diff --git a/.gitignore b/.gitignore
index 9cd387c21e..58946b17f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -88,6 +88,7 @@ packages/*/dist
 
 # Generated Prisma Client
 **/src/db/generated/
+packages/db/prisma/src/generated/
 
 # Release script
 scripts/sync-release-branch.sh
@@ -97,3 +98,4 @@ scripts/sync-release-branch.sh
 
 .superpowers/*
 .claude/worktrees/
+.worktrees/
diff --git a/Dockerfile b/Dockerfile
index 8177432ca0..a9fdfa1865 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,9 +63,13 @@ COPY apps/app ./apps/app
 # Bring in node_modules for build and prisma prebuild
 COPY --from=deps /app/node_modules ./node_modules
 
-# Pre-combine schemas for app build
-RUN cd packages/db && node scripts/combine-schemas.js
-RUN cp packages/db/dist/schema.prisma apps/app/prisma/schema.prisma
+# Pre-combine schemas and generate the Prisma client into
+# node_modules/@prisma/client. The deps stage ran `bun install` with
+# `--ignore-scripts` so packages/db's postinstall was skipped; we run
+# it explicitly here so `next build` can resolve the generated runtime
+# + types when it imports @prisma/client.
+RUN cd packages/db && node scripts/combine-schemas.js \
+                   && node scripts/generate-prisma-client-js.js
 
