One model of your
company, read many ways.
Nogu is not one integration per product. It is one graph, built once from access to systems you already run, read-only wherever the provider allows it, that every product queries.
What the Company Graph actually contains.
The types below, and the edges between them. Everything Nogu claims about your company is a path through this graph, which is why every finding can show its working — and where nothing resolves an entity yet, the table says so rather than naming a system Nogu cannot read.
| Entity | What it is | Resolved from |
|---|---|---|
| customer | A company you sell to, with its revenue history | Stripe |
| repository | A codebase Nogu has indexed | GitHub |
| file · symbol | Where in that codebase something is defined | GitHub · static analysis |
| dependency · provider | An external package or API you call | Manifests · call-site analysis |
| feature · workflow | What your product does, and the paths through it | Declared, then mapped to code |
| capability | What you can claim, as distinct from what you shipped | Declared · read from prose |
| contract · obligation | What you signed, and each duty inside it | Uploaded PDFs or pasted text, reviewed by a person |
| claim · control | A public statement, and what measures it | Read from your website, or declared · control checks |
| ticket | A reported problem | From Intercom, or from your help desk through the API |
Every finding is a path you can walk.
Every finding comes with the chain of entities it traversed, so you can check it or dispute one link.
The finding below is the one shown on the Margin page, in the shape a read API would return it.
{
"id": "fnd_8Kq2",
"product": "margin",
"severity": "high",
"summary": "Acme Corp gross margin 43.7%, 39 pts below cohort",
"path": [
{ "entity": "Account", "id": "acct_acme", "mrr": 199.00 },
{ "entity": "Workflow", "id": "wf_research", "share": 0.667 },
{ "entity": "CallSite", "id": "cs_a41b", "file": "workers/research/run.ts:82" },
{ "entity": "Vendor", "id": "ven_openai", "model": "gpt-5.1" },
{ "entity": "CostEvent", "window": "2026-02", "amount": 74.82 }
],
"recommendation": {
"actions": [
{ "label": "Move gpt-5.1 calls to gpt-5.1-mini", "saving": 46.30 },
{ "label": "Move claude-sonnet-4.5 calls to claude-haiku-4.5", "saving": 22.23 }
],
"projected_margin": 0.781,
"suggestion_only": true
}
}Illustrative — the read API is not published yet
Read-only where it can be, and revocable.
Read-only wherever the provider offers it. Where it does not, the connect screen says what the key can do before you paste it. Eight providers can be connected today, and each one is below with what it reads and what it does not.
| Source | How it connects | What it reads |
|---|---|---|
| GitHub | A GitHub App you install on the repositories you choose, asking for contents: read, metadata: read. Turning on pull-request checks asks for checks: write, pull_requests: read as a separate approval at GitHub | The repositories you choose, their files at the default branch, pull requests and their diffs, deployments, and what the installation is allowed to do. |
| Stripe | Stripe Connect, read only | Customers, subscriptions and their items, invoices and revenue, paged in full. |
| OpenRouter | OpenRouter sends each call to Nogu with a workspace key you create. Nogu holds no OpenRouter credential. | What your application spends on models, as each call happens, posted to Nogu by OpenRouter. |
| OpenAI | A key you create and paste. The connect screen says what else the key can do before you paste it. | Your organisation's usage and spend, by model and by key, from the admin reports.It cannot say which of your customers a call was for — the reports are by key and model, not by account. Cost per customer needs calls tagged as they happen, which is what OpenRouter's connection does. |
| Anthropic | A key you create and paste. The connect screen says what else the key can do before you paste it. | Your organisation's usage and spend, by model and by key, from the admin reports.Same as OpenAI's: the reports are by key and model, so they cannot attribute a call to one of your customers. |
| PostHog | A key you create and paste. The connect screen says what else the key can do before you paste it. | The events your product records, so Nogu can tell which features are actually used.An event whose feature nothing has mapped stays unresolved rather than being guessed at, so adoption is measured for the features somebody has connected to events and not for the rest. |
| HubSpot | A key you create and paste. The connect screen says what else the key can do before you paste it. | Deals and the notes on them, read for commitments somebody made to a customer in writing.Amounts come through as the deal's own number in the deal's own currency, and nothing converts them. What is extracted is a proposed promise a person still confirms. |
| Intercom | A key you create and paste. The connect screen says what else the key can do before you paste it. | Conversations, counted as the support burden a feature carries.It counts conversations rather than reading them: a feature's burden is how much support it generates, not what any one ticket said. |
Nothing merged or deployed
Nogu never merges or deploys. Draft pull requests open only when a person approves, or under an owner’s standing grant.
Disconnect and the credential is destroyed
Removing a source deletes Nogu's copy of the credential rather than marking it inactive. Entities already in the graph stay, and say which source they came from — deleting evidence somebody has acted on is not a privacy feature. Revoke the grant at the provider too; Nogu cannot do that for you.
Signed webhooks, not polling
Findings are POSTed to your endpoint as they are raised, at the severities you choose. Each carries an HMAC-SHA256 signature over the timestamp and body, so a captured delivery cannot be replayed. https only, and never a private address.
The read API is not public yet.
Sending usage, events, tickets and telemetry works today with a workspace API key. The read endpoints are not stable enough to publish yet; the entity model above is stable enough to describe.