing any code, Integuru’s team reviews the requested platform: whether an official API or partner program already covers the workflow, how the platform authenticates, and what its policies say about automated access. If a sanctioned route exists and is practical, Integuru recommends it. If the platform’s restrictions make an integration one Integuru can’t responsibly support, that is flagged during scoping, before any engineering time is spent. The integration can then be tried in a sandbox before it is used in production.
- Can automating my own account still violate a platform’s Terms of Service?
- It can. A platform’s Terms of Service governs its account holder regardless of whether a human clicks through a browser or an authenticated API call performs the same action, and some terms address automated access or credential sharing directly. Integuru does not create a violation where none existed, and it does not remove a restriction a platform has written into its terms. What Integuru does is read the platform’s policy during scoping, recommend the official API where one covers the workflow, and raise hard blockers during scoping rather than after a build, so you know where you stand before you commit.
- What happens if a platform changes its login flow or access rules after the integration is live?
- On production plans, Integuru’s team handles it. Production integrations include 24/7 on-call maintenance and authentication auto-healing, so when a platform changes its login flow, session handling, or access rules, Integuru updates the integration to match rather than leaving it to fail silently. Because Integuru uses direct HTTP requests rather than browser automation, front-end redesigns that break screen-scraping tools do not affect the integration.
- Is Integuru HIPAA-compliant?
- Yes. Integuru is HIPAA-compliant and signs Business Associate Agreements at no additional cost for any integration that touches protected health information.
- What does Integuru do to reduce compliance exposure?
- Integuru scopes each requested platform before building and flags hard blockers up front, ships full API documentation with every generated integration instead of a black-box script, and includes 24/7 on-call maintenance with authentication auto-healing on production plans so access changes are handled by Integuru’s team rather than breaking silently. None of this replaces your own legal review, but it gives that review something concrete and documented to start from.
Ready to talk through your compliance review?
Bring your legal or security team's questions. We'll walk through the platforms you need, how the integration would work, and what we check before you commit engineering time.