 # Ensure Next build has required public env at build-time
 ARG NEXT_PUBLIC_BETTER_AUTH_URL
diff --git a/apps/api/package.json b/apps/api/package.json
index c55d68cb37..4bf6aa80c4 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -7,57 +7,57 @@
         "@ai-sdk/anthropic": "^2.0.53",
         "@ai-sdk/groq": "^2.0.32",
         "@ai-sdk/openai": "^2.0.65",
-        "@aws-sdk/client-ec2": "^3.911.0",
-        "@aws-sdk/client-s3": "3.1013.0",
         "@aws-sdk/client-acm": "^3.948.0",
+        "@aws-sdk/client-api-gateway": "^3.948.0",
+        "@aws-sdk/client-apigatewayv2": "^3.948.0",
+        "@aws-sdk/client-appflow": "^3.948.0",
+        "@aws-sdk/client-athena": "^3.948.0",
         "@aws-sdk/client-backup": "^3.948.0",
+        "@aws-sdk/client-cloudfront": "^3.948.0",
         "@aws-sdk/client-cloudtrail": "^3.948.0",
         "@aws-sdk/client-cloudwatch": "^3.948.0",
-        "@aws-sdk/client-cost-explorer": "^3.948.0",
         "@aws-sdk/client-cloudwatch-logs": "^3.948.0",
+        "@aws-sdk/client-codebuild": "^3.948.0",
+        "@aws-sdk/client-cognito-identity-provider": "^3.948.0",
         "@aws-sdk/client-config-service": "^3.948.0",
+        "@aws-sdk/client-cost-explorer": "^3.948.0",
         "@aws-sdk/client-dynamodb": "^3.948.0",
+        "@aws-sdk/client-ec2": "^3.911.0",
         "@aws-sdk/client-ecr": "^3.948.0",
         "@aws-sdk/client-ecs": "^3.948.0",
         "@aws-sdk/client-efs": "^3.948.0",
         "@aws-sdk/client-eks": "^3.948.0",
+        "@aws-sdk/client-elastic-beanstalk": "^3.948.0",
         "@aws-sdk/client-elastic-load-balancing-v2": "^3.948.0",
+        "@aws-sdk/client-elasticache": "^3.948.0",
+        "@aws-sdk/client-emr": "^3.948.0",
+        "@aws-sdk/client-eventbridge": "^3.948.0",
+        "@aws-sdk/client-glue": "^3.948.0",
         "@aws-sdk/client-guardduty": "^3.948.0",
         "@aws-sdk/client-iam": "^3.948.0",
         "@aws-sdk/client-inspector2": "^3.948.0",
+        "@aws-sdk/client-kafka": "^3.948.0",
+        "@aws-sdk/client-kinesis": "^3.948.0",
         "@aws-sdk/client-kms": "^3.948.0",
         "@aws-sdk/client-lambda": "^3.948.0",
         "@aws-sdk/client-macie2": "^3.948.0",
+        "@aws-sdk/client-network-firewall": "^3.948.0",
         "@aws-sdk/client-opensearch": "^3.948.0",
         "@aws-sdk/client-rds": "^3.948.0",
         "@aws-sdk/client-redshift": "^3.948.0",
         "@aws-sdk/client-route-53": "^3.948.0",
+        "@aws-sdk/client-s3": "3.1013.0",
+        "@aws-sdk/client-sagemaker": "^3.948.0",
         "@aws-sdk/client-secrets-manager": "^3.948.0",
         "@aws-sdk/client-securityhub": "^3.948.0",
-        "@aws-sdk/client-sns": "^3.948.0",
-        "@aws-sdk/client-sqs": "^3.948.0",
-        "@aws-sdk/client-wafv2": "^3.948.0",
-        "@aws-sdk/client-api-gateway": "^3.948.0",
-        "@aws-sdk/client-apigatewayv2": "^3.948.0",
-        "@aws-sdk/client-appflow": "^3.948.0",
-        "@aws-sdk/client-athena": "^3.948.0",
-        "@aws-sdk/client-cloudfront": "^3.948.0",
-        "@aws-sdk/client-codebuild": "^3.948.0",
-        "@aws-sdk/client-cognito-identity-provider": "^3.948.0",
-        "@aws-sdk/client-elastic-beanstalk": "^3.948.0",
-        "@aws-sdk/client-elasticache": "^3.948.0",
-        "@aws-sdk/client-emr": "^3.948.0",
-        "@aws-sdk/client-eventbridge": "^3.948.0",
-        "@aws-sdk/client-glue": "^3.948.0",
-        "@aws-sdk/client-kafka": "^3.948.0",
-        "@aws-sdk/client-kinesis": "^3.948.0",
-        "@aws-sdk/client-network-firewall": "^3.948.0",
-        "@aws-sdk/client-sagemaker": "^3.948.0",
         "@aws-sdk/client-sfn": "^3.948.0",
         "@aws-sdk/client-shield": "^3.948.0",
+        "@aws-sdk/client-sns": "^3.948.0",
+        "@aws-sdk/client-sqs": "^3.948.0",
         "@aws-sdk/client-ssm": "^3.948.0",
         "@aws-sdk/client-sts": "^3.948.0",
         "@aws-sdk/client-transfer": "^3.948.0",
+        "@aws-sdk/client-wafv2": "^3.948.0",
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@browserbasehq/sdk": "2.6.0",
         "@browserbasehq/stagehand": "^3.2.1",
@@ -81,6 +81,7 @@
         "@trycompai/db": "workspace:*",
         "@trycompai/email": "workspace:*",
         "@trycompai/integration-platform": "workspace:*",
+        "@trycompai/utils": "workspace:*",
         "@upstash/ratelimit": "^2.0.8",
         "@upstash/redis": "^1.34.2",
         "@upstash/vector": "^1.2.2",
@@ -102,6 +103,7 @@
         "nanoid": "^5.1.6",
         "pdf-lib": "^1.17.1",
         "playwright-core": "^1.57.0",
+        "posthog-node": "^5.29.2",
         "prisma": "7.6.0",
         "react": "^19.1.1",
         "react-dom": "^19.1.0",
@@ -167,7 +169,8 @@
             "^@trycompai/company$": "<rootDir>/../../../packages/company/src/index.ts",
             "^@trycompai/db$": "@prisma/client",
             "^@trycompai/email$": "<rootDir>/../../../packages/email/index.ts",
-            "^@trycompai/integration-platform$": "<rootDir>/../../../packages/integration-platform/src/index.ts"
+            "^@trycompai/integration-platform$": "<rootDir>/../../../packages/integration-platform/src/index.ts",
+            "^@trycompai/utils/(.*)$": "<rootDir>/../../../packages/utils/src/$1.ts"
         }
     },
     "license": "UNLICENSED",
diff --git a/apps/api/src/admin-feature-flags/admin-feature-flags.controller.spec.ts b/apps/api/src/admin-feature-flags/admin-feature-flags.controller.spec.ts
new file mode 100644
index 0000000000..65d0c8a72a
--- /dev/null
+++ b/apps/api/src/admin-feature-flags/admin-feature-flags.controller.spec.ts
@@ -0,0 +1,132 @@
+import { NotFoundException } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
+
+jest.mock('@db', () => ({
+  db: {
+    organization: {
+      findUnique: jest.fn(),
+    },
+  },
+}));
+
+jest.mock('../auth/platform-admin.guard', () => ({
+  PlatformAdminGuard: class MockGuard {
+    canActivate() {
+      return true;
+    }
+  },
+}));
+
+jest.mock('../admin-organizations/admin-audit-log.interceptor', () => ({
+  AdminAuditLogInterceptor: class MockInterceptor {
+    intercept(_ctx: unknown, next: { handle: () => unknown }) {
+      return next.handle();
+    }
+  },
+}));
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+import { AdminFeatureFlagsController } from './admin-feature-flags.controller';
+import { AdminFeatureFlagsService } from './admin-feature-flags.service';
+import { PlatformAdminGuard } from '../auth/platform-admin.guard';
+import { AdminAuditLogInterceptor } from '../admin-organizations/admin-audit-log.interceptor';
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+const mockDb = require('@db').db as {
+  organization: { findUnique: jest.Mock };
+};
+
+describe('AdminFeatureFlagsController', () => {
+  let controller: AdminFeatureFlagsController;
+  let service: {
+    listForOrganization: jest.Mock;
+    setFlagForOrganization: jest.Mock;
+  };
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    service = {
+      listForOrganization: jest.fn(),
+      setFlagForOrganization: jest.fn(),
+    };
+
+    const module: TestingModule = await Test.createTestingModule({
+      controllers: [AdminFeatureFlagsController],
+      providers: [{ provide: AdminFeatureFlagsService, useValue: service }],
+    })
+      .overrideGuard(PlatformAdminGuard)
+      .useValue({ canActivate: () => true })
+      .overrideInterceptor(AdminAuditLogInterceptor)
+      .useValue({ intercept: (_ctx: unknown, next: { handle: () => unknown }) => next.handle() })
+      .compile();
+
+    controller = module.get(AdminFeatureFlagsController);
+  });
+
+  describe('list', () => {
+    it('throws NotFoundException when the org does not exist', async () => {
+      mockDb.organization.findUnique.mockResolvedValue(null);
+      await expect(controller.list('org_missing')).rejects.toBeInstanceOf(
+        NotFoundException,
+      );
+      expect(service.listForOrganization).not.toHaveBeenCalled();
+    });
+
+    it('returns flags wrapped in { data } when the org exists', async () => {
+      mockDb.organization.findUnique.mockResolvedValue({ id: 'org_1' });
+      service.listForOrganization.mockResolvedValue([
+        {
+          key: 'is-timeline-enabled',
+          name: 'is-timeline-enabled',
+          description: '',
+          active: true,
+          enabled: true,
+          createdAt: null,
+        },
+      ]);
+
+      const result = await controller.list('org_1');
+
+      expect(service.listForOrganization).toHaveBeenCalledWith('org_1');
+      expect(result.data).toHaveLength(1);
+      expect(result.data[0].key).toBe('is-timeline-enabled');
+    });
+  });
+
+  describe('update', () => {
+    it('throws NotFoundException when the org does not exist', async () => {
+      mockDb.organization.findUnique.mockResolvedValue(null);
+      await expect(
+        controller.update('org_missing', {
+          flagKey: 'is-timeline-enabled',
+          enabled: true,
+        }),
+      ).rejects.toBeInstanceOf(NotFoundException);
+      expect(service.setFlagForOrganization).not.toHaveBeenCalled();
+    });
+
+    it('delegates to the service with orgId, orgName, flagKey, and enabled', async () => {
+      mockDb.organization.findUnique.mockResolvedValue({
+        id: 'org_1',
+        name: 'Acme',
+      });
+      service.setFlagForOrganization.mockResolvedValue({
+        key: 'is-timeline-enabled',
+        enabled: false,
+      });
+
+      const result = await controller.update('org_1', {
+        flagKey: 'is-timeline-enabled',
+        enabled: false,
+      });
+
+      expect(service.setFlagForOrganization).toHaveBeenCalledWith({
+        orgId: 'org_1',
+        orgName: 'Acme',
+        flagKey: 'is-timeline-enabled',
+        enabled: false,
+      });
+      expect(result.data.enabled).toBe(false);
+    });
+  });
+});
diff --git a/apps/api/src/admin-feature-flags/admin-feature-flags.controller.ts b/apps/api/src/admin-feature-flags/admin-feature-flags.controller.ts
new file mode 100644
index 0000000000..ce2b1b0e98
--- /dev/null
+++ b/apps/api/src/admin-feature-flags/admin-feature-flags.controller.ts
@@ -0,0 +1,69 @@
+import {
+  Body,
+  Controller,
+  Get,
+  NotFoundException,
+  Param,
+  Patch,
+  UseGuards,
+  UseInterceptors,
+  UsePipes,
+  ValidationPipe,
+} from '@nestjs/common';
+import { ApiExcludeController, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
+import { db } from '@db';
+import { PlatformAdminGuard } from '../auth/platform-admin.guard';
+import { AdminAuditLogInterceptor } from '../admin-organizations/admin-audit-log.interceptor';
+import { AdminFeatureFlagsService } from './admin-feature-flags.service';
+import { UpdateFeatureFlagDto } from './dto/update-feature-flag.dto';
+
+@ApiExcludeController()
+@ApiTags('Admin - Feature Flags')
+@Controller({ path: 'admin/organizations', version: '1' })
+@UseGuards(PlatformAdminGuard)
+@UseInterceptors(AdminAuditLogInterceptor)
+@Throttle({ default: { ttl: 60000, limit: 60 } })
+export class AdminFeatureFlagsController {
+  constructor(private readonly service: AdminFeatureFlagsService) {}
+
+  @Get(':orgId/feature-flags')
+  @ApiOperation({
+    summary:
+      'List all admin-managed feature flags with their current state for an organization',
+  })
+  async list(@Param('orgId') orgId: string) {
+    const org = await db.organization.findUnique({ where: { id: orgId } });
+    if (!org) throw new NotFoundException('Organization not found');
+
+    const flags = await this.service.listForOrganization(orgId);
+    return { data: flags };
+  }
+
+  @Patch(':orgId/feature-flags')
+  @ApiOperation({
+    summary: 'Enable or disable a feature flag for an organization',
+  })
+  @UsePipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+    }),
+  )
+  async update(
+    @Param('orgId') orgId: string,
+    @Body() dto: UpdateFeatureFlagDto,
+  ) {
+    const org = await db.organization.findUnique({ where: { id: orgId } });
+    if (!org) throw new NotFoundException('Organization not found');
+
+    const result = await this.service.setFlagForOrganization({
+      orgId,
+      orgName: org.name,
+      flagKey: dto.flagKey,
+      enabled: dto.enabled,
+    });
+    return { data: result };
+  }
+}
diff --git a/apps/api/src/admin-feature-flags/admin-feature-flags.module.ts b/apps/api/src/admin-feature-flags/admin-feature-flags.module.ts
new file mode 100644
index 0000000000..c2d54c4a55
--- /dev/null
+++ b/apps/api/src/admin-feature-flags/admin-feature-flags.module.ts
@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { AdminFeatureFlagsController } from './admin-feature-flags.controller';
+import { AdminFeatureFlagsService } from './admin-feature-flags.service';
+import { PostHogService } from './posthog.service';
+
+@Module({
+  controllers: [AdminFeatureFlagsController],
+  providers: [AdminFeatureFlagsService, PostHogService],
+  exports: [AdminFeatureFlagsService, PostHogService],
+})
+export class AdminFeatureFlagsModule {}
diff --git a/apps/api/src/admin-feature-flags/admin-feature-flags.service.spec.ts b/apps/api/src/admin-feature-flags/admin-feature-flags.service.spec.ts
new file mode 100644
index 0000000000..588eea17f7
--- /dev/null
+++ b/apps/api/src/admin-feature-flags/admin-feature-flags.service.spec.ts
@@ -0,0 +1,146 @@
+import { BadRequestException } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { AdminFeatureFlagsService } from './admin-feature-flags.service';
+import { PostHogService } from './posthog.service';
+
+const originalEnv = { ...process.env };
+
+describe('AdminFeatureFlagsService', () => {
+  let service: AdminFeatureFlagsService;
+  let posthog: { getClient: jest.Mock };
+  let fetchSpy: jest.SpiedFunction<typeof fetch>;
+
+  const mockClient = () => ({
+    getAllFlags: jest.fn(),
+    groupIdentify: jest.fn(),
+    flush: jest.fn().mockResolvedValue(undefined),
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    process.env.POSTHOG_PERSONAL_API_KEY = 'phx_test';
+    process.env.POSTHOG_PROJECT_ID = '123';
+    process.env.POSTHOG_HOST = 'https://us.posthog.com';
+
+    posthog = { getClient: jest.fn() };
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        AdminFeatureFlagsService,
+        { provide: PostHogService, useValue: posthog },
+      ],
+    }).compile();
+
+    service = module.get(AdminFeatureFlagsService);
+    fetchSpy = jest
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValue(new Response('{}', { status: 200 })) as any;
+  });
+
+  afterEach(() => {
+    fetchSpy.mockRestore();
+    process.env = { ...originalEnv };
+  });
+
+  describe('listForOrganization', () => {
+    it('returns [] when PostHog REST config is missing', async () => {
+      delete process.env.POSTHOG_PERSONAL_API_KEY;
+      const result = await service.listForOrganization('org_1');
+      expect(result).toEqual([]);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+
+    it('refuses to follow a pagination `next` URL pointing to a foreign origin', async () => {
+      const client = mockClient();
+      client.getAllFlags.mockResolvedValue({});
+      posthog.getClient.mockReturnValue(client);
+
+      fetchSpy.mockImplementation((url) => {
+        const host = new URL(String(url)).host;
+        if (host === 'us.posthog.com') {
+          return Promise.resolve(
+            new Response(
+              JSON.stringify({
+                results: [
+                  { id: 1, key: 'flag_a', name: '', active: true },
+                ],
+                next: 'https://evil.example.com/api/feature_flags/?cursor=abc',
+              }),
+              { status: 200 },
+            ),
+          );
+        }
+        throw new Error(`fetch should not be called with ${url}`);
+      });
+
+      const result = await service.listForOrganization('org_1');
+
+      expect(result).toEqual([
+        expect.objectContaining({ key: 'flag_a', enabled: false }),
+      ]);
+      // Only the first (trusted) page was fetched; evil origin was refused.
+      expect(fetchSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it('treats a multivariate variant string as enabled', async () => {
+      const client = mockClient();
+      client.getAllFlags.mockResolvedValue({
+        'exp-flag': 'variant-a',
+        'off-flag': false,
+      });
+      posthog.getClient.mockReturnValue(client);
+
+      fetchSpy.mockResolvedValue(
+        new Response(
+          JSON.stringify({
+            results: [
+              { id: 1, key: 'exp-flag', name: '', active: true },
+              { id: 2, key: 'off-flag', name: '', active: true },
+            ],
+            next: null,
+          }),
+          { status: 200 },
+        ),
+      );
+
+      const result = await service.listForOrganization('org_1');
+
+      const exp = result.find((f) => f.key === 'exp-flag');
+      const off = result.find((f) => f.key === 'off-flag');
+      expect(exp?.enabled).toBe(true);
+      expect(off?.enabled).toBe(false);
+    });
+  });
+
+  describe('setFlagForOrganization', () => {
+    it('throws BadRequest when PostHog is not configured', async () => {
+      posthog.getClient.mockReturnValue(null);
+      await expect(
+        service.setFlagForOrganization({
+          orgId: 'org_1',
+          flagKey: 'f',
+          enabled: true,
+        }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('calls groupIdentify + flush with the flag key as a group property', async () => {
+      const client = mockClient();
+      posthog.getClient.mockReturnValue(client);
+
+      const result = await service.setFlagForOrganization({
+        orgId: 'org_1',
+        orgName: 'Acme',
+        flagKey: 'is-timeline-enabled',
+        enabled: true,
+      });
+
+      expect(client.groupIdentify).toHaveBeenCalledWith({
+        groupType: 'organization',
+        groupKey: 'org_1',
+        properties: { name: 'Acme', 'is-timeline-enabled': true },
+      });
+      expect(client.flush).toHaveBeenCalled();
+      expect(result).toEqual({ key: 'is-timeline-enabled', enabled: true });
+    });
+  });
+});
diff --git a/apps/api/src/admin-feature-flags/admin-feature-flags.service.ts b/apps/api/src/admin-feature-flags/admin-feature-flags.service.ts
new file mode 100644
index 0000000000..192c5c6692
--- /dev/null
+++ b/apps/api/src/admin-feature-flags/admin-feature-flags.service.ts
@@ -0,0 +1,197 @@
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import { PostHogService } from './posthog.service';
+
+export interface FlagState {
+  key: string;
+  name: string;
+  description: string;
+  active: boolean;
+  enabled: boolean;
+  createdAt: string | null;
+}
+
+interface PostHogFlagListItem {
+  id: number;
+  key: string;
+  name: string;
+  active: boolean;
+  deleted?: boolean;
+  created_at?: string;
+}
+
+@Injectable()
+export class AdminFeatureFlagsService {
+  private readonly logger = new Logger(AdminFeatureFlagsService.name);
+
+  constructor(private readonly posthog: PostHogService) {}
+
+  private getPostHogRestConfig(): { apiHost: string; apiKey: string; projectId: string } | null {
+    const apiKey = process.env.POSTHOG_PERSONAL_API_KEY;
+    const projectId = process.env.POSTHOG_PROJECT_ID;
+    const apiHost =
+      process.env.POSTHOG_HOST ||
+      process.env.NEXT_PUBLIC_POSTHOG_HOST ||
+      'https://us.posthog.com';
+
+    if (!apiKey || !projectId) return null;
+    return { apiHost, apiKey, projectId };
+  }
+
+  private async fetchFlagsFromPostHog(): Promise<PostHogFlagListItem[]> {
+    const config = this.getPostHogRestConfig();
+    if (!config) return [];
+
+    const results: PostHogFlagListItem[] = [];
+    const apiHost = config.apiHost.replace(/\/$/, '');
+    const baseUrl = `${apiHost}/api/projects/${config.projectId}/feature_flags/`;
+    let nextUrl: string | null = `${baseUrl}?limit=200`;
+    // Hard cap so a misbehaving cursor can't loop forever.
+    const maxPages = 25;
+
+    // Only follow `next` links that point back to the configured PostHog
+    // host. Without this check, a malicious PostHog response could redirect
+    // pagination to an attacker-controlled host and leak the Authorization
+    // header (which carries the personal API key) via SSRF.
+    let expectedOrigin: string;
+    try {
+      expectedOrigin = new URL(apiHost).origin;
+    } catch {
+      this.logger.error(
+        `POSTHOG_HOST is not a valid URL: "${apiHost}". Skipping flag fetch.`,
+      );
+      return [];
+    }
+
+    try {
+      for (let page = 0; page < maxPages && nextUrl; page++) {
+        let parsedNext: URL;
+        try {
+          parsedNext = new URL(nextUrl);
+        } catch {
+          this.logger.error(`Invalid PostHog pagination URL: ${nextUrl}`);
+          break;
+        }
+        if (parsedNext.origin !== expectedOrigin) {
+          this.logger.error(
+            `Refusing to follow PostHog pagination to foreign origin: ${parsedNext.origin}`,
+          );
+          break;
+        }
+
+        const response: Response = await fetch(parsedNext.toString(), {
+          headers: {
+            Authorization: `Bearer ${config.apiKey}`,
+            'Content-Type': 'application/json',
+          },
+        });
+
+        if (!response.ok) {
+          this.logger.error(
+            `PostHog flag list failed: ${response.status} ${await response.text()}`,
+          );
+          break;
+        }
+
+        const data = (await response.json()) as {
+          results?: PostHogFlagListItem[];
+          next?: string | null;
+        };
+        for (const f of data.results ?? []) {
+          if (!f.deleted) results.push(f);
+        }
+        nextUrl = data.next ?? null;
+      }
+    } catch (err) {
+      this.logger.error('Failed to fetch flags from PostHog REST API', err);
+    }
+
+    return results;
+  }
+
+  async listForOrganization(orgId: string): Promise<FlagState[]> {
+    const flags = await this.fetchFlagsFromPostHog();
+    const client = this.posthog.getClient();
+
+    if (flags.length === 0 || !client) {
+      return [];
+    }
+
+    // Evaluate all flags in one network call instead of one per flag.
+    const distinctId = `admin-check:${orgId}`;
+    let evaluated: Record<string, string | boolean> = {};
+    try {
+      evaluated = await client.getAllFlags(distinctId, {
+        groups: { organization: orgId },
+        disableGeoip: true,
+      });
+    } catch (err) {
+      this.logger.error(`Failed to evaluate flags for org ${orgId}`, err);
+    }
+
+    // A flag is "on" for this org when the evaluator returns true (boolean
+    // flags) OR any string variant key (multivariate flags — PostHog returns
+    // the variant name for enabled variants, `false` for disabled).
+    const isEnabled = (value: string | boolean | undefined): boolean =>
+      value === true || (typeof value === 'string' && value.length > 0);
+
+    return flags
+      .map((flag) => ({
+        key: flag.key,
+        name: flag.key,
+        description: flag.name ?? '',
+        active: flag.active,
+        enabled: isEnabled(evaluated[flag.key]),
+        createdAt: flag.created_at ?? null,
+      }))
+      .sort((a, b) => {
+        // Newest first; fall back to key for ties / missing dates.
+        const aTime = a.createdAt ? new Date(a.createdAt).getTime() : 0;
+        const bTime = b.createdAt ? new Date(b.createdAt).getTime() : 0;
+        if (aTime !== bTime) return bTime - aTime;
+        return a.key.localeCompare(b.key);
+      });
+  }
+
+  async setFlagForOrganization({
+    orgId,
+    orgName,
+    flagKey,
+    enabled,
+  }: {
+    orgId: string;
+    orgName?: string;
+    flagKey: string;
+    enabled: boolean;
+  }): Promise<{ key: string; enabled: boolean }> {
+    if (!flagKey) {
+      throw new BadRequestException('flagKey is required');
+    }
+
+    const client = this.posthog.getClient();
+    if (!client) {
+      throw new BadRequestException('PostHog is not configured on this environment');
+    }
+
+    try {
+      client.groupIdentify({
+        groupType: 'organization',
+        groupKey: orgId,
+        properties: {
+          ...(orgName ? { name: orgName } : {}),
+          [flagKey]: enabled,
+        },
+      });
+      await client.flush();
+    } catch (err) {
+      this.logger.error(
+        `Failed to set flag ${flagKey}=${enabled} for org ${orgId}`,
+        err,
+      );
+      throw new BadRequestException(
+        'Unable to update feature flag via PostHog. Please try again.',
+      );
+    }
+
+    return { key: flagKey, enabled };
+  }
+}
diff --git a/apps/api/src/admin-feature-flags/dto/update-feature-flag.dto.ts b/apps/api/src/admin-feature-flags/dto/update-feature-flag.dto.ts
new file mode 100644
index 0000000000..c2520805e5
--- /dev/null
+++ b/apps/api/src/admin-feature-flags/dto/update-feature-flag.dto.ts
@@ -0,0 +1,10 @@
+import { IsBoolean, IsString, IsNotEmpty } from 'class-validator';
+
+export class UpdateFeatureFlagDto {
+  @IsString()
+  @IsNotEmpty()
+  flagKey!: string;
+
+  @IsBoolean()
+  enabled!: boolean;
+}
diff --git a/apps/api/src/admin-feature-flags/posthog.service.ts b/apps/api/src/admin-feature-flags/posthog.service.ts
new file mode 100644
index 0000000000..942e155fe0
--- /dev/null
+++ b/apps/api/src/admin-feature-flags/posthog.service.ts
@@ -0,0 +1,42 @@
+import { Injectable, Logger, OnModuleDestroy } from '@nestjs/common';
+import { PostHog } from 'posthog-node';
+
+@Injectable()
+export class PostHogService implements OnModuleDestroy {
+  private readonly logger = new Logger(PostHogService.name);
+  private client: PostHog | null = null;
+  private initialized = false;
+
+  getClient(): PostHog | null {
+    if (this.initialized) return this.client;
+
+    // Prefer POSTHOG_API_KEY (explicit backend config) over the
+    // NEXT_PUBLIC_* fallback so frontend env wiring can't accidentally
+    // override the server key if both happen to be present.
+    const apiKey = process.env.POSTHOG_API_KEY || process.env.NEXT_PUBLIC_POSTHOG_KEY;
+    const apiHost =
+      process.env.POSTHOG_HOST ||
+      process.env.NEXT_PUBLIC_POSTHOG_HOST ||
+      'https://us.i.posthog.com';
+
+    this.initialized = true;
+
+    if (!apiKey) {
+      this.logger.warn('PostHog API key not configured; feature flag operations will be no-ops');
+      return null;
+    }
+
+    this.client = new PostHog(apiKey, {
+      host: apiHost,
+      flushAt: 1,
+      flushInterval: 0,
+    });
+    return this.client;
+  }
+
+  async onModuleDestroy() {
+    if (this.client) {
+      await this.client.shutdown();
+    }
+  }
+}
diff --git a/apps/api/src/app.module.ts b/apps/api/src/app.module.ts
index 3bc246e5ac..b6ada5eb93 100644
--- a/apps/api/src/app.module.ts
+++ b/apps/api/src/app.module.ts
@@ -49,6 +49,8 @@ import { SecretsModule } from './secrets/secrets.module';
 import { SecurityPenetrationTestsModule } from './security-penetration-tests/security-penetration-tests.module';
 import { StripeModule } from './stripe/stripe.module';
 import { AdminOrganizationsModule } from './admin-organizations/admin-organizations.module';
+import { AdminFeatureFlagsModule } from './admin-feature-flags/admin-feature-flags.module';
+import { TimelinesModule } from './timelines/timelines.module';
 
