Administration

Connections & sidecars

Every third party in one grid, every credential encrypted before it reaches the database, and the optional containers that keep search, meetings and speech on your own box.

One connections grid

All connections live on one page. There is no per-provider section in the sidebar, because a page per provider is a sidebar tax on a distinction that only exists to justify itself — every card opens the same dialog.

What connects

Mail

Gmail (OAuth, thread-mirrored) and generic SMTP/IMAP. What makes the CRM's mail surfaces real.

Code

GitHub — the developer agents and dev sessions are blind without it; also the source of security alerts the findings register reads.

Money

Stripe, for checkout and the payment events that reconcile against the ledger.

Chat & social

Slack, Discord, Telegram, X, LinkedIn, Instagram, TikTok, YouTube — publishing and notification targets, all behind the approval gate.

Search & research

Brave Search, Tavily, or a self-hosted SearXNG, as the Research agent's provider chain.

Company data

Companies House, for filing and officer data against the statutory registers.

Infrastructure

Coolify and Docker Hub, where you operate hosted deployments.

Meetings

Vexa, the meeting bot that joins a call and returns a transcript.

None of them are required. The appliance runs with every one of them disconnected — each connection is what turns a section from a register into something that acts.

How credentials are stored

Every secret you paste here — OAuth tokens, API keys, SMTP passwords, the GitHub App private key — is encrypted with TALON_CONTROL_ENCRYPTION_KEY before it touches the database.

Which is why that key is not recoverable

Restoring a database backup on an instance with a different encryption key gives you every row and not one usable credential. Escrow the key separately from the backups, and treat losing it as losing the connections.

Health, and what breaks

Connections are health-checked, and the result surfaces both here and on the compliance dashboard — because a dead integration is usually silent. An expired OAuth token does not raise an error anybody sees; it just means the mail stopped syncing on Tuesday and nobody noticed until Friday.

Optional sidecars

Three things run as containers beside the app rather than as code inside it. Your host pulls each from its upstream publisher, which is deliberate — it keeps their licences off Control's own source, and keeps the data on your box either way.

Kokoro

Spoken replies. Effectively part of the appliance — without it the browser's built-in voice stands in.

SearXNG

Self-hosted web search, as the first hop of the Research agent's chain. Skipped entirely when unset, rather than tried and failed.

Vexa

The meeting bot, with its own datastore and a CPU Whisper beside it so call audio never leaves the host. Keeps a transcript, never a recording — and in its bundled form is honest for one call at a time.

They arrive pinned by digest — leave them that way

Every third-party image in the published compose file is pinned as tag@sha256:…, because a tag is a moving pointer and a digest is the bytes. That is what makes "the same deployment" mean the same thing on the day you rebuild it. Moving a pin is an upgrade: take it deliberately, after reading the upstream changelog, rather than by loosening the pin.