 @Module({
   imports: [
@@ -110,6 +112,8 @@ import { AdminOrganizationsModule } from './admin-organizations/admin-organizati
     SecurityPenetrationTestsModule,
     StripeModule,
     AdminOrganizationsModule,
+    AdminFeatureFlagsModule,
+    TimelinesModule,
   ],
   controllers: [AppController],
   providers: [
diff --git a/apps/api/src/devices/devices.service.ts b/apps/api/src/devices/devices.service.ts
index fcfd5e4eef..cc43686d84 100644
--- a/apps/api/src/devices/devices.service.ts
+++ b/apps/api/src/devices/devices.service.ts
@@ -1,5 +1,6 @@
 import { Injectable, NotFoundException, Logger } from '@nestjs/common';
 import { db } from '@db';
+import { getDeviceComplianceStatus } from '@trycompai/utils/devices';
 import { FleetService } from '../lib/fleet.service';
 import { DeviceResponseDto } from './dto/device-responses.dto';
 import type { MemberResponseDto } from './dto/member-responses.dto';
@@ -331,7 +332,14 @@ export class DevicesService {
     dto.updated_at = device.updatedAt.toISOString();
     dto.display_name = device.name;
     dto.display_text = device.name;
-    dto.status = device.isCompliant ? 'compliant' : 'non-compliant';
+    const complianceStatus = getDeviceComplianceStatus({
+      isCompliant: device.isCompliant,
+      lastCheckIn: device.lastCheckIn,
+    });
+    // Keep the existing string shape ('compliant' | 'non-compliant' | 'stale') so
+    // downstream API consumers see a predictable value.
+    dto.status =
+      complianceStatus === 'non_compliant' ? 'non-compliant' : complianceStatus;
     dto.disk_encryption_enabled = device.diskEncryptionEnabled;
     dto.source = 'device_agent';
     // Default empty values for FleetDM-specific fields
diff --git a/apps/api/src/evidence-forms/evidence-forms.module.ts b/apps/api/src/evidence-forms/evidence-forms.module.ts
index 333ffaa5d0..a2d69ad34a 100644
--- a/apps/api/src/evidence-forms/evidence-forms.module.ts
+++ b/apps/api/src/evidence-forms/evidence-forms.module.ts
@@ -1,11 +1,12 @@
 import { Module } from '@nestjs/common';
 import { AttachmentsModule } from '@/attachments/attachments.module';
 import { AuthModule } from '@/auth/auth.module';
+import { TimelinesModule } from '../timelines/timelines.module';
 import { EvidenceFormsController } from './evidence-forms.controller';
 import { EvidenceFormsService } from './evidence-forms.service';
 
 @Module({
-  imports: [AuthModule, AttachmentsModule],
+  imports: [AuthModule, AttachmentsModule, TimelinesModule],
   controllers: [EvidenceFormsController],
   providers: [EvidenceFormsService],
   exports: [EvidenceFormsService],
diff --git a/apps/api/src/evidence-forms/evidence-forms.service.spec.ts b/apps/api/src/evidence-forms/evidence-forms.service.spec.ts
index 670ee8d6ad..26b7752d91 100644
--- a/apps/api/src/evidence-forms/evidence-forms.service.spec.ts
+++ b/apps/api/src/evidence-forms/evidence-forms.service.spec.ts
@@ -59,7 +59,9 @@ describe('EvidenceFormsService', () => {
     getPresignedDownloadUrl: jest.fn(),
   } as unknown as AttachmentsService;
 
-  const service = new EvidenceFormsService(attachmentsServiceMock);
+  const timelinesServiceMock = {} as unknown as import('../timelines/timelines.service').TimelinesService;
+
+  const service = new EvidenceFormsService(attachmentsServiceMock, timelinesServiceMock);
   const mockedDb = db as unknown as MockDb;
 
   beforeEach(() => {
diff --git a/apps/api/src/evidence-forms/evidence-forms.service.ts b/apps/api/src/evidence-forms/evidence-forms.service.ts
index 53e6c6edae..b1f88934cf 100644
--- a/apps/api/src/evidence-forms/evidence-forms.service.ts
+++ b/apps/api/src/evidence-forms/evidence-forms.service.ts
@@ -8,6 +8,7 @@ import {
 import {
   BadRequestException,
   Injectable,
+  Logger,
   NotFoundException,
   UnauthorizedException,
 } from '@nestjs/common';
@@ -20,6 +21,8 @@ import {
   type EvidenceFormFieldDefinition,
   type EvidenceFormType,
 } from './evidence-forms.definitions';
+import { checkAutoCompletePhases } from '../frameworks/frameworks-timeline.helper';
+import { TimelinesService } from '../timelines/timelines.service';
 
 const listQuerySchema = z.object({
   search: z.string().trim().optional(),
@@ -128,7 +131,12 @@ function normalizeSubmissionFormType<
 
 @Injectable()
 export class EvidenceFormsService {
-  constructor(private readonly attachmentsService: AttachmentsService) {}
+  private readonly logger = new Logger(EvidenceFormsService.name);
+
+  constructor(
+    private readonly attachmentsService: AttachmentsService,
+    private readonly timelinesService: TimelinesService,
+  ) {}
 
   private requireJwtUser(authContext: AuthContext): string {
     if (authContext.isApiKey || authContext.authType === 'api-key') {
@@ -407,6 +415,14 @@ export class EvidenceFormsService {
       where: { id: params.submissionId },
     });
 
+    // Check timeline auto-completion after evidence deletion
+    checkAutoCompletePhases({
+      organizationId: params.organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
     return { success: true, id: params.submissionId };
   }
 
@@ -464,7 +480,7 @@ export class EvidenceFormsService {
       throw new BadRequestException(message);
     }
 
-    return await db.evidenceSubmission
+    const submission = await db.evidenceSubmission
       .create({
         data: {
           organizationId: params.organizationId,
@@ -483,6 +499,16 @@ export class EvidenceFormsService {
         },
       })
       .then(normalizeSubmissionFormType);
+
+    // Check timeline auto-completion after evidence submission
+    checkAutoCompletePhases({
+      organizationId: params.organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
+    return submission;
   }
 
   async uploadFile(params: {
@@ -576,7 +602,7 @@ export class EvidenceFormsService {
     const downloadUrl =
       await this.attachmentsService.getPresignedDownloadUrl(fileKey);
 
-    return await db.evidenceSubmission
+    const submission = await db.evidenceSubmission
       .create({
         data: {
           organizationId: params.organizationId,
@@ -602,6 +628,16 @@ export class EvidenceFormsService {
         },
       })
       .then(normalizeSubmissionFormType);
+
+    // Check timeline auto-completion after evidence upload submission
+    checkAutoCompletePhases({
+      organizationId: params.organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
+    return submission;
   }
 
   async exportCsv(params: {
diff --git a/apps/api/src/findings/findings.module.ts b/apps/api/src/findings/findings.module.ts
index 975b20351e..642f8a49b4 100644
--- a/apps/api/src/findings/findings.module.ts
+++ b/apps/api/src/findings/findings.module.ts
@@ -1,5 +1,6 @@
 import { Module } from '@nestjs/common';
 import { AuthModule } from '../auth/auth.module';
+import { TimelinesModule } from '../timelines/timelines.module';
 import { NovuService } from '../notifications/novu.service';
 import { FindingAuditService } from './finding-audit.service';
 import { FindingNotifierService } from './finding-notifier.service';
@@ -7,7 +8,7 @@ import { FindingsController } from './findings.controller';
 import { FindingsService } from './findings.service';
 
 @Module({
-  imports: [AuthModule],
+  imports: [AuthModule, TimelinesModule],
   controllers: [FindingsController],
   providers: [
     FindingsService,
diff --git a/apps/api/src/findings/findings.service.ts b/apps/api/src/findings/findings.service.ts
index 6d70b5de6a..e5f1ff961c 100644
--- a/apps/api/src/findings/findings.service.ts
+++ b/apps/api/src/findings/findings.service.ts
@@ -21,6 +21,9 @@ import { CreateFindingDto } from './dto/create-finding.dto';
 import { UpdateFindingDto } from './dto/update-finding.dto';
 import { FindingAuditService } from './finding-audit.service';
 import { FindingNotifierService } from './finding-notifier.service';
+import { type EvidenceFormType } from '@/evidence-forms/evidence-forms.definitions';
+import { TimelinesService } from '../timelines/timelines.service';
+import { checkAutoCompletePhases } from '../frameworks/frameworks-timeline.helper';
 
 // Target keys on Finding. Exactly one of these (or `area`) must be set per finding.
 const TARGET_KEYS = [
@@ -72,6 +75,7 @@ export class FindingsService {
   constructor(
     private readonly findingAuditService: FindingAuditService,
     private readonly findingNotifierService: FindingNotifierService,
+    private readonly timelinesService: TimelinesService,
   ) {}
 
   private normalizeFindingFormTypes<
@@ -337,6 +341,18 @@ export class FindingsService {
       actorName,
     });
 
+    // A new open finding lowers the AUTO_FINDINGS completion ratio, which
+    // can regress a previously COMPLETED phase back to IN_PROGRESS.
+    void checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((error) => {
+      this.logger.warn(
+        `Failed to reconcile AUTO_FINDINGS phases after finding ${finding.id} create`,
+        error instanceof Error ? error.message : String(error),
+      );
+    });
+
     this.logger.log(`Created finding ${finding.id} for ${target.kind}`);
     return this.normalizeFindingFormTypes(finding);
   }
@@ -444,6 +460,20 @@ export class FindingsService {
         actorName,
         newStatus: updateDto.status,
       });
+
+      // Any status transition can move AUTO_FINDINGS metric in either
+      // direction — advance when everything is closed, regress when a
+      // closed finding is reopened. checkAutoCompletePhases also triggers
+      // the regression reconciliation pass.
+      void checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((error) => {
+        this.logger.warn(
+          `Failed to reconcile AUTO_FINDINGS phases after finding ${findingId} status change`,
+          error instanceof Error ? error.message : String(error),
+        );
+      });
     }
 
     this.logger.log(
@@ -466,6 +496,18 @@ export class FindingsService {
     // `extractFindingDescription`. No explicit call here to avoid a
     // duplicate activity entry.
 
+    // Removing a finding shifts the AUTO_FINDINGS completion ratio and can
+    // advance a phase whose only remaining open finding was deleted.
+    void checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((error) => {
+      this.logger.warn(
+        `Failed to reconcile AUTO_FINDINGS phases after finding ${findingId} delete`,
+        error instanceof Error ? error.message : String(error),
+      );
+    });
+
     this.logger.log(`Deleted finding ${findingId}`);
     return {
       message: 'Finding deleted successfully',
diff --git a/apps/api/src/frameworks/frameworks-scores.helper.spec.ts b/apps/api/src/frameworks/frameworks-scores.helper.spec.ts
new file mode 100644
index 0000000000..7cb00fbaa8
--- /dev/null
+++ b/apps/api/src/frameworks/frameworks-scores.helper.spec.ts
@@ -0,0 +1,277 @@
+jest.mock('@db', () => ({
+  db: {
+    policy: { findMany: jest.fn() },
+    task: { findMany: jest.fn() },
+    member: { findMany: jest.fn() },
+    onboarding: { findUnique: jest.fn() },
+    organization: { findUnique: jest.fn() },
+    frameworkInstance: { findFirst: jest.fn() },
+    employeeTrainingVideoCompletion: { findMany: jest.fn() },
+    device: { findMany: jest.fn() },
+    fleetPolicyResult: { findMany: jest.fn() },
+    evidenceSubmission: { groupBy: jest.fn() },
+    finding: { findMany: jest.fn() },
+  },
+}));
+
+jest.mock('../utils/compliance-filters', () => ({
+  filterComplianceMembers: jest.fn(),
+}));
+
+import { db } from '@db';
+import { filterComplianceMembers } from '../utils/compliance-filters';
+import { getOverviewScores } from './frameworks-scores.helper';
+
+const mockDb = db as jest.Mocked<typeof db>;
+const mockFilterComplianceMembers =
+  filterComplianceMembers as jest.MockedFunction<
+    typeof filterComplianceMembers
+  >;
+
+describe('frameworks-scores.helper', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    (mockDb.policy.findMany as jest.Mock).mockResolvedValue([]);
+    (mockDb.task.findMany as jest.Mock).mockResolvedValue([]);
+    (mockDb.onboarding.findUnique as jest.Mock).mockResolvedValue(null);
+    (mockDb.frameworkInstance.findFirst as jest.Mock).mockResolvedValue(null);
+    (
+      mockDb.employeeTrainingVideoCompletion.findMany as jest.Mock
+    ).mockResolvedValue([]);
+    (mockDb.fleetPolicyResult.findMany as jest.Mock).mockResolvedValue([]);
+    (mockDb.evidenceSubmission.groupBy as jest.Mock).mockResolvedValue([]);
+    (mockDb.finding.findMany as jest.Mock).mockResolvedValue([]);
+  });
+
+  it('requires installed device for people completion when device agent step is enabled', async () => {
+    const members: Array<{
+      id: string;
+      role: string;
+      deactivated: boolean;
+      user: { id: string; email: string; role: string };
+    }> = [
+      {
+        id: 'mem_1',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_1', email: 'a@example.com', role: 'owner' },
+      },
+      {
+        id: 'mem_2',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_2', email: 'b@example.com', role: 'owner' },
+      },
+    ];
+
+    (mockDb.member.findMany as jest.Mock)
+      .mockResolvedValueOnce(members)
+      .mockResolvedValueOnce([]);
+    mockFilterComplianceMembers.mockResolvedValue(members);
+    (mockDb.organization.findUnique as jest.Mock).mockResolvedValue({
+      securityTrainingStepEnabled: false,
+      deviceAgentStepEnabled: true,
+    });
+    (mockDb.device.findMany as jest.Mock).mockResolvedValue([
+      { memberId: 'mem_1' },
+    ]);
+
+    const scores = await getOverviewScores('org_1');
+
+    expect(scores.people.total).toBe(2);
+    expect(scores.people.completed).toBe(1);
+    const deviceFindManyCalls = (mockDb.device.findMany as jest.Mock).mock
+      .calls;
+    expect(deviceFindManyCalls).toContainEqual([
+      {
+        where: {
+          organizationId: 'org_1',
+          memberId: { in: ['mem_1', 'mem_2'] },
+        },
+        select: { memberId: true },
+        distinct: ['memberId'],
+      },
+    ]);
+  });
+
+  it('skips installed device requirement when device agent step is disabled', async () => {
+    const members: Array<{
+      id: string;
+      role: string;
+      deactivated: boolean;
+      user: { id: string; email: string; role: string };
+    }> = [
+      {
+        id: 'mem_1',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_1', email: 'a@example.com', role: 'owner' },
+      },
+      {
+        id: 'mem_2',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_2', email: 'b@example.com', role: 'owner' },
+      },
+    ];
+
+    (mockDb.member.findMany as jest.Mock).mockResolvedValue(members);
+    mockFilterComplianceMembers.mockResolvedValue(members);
+    (mockDb.organization.findUnique as jest.Mock).mockResolvedValue({
+      securityTrainingStepEnabled: false,
+      deviceAgentStepEnabled: false,
+    });
+
+    const scores = await getOverviewScores('org_1');
+
+    expect(scores.people.total).toBe(2);
+    expect(scores.people.completed).toBe(2);
+    const deviceFindManyCalls = (mockDb.device.findMany as jest.Mock).mock
+      .calls;
+    expect(deviceFindManyCalls).toHaveLength(0);
+  });
+
+  it('counts Fleet-managed devices when device agent step is enabled', async () => {
+    const members: Array<{
+      id: string;
+      userId: string;
+      role: string;
+      deactivated: boolean;
+      user: { id: string; email: string; role: string };
+    }> = [
+      {
+        id: 'mem_1',
+        userId: 'usr_1',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_1', email: 'a@example.com', role: 'owner' },
+      },
+      {
+        id: 'mem_2',
+        userId: 'usr_2',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_2', email: 'b@example.com', role: 'owner' },
+      },
+    ];
+
+    (mockDb.member.findMany as jest.Mock)
+      .mockResolvedValueOnce(members)
+      .mockResolvedValueOnce([{ id: 'mem_2', userId: 'usr_2' }]);
+    mockFilterComplianceMembers.mockResolvedValue(members);
+    (mockDb.organization.findUnique as jest.Mock).mockResolvedValue({
+      securityTrainingStepEnabled: false,
+      deviceAgentStepEnabled: true,
+    });
+    (mockDb.device.findMany as jest.Mock).mockResolvedValue([]);
+    (mockDb.fleetPolicyResult.findMany as jest.Mock).mockResolvedValue([
+      { userId: 'usr_2' },
+    ]);
+
+    const scores = await getOverviewScores('org_1');
+
+    expect(scores.people.total).toBe(2);
+    expect(scores.people.completed).toBe(1);
+    const fleetPolicyCalls = (mockDb.fleetPolicyResult.findMany as jest.Mock)
+      .mock.calls;
+    expect(fleetPolicyCalls).toContainEqual([
+      {
+        where: {
+          organizationId: 'org_1',
+          userId: { in: ['usr_1', 'usr_2'] },
+        },
+        select: { userId: true },
+        distinct: ['userId'],
+      },
+    ]);
+  });
+
+  it('requires all security training videos when security training step is enabled', async () => {
+    const members: Array<{
+      id: string;
+      role: string;
+      deactivated: boolean;
+      user: { id: string; email: string; role: string };
+    }> = [
+      {
+        id: 'mem_1',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_1', email: 'a@example.com', role: 'owner' },
+      },
+      {
+        id: 'mem_2',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_2', email: 'b@example.com', role: 'owner' },
+      },
+    ];
+
+    (mockDb.member.findMany as jest.Mock).mockResolvedValue(members);
+    mockFilterComplianceMembers.mockResolvedValue(members);
+    (mockDb.organization.findUnique as jest.Mock).mockResolvedValue({
+      securityTrainingStepEnabled: true,
+      deviceAgentStepEnabled: false,
+    });
+    (
+      mockDb.employeeTrainingVideoCompletion.findMany as jest.Mock
+    ).mockResolvedValue([
+      { memberId: 'mem_1', videoId: 'sat-1', completedAt: new Date() },
+      { memberId: 'mem_1', videoId: 'sat-2', completedAt: new Date() },
+      { memberId: 'mem_1', videoId: 'sat-3', completedAt: new Date() },
+      { memberId: 'mem_1', videoId: 'sat-4', completedAt: new Date() },
+      { memberId: 'mem_1', videoId: 'sat-5', completedAt: new Date() },
+      { memberId: 'mem_2', videoId: 'sat-1', completedAt: new Date() },
+      { memberId: 'mem_2', videoId: 'sat-2', completedAt: new Date() },
+      { memberId: 'mem_2', videoId: 'sat-3', completedAt: new Date() },
+      { memberId: 'mem_2', videoId: 'sat-4', completedAt: new Date() },
+      { memberId: 'mem_2', videoId: 'sat-5', completedAt: null },
+    ]);
+
+    const scores = await getOverviewScores('org_1');
+
+    expect(scores.people.total).toBe(2);
+    expect(scores.people.completed).toBe(1);
+    expect(
+      mockDb.employeeTrainingVideoCompletion.findMany,
+    ).toHaveBeenCalledWith({
+      where: { memberId: { in: ['mem_1', 'mem_2'] } },
+    });
+  });
+
+  it('skips security training requirement when security training step is disabled', async () => {
+    const members: Array<{
+      id: string;
+      role: string;
+      deactivated: boolean;
+      user: { id: string; email: string; role: string };
+    }> = [
+      {
+        id: 'mem_1',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_1', email: 'a@example.com', role: 'owner' },
+      },
+      {
+        id: 'mem_2',
+        role: 'owner',
+        deactivated: false,
+        user: { id: 'usr_2', email: 'b@example.com', role: 'owner' },
+      },
+    ];
+
+    (mockDb.member.findMany as jest.Mock).mockResolvedValue(members);
+    mockFilterComplianceMembers.mockResolvedValue(members);
+    (mockDb.organization.findUnique as jest.Mock).mockResolvedValue({
+      securityTrainingStepEnabled: false,
+      deviceAgentStepEnabled: false,
+    });
+
+    const scores = await getOverviewScores('org_1');
+
+    expect(scores.people.total).toBe(2);
+    expect(scores.people.completed).toBe(2);
+    expect(mockDb.employeeTrainingVideoCompletion.findMany).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/api/src/frameworks/frameworks-scores.helper.ts b/apps/api/src/frameworks/frameworks-scores.helper.ts
index 9c233b1640..b629742787 100644
--- a/apps/api/src/frameworks/frameworks-scores.helper.ts
+++ b/apps/api/src/frameworks/frameworks-scores.helper.ts
@@ -27,7 +27,10 @@ export async function getOverviewScores(organizationId: string) {
       }),
       db.organization.findUnique({
         where: { id: organizationId },
-        select: { securityTrainingStepEnabled: true },
+        select: {
+          securityTrainingStepEnabled: true,
+          deviceAgentStepEnabled: true,
+        },
       }),
       db.frameworkInstance.findFirst({
         where: { organizationId, framework: { name: 'HIPAA' } },
@@ -36,6 +39,7 @@ export async function getOverviewScores(organizationId: string) {
     ]);
 
   const securityTrainingStepEnabled = org?.securityTrainingStepEnabled === true;
+  const deviceAgentStepEnabled = org?.deviceAgentStepEnabled === true;
   const hasHipaaFramework = !!hipaaInstance;
 
   // Policy breakdown
@@ -70,7 +74,55 @@ export async function getOverviewScores(organizationId: string) {
     );
 
     const memberIds = activeEmployees.map((e) => e.id);
+    const memberUserIds = activeEmployees
+      .map((e) => e.userId)
+      .filter((id): id is string => !!id);
     const needsCompletions = securityTrainingStepEnabled || hasHipaaFramework;
+    let membersWithInstalledDevices = new Set<string>();
+
+    if (deviceAgentStepEnabled) {
+      const [installedDevices, membersWithFleetLabels, fleetPolicyResults] =
+        await Promise.all([
+          db.device.findMany({
+            where: {
+              organizationId,
+              memberId: { in: memberIds },
+            },
+            select: { memberId: true },
+            distinct: ['memberId'],
+          }),
+          db.member.findMany({
+            where: {
+              organizationId,
+              id: { in: memberIds },
+              NOT: { fleetDmLabelId: null },
+            },
+            select: { id: true, userId: true },
+          }),
+          memberUserIds.length > 0
+            ? db.fleetPolicyResult.findMany({
+                where: {
+                  organizationId,
+                  userId: { in: memberUserIds },
+                },
+                select: { userId: true },
+                distinct: ['userId'],
+              })
+            : Promise.resolve([]),
+        ]);
+
+      const fleetUserIdsWithData = new Set(
+        fleetPolicyResults.map((result) => result.userId),
+      );
+      const memberIdsWithFleetData = membersWithFleetLabels
+        .filter((member) => fleetUserIdsWithData.has(member.userId))
+        .map((member) => member.id);
+
+      membersWithInstalledDevices = new Set([
+        ...installedDevices.map((device) => device.memberId),
+        ...memberIdsWithFleetData,
+      ]);
+    }
 
     const trainingCompletions = needsCompletions
       ? await db.employeeTrainingVideoCompletion.findMany({
@@ -94,11 +146,15 @@ export async function getOverviewScores(organizationId: string) {
       const hasCompletedHipaa = hasHipaaFramework
         ? completedVideoIds.includes(HIPAA_TRAINING_ID)
         : true;
+      const hasInstalledDevice = deviceAgentStepEnabled
+        ? membersWithInstalledDevices.has(emp.id)
+        : true;
 
       if (
         hasAcceptedAllPolicies &&
         hasCompletedAllTraining &&
-        hasCompletedHipaa
+        hasCompletedHipaa &&
+        hasInstalledDevice
       ) {
         completedMembers++;
       }
diff --git a/apps/api/src/frameworks/frameworks-timeline.helper.spec.ts b/apps/api/src/frameworks/frameworks-timeline.helper.spec.ts
new file mode 100644
index 0000000000..b26169104f
--- /dev/null
+++ b/apps/api/src/frameworks/frameworks-timeline.helper.spec.ts
@@ -0,0 +1,196 @@
+import { checkAutoCompletePhases } from './frameworks-timeline.helper';
+
+jest.mock('@db', () => ({
+  db: {
+    timelinePhase: {
+      findMany: jest.fn(),
+    },
+    frameworkInstance: {
+      findMany: jest.fn(),
+    },
+    task: {
+      findMany: jest.fn(),
+    },
+    finding: {
+      findMany: jest.fn(),
+    },
+  },
+  PhaseCompletionType: {
+    AUTO_TASKS: 'AUTO_TASKS',
+    AUTO_POLICIES: 'AUTO_POLICIES',
+    AUTO_PEOPLE: 'AUTO_PEOPLE',
+    AUTO_FINDINGS: 'AUTO_FINDINGS',
+    AUTO_UPLOAD: 'AUTO_UPLOAD',
+    MANUAL: 'MANUAL',
+  },
+  TimelinePhaseStatus: {
+    PENDING: 'PENDING',
+    IN_PROGRESS: 'IN_PROGRESS',
+    COMPLETED: 'COMPLETED',
+  },
+  TimelineStatus: {
+    DRAFT: 'DRAFT',
+    ACTIVE: 'ACTIVE',
+    PAUSED: 'PAUSED',
+    COMPLETED: 'COMPLETED',
+  },
+  FindingStatus: {
+    open: 'open',
+    ready_for_review: 'ready_for_review',
+    needs_revision: 'needs_revision',
+    closed: 'closed',
+  },
+  FindingType: {
+    soc2: 'soc2',
+    iso27001: 'iso27001',
+  },
+}));
+
+jest.mock('./frameworks-scores.helper', () => ({
+  getOverviewScores: jest.fn().mockResolvedValue({
+    policies: { total: 1, published: 0 },
+    tasks: { total: 1, done: 0 },
+    people: { total: 1, completed: 0 },
+  }),
+}));
+
+import { db } from '@db';
+
+const mockDb = db as jest.Mocked<typeof db>;
+
+describe('frameworks-timeline.helper', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('auto-completes AUTO_FINDINGS phase only when all findings for that framework type are closed', async () => {
+    const timelinesService = {
+      completePhase: jest.fn().mockResolvedValue({ id: 'tli_soc2' }),
+    };
+
+    (mockDb.timelinePhase.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'phase_soc2',
+        completionType: 'AUTO_FINDINGS',
+        startDate: new Date('2026-04-10T00:00:00.000Z'),
+        instance: {
+          id: 'tli_soc2',
+          organizationId: 'org_1',
+          frameworkInstanceId: 'fi_soc2',
+          frameworkInstance: { framework: { name: 'SOC 2' } },
+        },
+      },
+      {
+        id: 'phase_iso',
+        completionType: 'AUTO_FINDINGS',
+        startDate: new Date('2026-04-10T00:00:00.000Z'),
+        instance: {
+          id: 'tli_iso',
+          organizationId: 'org_1',
+          frameworkInstanceId: 'fi_iso',
+          frameworkInstance: { framework: { name: 'ISO 27001' } },
+        },
+      },
+    ]);
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      { id: 'fi_soc2', requirementsMapped: [] },
+      { id: 'fi_iso', requirementsMapped: [] },
+    ]);
+    (mockDb.finding.findMany as jest.Mock).mockResolvedValue([
+      {
+        type: 'soc2',
+        status: 'closed',
+        createdAt: new Date('2026-04-11T00:00:00.000Z'),
+      },
+      {
+        type: 'iso27001',
+        status: 'open',
+        createdAt: new Date('2026-04-11T00:00:00.000Z'),
+      },
+    ]);
+
+    await checkAutoCompletePhases({
+      organizationId: 'org_1',
+      timelinesService: timelinesService as any,
+    });
+
+    expect(timelinesService.completePhase).toHaveBeenCalledTimes(1);
+    expect(timelinesService.completePhase).toHaveBeenCalledWith(
+      'tli_soc2',
+      'phase_soc2',
+      'org_1',
+    );
+  });
+
+  it('does not auto-complete AUTO_FINDINGS phase when no findings exist for that framework type', async () => {
+    const timelinesService = {
+      completePhase: jest.fn().mockResolvedValue({ id: 'tli_soc2' }),
+    };
+
+    (mockDb.timelinePhase.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'phase_soc2',
+        completionType: 'AUTO_FINDINGS',
+        startDate: new Date('2026-04-10T00:00:00.000Z'),
+        instance: {
+          id: 'tli_soc2',
+          organizationId: 'org_1',
+          frameworkInstanceId: 'fi_soc2',
+          frameworkInstance: { framework: { name: 'SOC 2' } },
+        },
+      },
+    ]);
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      { id: 'fi_soc2', requirementsMapped: [] },
+    ]);
+    (mockDb.finding.findMany as jest.Mock).mockResolvedValue([]);
+
+    await checkAutoCompletePhases({
+      organizationId: 'org_1',
+      timelinesService: timelinesService as any,
+    });
+
+    expect(timelinesService.completePhase).not.toHaveBeenCalled();
+  });
+
+  it('maps SOC 2 v.1 AUTO_FINDINGS phases to SOC 2 finding type', async () => {
+    const timelinesService = {
+      completePhase: jest.fn().mockResolvedValue({ id: 'tli_soc2_v1' }),
+    };
+
+    (mockDb.timelinePhase.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'phase_soc2_v1',
+        completionType: 'AUTO_FINDINGS',
+        startDate: new Date('2026-04-10T00:00:00.000Z'),
+        instance: {
+          id: 'tli_soc2_v1',
+          organizationId: 'org_1',
+          frameworkInstanceId: 'fi_soc2_v1',
+          frameworkInstance: { framework: { name: 'SOC 2 v.1' } },
+        },
+      },
+    ]);
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      { id: 'fi_soc2_v1', requirementsMapped: [] },
+    ]);
+    (mockDb.finding.findMany as jest.Mock).mockResolvedValue([
+      {
+        type: 'soc2',
+        status: 'closed',
+        createdAt: new Date('2026-04-11T00:00:00.000Z'),
+      },
+    ]);
+
+    await checkAutoCompletePhases({
+      organizationId: 'org_1',
+      timelinesService: timelinesService as any,
+    });
+
+    expect(timelinesService.completePhase).toHaveBeenCalledWith(
+      'tli_soc2_v1',
+      'phase_soc2_v1',
+      'org_1',
+    );
+  });
+});
diff --git a/apps/api/src/frameworks/frameworks-timeline.helper.ts b/apps/api/src/frameworks/frameworks-timeline.helper.ts
new file mode 100644
index 0000000000..fc604bb29e
--- /dev/null
+++ b/apps/api/src/frameworks/frameworks-timeline.helper.ts
@@ -0,0 +1,362 @@
+import { Logger } from '@nestjs/common';
+import {
+  db,
+  FindingStatus,
+  FindingType,
+  PhaseCompletionType,
+  TimelinePhaseStatus,
+  TimelineStatus,
+} from '@db';
+import { TimelinesService } from '../timelines/timelines.service';
+import { getOverviewScores } from './frameworks-scores.helper';
+
+const logger = new Logger('FrameworksTimelineHelper');
+
+type TaskForAutoCompletion = {
+  id: string;
+  status: string;
+  controls: Array<{ id: string }>;
+};
+
+const FRAMEWORK_TO_FINDING_TYPE: Record<string, FindingType> = {
+  SOC2: FindingType.soc2,
+  SOC2V1: FindingType.soc2,
+  ISO27001: FindingType.iso27001,
+};
+
+function getFindingTypeForFrameworkName(
+  frameworkName: string | null | undefined,
+): FindingType | undefined {
+  if (!frameworkName) return undefined;
+  const normalized = frameworkName
+    .toUpperCase()
+    .replace(/[^A-Z0-9]/g, '');
+  return FRAMEWORK_TO_FINDING_TYPE[normalized];
+}
+
+/**
+ * For each framework editor ID, look up the corresponding FrameworkInstance
+ * and attempt to create a DRAFT timeline from the matching template.
+ * Failures are logged but never propagate -- the framework add must succeed.
+ */
+export async function createTimelinesForFrameworks({
+  organizationId,
+  frameworkEditorIds,
+  timelinesService,
+}: {
+  organizationId: string;
+  frameworkEditorIds: string[];
+  timelinesService: TimelinesService;
+}) {
+  const instances = await db.frameworkInstance.findMany({
+    where: {
+      organizationId,
+      frameworkId: { in: frameworkEditorIds },
+    },
+    select: {
+      id: true,
+      framework: { select: { name: true } },
+    },
+  });
+
+  for (const instance of instances) {
+    // Custom frameworks don't have a platform Framework record; fall back to
+    // the single primary track.
+    const timelinesToCreate =
+      instance.framework?.name === 'SOC 2'
+        ? [
+            { cycleNumber: 1, trackKey: 'soc2_type1' },
+            { cycleNumber: 1, trackKey: 'soc2_type2' },
+          ]
+        : [{ cycleNumber: 1, trackKey: 'primary' }];
+
+    // Try each track independently so a failure on one track (e.g.
+    // soc2_type1) doesn't silently skip the other (soc2_type2). Partial
+    // state is also repaired on the next /timelines read via backfill.
+    for (const timeline of timelinesToCreate) {
+      try {
+        await timelinesService.createFromTemplate({
+          organizationId,
+          frameworkInstanceId: instance.id,
+          cycleNumber: timeline.cycleNumber,
+          trackKey: timeline.trackKey,
+        });
+      } catch (err) {
+        logger.warn(
+          `Failed to create ${timeline.trackKey} timeline for framework instance ${instance.id}`,
+          err instanceof Error ? err.message : err,
+        );
+      }
+    }
+  }
+}
+
+/**
+ * Check all active timeline instances for this org. For any IN_PROGRESS
+ * AUTO_* phase, verify whether the linked auto-completion criteria
+ * are satisfied and auto-complete the phase if so.
+ */
+export async function checkAutoCompletePhases({
+  organizationId,
+  timelinesService,
+}: {
+  organizationId: string;
+  timelinesService: TimelinesService;
+}) {
+  try {
+    await runPhaseAdvancement({ organizationId, timelinesService });
+  } finally {
+    // Always reconcile — handles regressions on COMPLETED phases, which
+    // runPhaseAdvancement skips via its early return when no phase is
+    // IN_PROGRESS. Without this, a metric drop on an already-completed
+    // phase would be missed by every event hook.
+    await timelinesService
+      .reconcileAutoPhasesForOrganization(organizationId)
+      .catch((err) =>
+        logger.warn(
+          'reconcileAutoPhasesForOrganization failed',
+          err instanceof Error ? err.message : err,
+        ),
+      );
+  }
+}
+
+async function runPhaseAdvancement({
+  organizationId,
+  timelinesService,
+}: {
+  organizationId: string;
+  timelinesService: TimelinesService;
+}) {
+  const autoTypes = [
+    PhaseCompletionType.AUTO_TASKS,
+    PhaseCompletionType.AUTO_POLICIES,
+    PhaseCompletionType.AUTO_PEOPLE,
+    PhaseCompletionType.AUTO_FINDINGS,
+  ];
+
+  const phases = await db.timelinePhase.findMany({
+    where: {
+      completionType: { in: autoTypes },
+      status: TimelinePhaseStatus.IN_PROGRESS,
+      instance: {
+        organizationId,
+        status: TimelineStatus.ACTIVE,
+      },
+    },
+    include: {
+      instance: {
+        select: {
+          id: true,
+          organizationId: true,
+          frameworkInstanceId: true,
+          frameworkInstance: {
+            select: {
+              framework: {
+                select: { name: true },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+
+  if (phases.length === 0) return;
+
+  // Collect unique framework instance IDs
+  const frameworkInstanceIds = [
+    ...new Set(phases.map((p) => p.instance.frameworkInstanceId)),
+  ];
+
+  // Fetch framework instances with controls for scoring
+  const frameworkInstances = await db.frameworkInstance.findMany({
+    where: { id: { in: frameworkInstanceIds }, organizationId },
+    include: {
+      requirementsMapped: {
+        include: {
+          control: {
+            include: {
+              policies: {
+                select: { id: true, name: true, status: true },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+
+  // Deduplicate controls per framework instance
+  const frameworkControlsMap = new Map<string, { id: string }[]>();
+  const frameworkControlIdsMap = new Map<string, Set<string>>();
+  for (const fi of frameworkInstances) {
+    const controlsMap = new Map<string, { id: string }>();
+    for (const rm of fi.requirementsMapped) {
+      if (rm.control && !controlsMap.has(rm.control.id)) {
+        controlsMap.set(rm.control.id, { id: rm.control.id });
+      }
+    }
+    const controls = Array.from(controlsMap.values());
+    frameworkControlsMap.set(fi.id, controls);
+    frameworkControlIdsMap.set(fi.id, new Set(controls.map((c) => c.id)));
+  }
+
+  // Fetch all tasks linked to any of these controls
+  const allControlIds = [
+    ...new Set(
+      Array.from(frameworkControlsMap.values())
+        .flat()
+        .map((c) => c.id),
+    ),
+  ];
+
+  const hasAutoFindingsPhase = phases.some(
+    (phase) => phase.completionType === PhaseCompletionType.AUTO_FINDINGS,
+  );
+
+  if (allControlIds.length === 0 && !hasAutoFindingsPhase) return;
+
+  // Fetch tasks and overview scores in parallel
+  const tasksPromise: Promise<TaskForAutoCompletion[]> =
+    allControlIds.length > 0
+      ? db.task.findMany({
+          where: {
+            organizationId,
+            controls: { some: { id: { in: allControlIds } } },
+          },
+          select: {
+            id: true,
+            status: true,
+            controls: { select: { id: true } },
+          },
+        })
+      : Promise.resolve([]);
+
+  const [tasks, scores] = await Promise.all([
+    tasksPromise,
+    getOverviewScores(organizationId),
+  ]);
+
+  const frameworkTaskIdsMap = new Map<string, Set<string>>();
+  for (const fiId of frameworkInstanceIds) {
+    const controlIds = frameworkControlIdsMap.get(fiId) ?? new Set<string>();
+    const taskIds = new Set<string>();
+    for (const task of tasks) {
+      const matchesFramework = task.controls.some((c) => controlIds.has(c.id));
+      if (matchesFramework) taskIds.add(task.id);
+    }
+    frameworkTaskIdsMap.set(fiId, taskIds);
+  }
+
+  let findingsForAutoCompletion: Array<{
+    status: FindingStatus;
+    createdAt: Date;
+    type: FindingType;
+  }> = [];
+
+  if (hasAutoFindingsPhase) {
+    const autoFindingPhaseStartDates = phases
+      .filter(
+        (phase) => phase.completionType === PhaseCompletionType.AUTO_FINDINGS,
+      )
+      .map((phase) => phase.startDate)
+      .filter((d): d is Date => d instanceof Date);
+    const findingTypes = Array.from(
+      new Set(
+        phases
+          .filter(
+            (phase) =>
+              phase.completionType === PhaseCompletionType.AUTO_FINDINGS,
+          )
+          .map((phase) =>
+            getFindingTypeForFrameworkName(
+              phase.instance.frameworkInstance.framework?.name,
+            ),
+          )
+          .filter((t): t is FindingType => !!t),
+      ),
+    );
+
+    if (
+      autoFindingPhaseStartDates.length > 0 &&
+      findingTypes.length > 0
+    ) {
+      const earliestStartDate = new Date(
+        Math.min(...autoFindingPhaseStartDates.map((d) => d.getTime())),
+      );
+      findingsForAutoCompletion = await db.finding.findMany({
+        where: {
+          organizationId,
+          createdAt: { gte: earliestStartDate },
+          type: { in: findingTypes },
+        },
+        select: {
+          status: true,
+          createdAt: true,
+          type: true,
+        },
+      });
+    }
+  }
+
+  for (const phase of phases) {
+    const fiId = phase.instance.frameworkInstanceId;
+    const controls = frameworkControlsMap.get(fiId);
+    let shouldComplete = false;
+
+    if (phase.completionType === PhaseCompletionType.AUTO_TASKS) {
+      if (!controls || controls.length === 0) continue;
+      const controlIds = controls.map((c) => c.id);
+      const fiTasks = tasks.filter((t) =>
+        t.controls.some((c) => controlIds.includes(c.id)),
+      );
+      if (fiTasks.length === 0) continue;
+      shouldComplete = fiTasks.every(
+        (t) => t.status === 'done' || t.status === 'not_relevant',
+      );
+    } else if (phase.completionType === PhaseCompletionType.AUTO_POLICIES) {
+      const { total, published } = scores.policies;
+      shouldComplete = total > 0 && published >= total;
+    } else if (phase.completionType === PhaseCompletionType.AUTO_PEOPLE) {
+      const { total, completed } = scores.people;
+      shouldComplete = total > 0 && completed >= total;
+    } else if (phase.completionType === PhaseCompletionType.AUTO_FINDINGS) {
+      if (!phase.startDate) continue;
+
+      const phaseStartTime = phase.startDate.getTime();
+      const findingType = getFindingTypeForFrameworkName(
+        phase.instance.frameworkInstance.framework?.name,
+      );
+
+      if (!findingType) continue;
+
+      const relevantFindings = findingsForAutoCompletion.filter((finding) => {
+        if (finding.createdAt.getTime() < phaseStartTime) return false;
+        return finding.type === findingType;
+      });
+
+      // Don't auto-complete phases where no findings were ever raised.
+      if (relevantFindings.length === 0) continue;
+
+      shouldComplete = relevantFindings.every(
+        (finding) => finding.status === FindingStatus.closed,
+      );
+    }
+
+    if (!shouldComplete) continue;
+
+    try {
+      await timelinesService.completePhase(
+        phase.instance.id,
+        phase.id,
+        phase.instance.organizationId,
+      );
+    } catch (err) {
+      logger.warn(
+        `Auto-complete failed for phase ${phase.id}`,
+        err instanceof Error ? err.message : err,
+      );
+    }
+  }
+}
diff --git a/apps/api/src/frameworks/frameworks.module.ts b/apps/api/src/frameworks/frameworks.module.ts
index b6d956e7fd..53068441fe 100644
--- a/apps/api/src/frameworks/frameworks.module.ts
+++ b/apps/api/src/frameworks/frameworks.module.ts
@@ -1,10 +1,11 @@
 import { Module } from '@nestjs/common';
 import { AuthModule } from '../auth/auth.module';
+import { TimelinesModule } from '../timelines/timelines.module';
 import { FrameworksController } from './frameworks.controller';
 import { FrameworksService } from './frameworks.service';
 
 @Module({
-  imports: [AuthModule],
+  imports: [AuthModule, TimelinesModule],
   controllers: [FrameworksController],
   providers: [FrameworksService],
   exports: [FrameworksService],
diff --git a/apps/api/src/frameworks/frameworks.service.ts b/apps/api/src/frameworks/frameworks.service.ts
index 6947aa8524..f00ec0768e 100644
--- a/apps/api/src/frameworks/frameworks.service.ts
+++ b/apps/api/src/frameworks/frameworks.service.ts
@@ -1,6 +1,7 @@
 import {
   BadRequestException,
   Injectable,
+  Logger,
   NotFoundException,
 } from '@nestjs/common';
 import { db, type EvidenceFormType } from '@db';
@@ -10,6 +11,8 @@ import {
   computeFrameworkComplianceScore,
 } from './frameworks-scores.helper';
 import { upsertOrgFrameworkStructure } from './frameworks-upsert.helper';
+import { createTimelinesForFrameworks } from './frameworks-timeline.helper';
+import { TimelinesService } from '../timelines/timelines.service';
 
 type RequirementDef = {
   id: string;
@@ -22,6 +25,10 @@ type RequirementDef = {
 
 @Injectable()
 export class FrameworksService {
+  private readonly logger = new Logger(FrameworksService.name);
+
+  constructor(private readonly timelinesService: TimelinesService) {}
+
   private async loadRequirementDefinitions(fi: {
     frameworkId: string | null;
     customFrameworkId: string | null;
@@ -414,6 +421,11 @@ export class FrameworksService {
       getOverviewScores(organizationId),
       userId ? getCurrentMember(organizationId, userId) : Promise.resolve(null),
     ]);
+
+    // checkAutoCompletePhases is driven from mutation hooks in
+    // tasks/policies/people/findings/evidence-forms services (it also triggers
+    // regression reconciliation via reconcileAutoPhasesForOrganization), so
+    // the dashboard read path no longer needs to fire it on every call.
     return { ...scores, currentMember };
   }
 
@@ -439,10 +451,23 @@ export class FrameworksService {
         tx,
       });
 
-      return { success: true, frameworksAdded: finalIds.length };
+      return { success: true, frameworksAdded: finalIds.length, finalIds };
+    });
+
+    // Auto-create timeline instances from templates for newly added
+    // frameworks. Fire-and-forget so a timeline-creation failure never masks
+    // the primary transaction's success — partial state (e.g. only one SOC 2
+    // track created) is repaired on the next /timelines read because
+    // ensureTimelinesExist now always calls backfill (idempotent per track).
+    createTimelinesForFrameworks({
+      organizationId,
+      frameworkEditorIds: result.finalIds,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('createTimelinesForFrameworks failed after framework add', err);
     });
 
-    return result;
+    return { success: result.success, frameworksAdded: result.frameworksAdded };
   }
 
   async findRequirement(
diff --git a/apps/api/src/integration-platform/controllers/admin-integrations.controller.ts b/apps/api/src/integration-platform/controllers/admin-integrations.controller.ts
index ccf49286f7..46de4839c5 100644
--- a/apps/api/src/integration-platform/controllers/admin-integrations.controller.ts
+++ b/apps/api/src/integration-platform/controllers/admin-integrations.controller.ts
@@ -12,8 +12,8 @@ import {
   UseInterceptors,
   Req,
 } from '@nestjs/common';
-import { Throttle } from '@nestjs/throttler';
 import { ApiExcludeController } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
 import { OAuthCredentialsService } from '../services/oauth-credentials.service';
 import { PlatformCredentialRepository } from '../repositories/platform-credential.repository';
 import { getAllManifests, getManifest } from '@trycompai/integration-platform';
diff --git a/apps/api/src/integration-platform/services/dynamic-manifest-loader.service.ts b/apps/api/src/integration-platform/services/dynamic-manifest-loader.service.ts
index 8a827f18cd..9bdb30f449 100644
--- a/apps/api/src/integration-platform/services/dynamic-manifest-loader.service.ts
+++ b/apps/api/src/integration-platform/services/dynamic-manifest-loader.service.ts
@@ -68,8 +68,20 @@ export class DynamicManifestLoaderService
     if (error instanceof Prisma.PrismaClientInitializationError) {
       return true;
     }
+    // Prisma known-request errors use P-prefixed codes — P1001 is
+    // "Can't reach database server". System-level codes like ECONNREFUSED
+    // only appear in the underlying Error.message, handled below.
+    if (
+      error instanceof Prisma.PrismaClientKnownRequestError &&
+      error.code === 'P1001'
+    ) {
+      return true;
+    }
     if (error instanceof Error) {
-      return error.message.includes("Can't reach database server");
+      return (
+        error.message.includes("Can't reach database server") ||
+        error.message.includes('ECONNREFUSED')
+      );
     }
     return false;
   }
diff --git a/apps/api/src/people/people-invite.service.spec.ts b/apps/api/src/people/people-invite.service.spec.ts
index f3c9e31fd3..420c2c8760 100644
--- a/apps/api/src/people/people-invite.service.spec.ts
+++ b/apps/api/src/people/people-invite.service.spec.ts
@@ -1,6 +1,7 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { BadRequestException, ForbiddenException } from '@nestjs/common';
 import { PeopleInviteService } from './people-invite.service';
+import { TimelinesService } from '../timelines/timelines.service';
 
 jest.mock('@db', () => ({
   db: {
@@ -42,9 +43,14 @@ const mockTriggerEmail = triggerEmail as jest.Mock;
 describe('PeopleInviteService', () => {
   let service: PeopleInviteService;
 
+  const mockTimelinesService = {};
+
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
-      providers: [PeopleInviteService],
+      providers: [
+        PeopleInviteService,
+        { provide: TimelinesService, useValue: mockTimelinesService },
+      ],
     }).compile();
 
     service = module.get<PeopleInviteService>(PeopleInviteService);
diff --git a/apps/api/src/people/people-invite.service.ts b/apps/api/src/people/people-invite.service.ts
index 5a55212ce6..3f6dcc0c9f 100644
--- a/apps/api/src/people/people-invite.service.ts
+++ b/apps/api/src/people/people-invite.service.ts
@@ -8,6 +8,8 @@ import { db } from '@db';
 import { triggerEmail } from '../email/trigger-email';
 import { InviteEmail } from '../email/templates/invite-member';
 import type { InviteItemDto } from './dto/invite-people.dto';
+import { checkAutoCompletePhases } from '../frameworks/frameworks-timeline.helper';
+import { TimelinesService } from '../timelines/timelines.service';
 
 export interface InviteResult {
   email: string;
@@ -20,6 +22,8 @@ export interface InviteResult {
 export class PeopleInviteService {
   private readonly logger = new Logger(PeopleInviteService.name);
 
+  constructor(private readonly timelinesService: TimelinesService) {}
+
   async inviteMembers(params: {
     organizationId: string;
     invites: InviteItemDto[];
@@ -95,6 +99,17 @@ export class PeopleInviteService {
       }
     }
 
+    // Check timeline auto-completion after inviting members (people metrics may change)
+    const hasSuccessfulInvites = results.some((r) => r.success);
+    if (hasSuccessfulInvites) {
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+    }
+
     return results;
   }
 
diff --git a/apps/api/src/people/people.module.ts b/apps/api/src/people/people.module.ts
index 87c878e8aa..8d26064f9f 100644
--- a/apps/api/src/people/people.module.ts
+++ b/apps/api/src/people/people.module.ts
@@ -1,12 +1,13 @@
 import { Module } from '@nestjs/common';
 import { AuthModule } from '../auth/auth.module';
+import { TimelinesModule } from '../timelines/timelines.module';
 import { FleetService } from '../lib/fleet.service';
 import { PeopleController } from './people.controller';
 import { PeopleService } from './people.service';
 import { PeopleInviteService } from './people-invite.service';
 
 @Module({
-  imports: [AuthModule],
+  imports: [AuthModule, TimelinesModule],
   controllers: [PeopleController],
   providers: [PeopleService, PeopleInviteService, FleetService],
   exports: [PeopleService],
diff --git a/apps/api/src/people/people.service.spec.ts b/apps/api/src/people/people.service.spec.ts
index b6ce94971f..ea0a77b7d5 100644
--- a/apps/api/src/people/people.service.spec.ts
+++ b/apps/api/src/people/people.service.spec.ts
@@ -6,6 +6,7 @@ import {
 } from '@nestjs/common';
 import { PeopleService } from './people.service';
 import { FleetService } from '../lib/fleet.service';
+import { TimelinesService } from '../timelines/timelines.service';
 import { MemberValidator } from './utils/member-validator';
 import { MemberQueries } from './utils/member-queries';
 
@@ -85,11 +86,14 @@ describe('PeopleService', () => {
     removeHostById: jest.fn(),
   };
 
+  const mockTimelinesService = {};
+
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
       providers: [
         PeopleService,
         { provide: FleetService, useValue: mockFleetService },
+        { provide: TimelinesService, useValue: mockTimelinesService },
       ],
     }).compile();
 
diff --git a/apps/api/src/people/people.service.ts b/apps/api/src/people/people.service.ts
index 9f36b2cba9..e0ab4cc2e5 100644
--- a/apps/api/src/people/people.service.ts
+++ b/apps/api/src/people/people.service.ts
@@ -20,12 +20,17 @@ import {
   removeMemberFromOrgChart,
   notifyOwnerOfUnassignedItems,
 } from './utils/member-deactivation';
+import { checkAutoCompletePhases } from '../frameworks/frameworks-timeline.helper';
+import { TimelinesService } from '../timelines/timelines.service';
 
 @Injectable()
 export class PeopleService {
   private readonly logger = new Logger(PeopleService.name);
 
-  constructor(private readonly fleetService: FleetService) {}
+  constructor(
+    private readonly fleetService: FleetService,
+    private readonly timelinesService: TimelinesService,
+  ) {}
 
   async findAllByOrganization(
     organizationId: string,
@@ -170,6 +175,15 @@ export class PeopleService {
       this.logger.log(
         `Created member: ${member.user.name} (${member.id}) for organization ${organizationId}`,
       );
+
+      // Check timeline auto-completion after member creation (people metrics may change)
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
       return member;
     } catch (error) {
       if (
@@ -251,6 +265,16 @@ export class PeopleService {
         `Bulk create completed for organization ${organizationId}: ${summary.successful}/${summary.total} successful`,
       );
 
+      // Check timeline auto-completion after bulk member creation
+      if (created.length > 0) {
+        checkAutoCompletePhases({
+          organizationId,
+          timelinesService: this.timelinesService,
+        }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+      }
+
       return { created, errors, summary };
     } catch (error) {
       if (error instanceof NotFoundException) {
@@ -380,6 +404,14 @@ export class PeopleService {
       `Deactivated member: ${member.user.name} (${memberId}) from organization ${organizationId}`,
     );
 
+    // Check timeline auto-completion after member deactivation (people metrics may change)
+    checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
     return {
       success: true,
       deletedMember: {
@@ -414,11 +446,21 @@ export class PeopleService {
       );
     }
 
-    return db.member.update({
+    const reactivatedMember = await db.member.update({
       where: { id: memberId, organizationId },
       data: { deactivated: false, isActive: true },
       select: MemberQueries.MEMBER_SELECT,
     });
+
+    // Check timeline auto-completion after member reactivation (people metrics may change)
+    checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
+    return reactivatedMember;
   }
 
   async unlinkDevice(
diff --git a/apps/api/src/policies/policies.module.ts b/apps/api/src/policies/policies.module.ts
index e4e742c3b2..14ff3901a6 100644
--- a/apps/api/src/policies/policies.module.ts
+++ b/apps/api/src/policies/policies.module.ts
@@ -1,12 +1,13 @@
 import { Module } from '@nestjs/common';
 import { AttachmentsModule } from '../attachments/attachments.module';
 import { AuthModule } from '../auth/auth.module';
+import { TimelinesModule } from '../timelines/timelines.module';
 import { PolicyPdfRendererService } from '../trust-portal/policy-pdf-renderer.service';
 import { PoliciesController } from './policies.controller';
 import { PoliciesService } from './policies.service';
 
 @Module({
-  imports: [AuthModule, AttachmentsModule],
+  imports: [AuthModule, AttachmentsModule, TimelinesModule],
   controllers: [PoliciesController],
   providers: [PoliciesService, PolicyPdfRendererService],
   exports: [PoliciesService],
diff --git a/apps/api/src/policies/policies.service.spec.ts b/apps/api/src/policies/policies.service.spec.ts
index 8642a55bc4..42487bc8a7 100644
--- a/apps/api/src/policies/policies.service.spec.ts
+++ b/apps/api/src/policies/policies.service.spec.ts
@@ -3,6 +3,7 @@ import { NotFoundException } from '@nestjs/common';
 import { PoliciesService } from './policies.service';
 import { AttachmentsService } from '../attachments/attachments.service';
 import { PolicyPdfRendererService } from '../trust-portal/policy-pdf-renderer.service';
+import { TimelinesService } from '../timelines/timelines.service';
 
 jest.mock('@db', () => ({
   db: {
@@ -93,6 +94,9 @@ describe('PoliciesService', () => {
         PoliciesService,
         { provide: AttachmentsService, useValue: mockAttachmentsService },
         { provide: PolicyPdfRendererService, useValue: {} },
+        // TimelinesService is injected for timeline auto-completion hooks;
+        // tests don't exercise that path so a bare stub is enough.
+        { provide: TimelinesService, useValue: {} },
       ],
     }).compile();
     service = module.get<PoliciesService>(PoliciesService);
diff --git a/apps/api/src/policies/policies.service.ts b/apps/api/src/policies/policies.service.ts
index 9f3b2ad4be..ff4b6d2fad 100644
--- a/apps/api/src/policies/policies.service.ts
+++ b/apps/api/src/policies/policies.service.ts
@@ -17,6 +17,8 @@ import type {
   SubmitForApprovalDto,
   UpdateVersionContentDto,
 } from './dto/version.dto';
+import { checkAutoCompletePhases } from '../frameworks/frameworks-timeline.helper';
+import { TimelinesService } from '../timelines/timelines.service';
 
 function computeNextReviewDate(frequency: Frequency | null | undefined): Date {
   const now = new Date();
@@ -40,6 +42,7 @@ export class PoliciesService {
   constructor(
     private readonly attachmentsService: AttachmentsService,
     private readonly pdfRendererService: PolicyPdfRendererService,
+    private readonly timelinesService: TimelinesService,
   ) {}
 
   async findAll(organizationId: string) {
@@ -158,6 +161,14 @@ export class PoliciesService {
       organizationId,
     );
 
+    // Check timeline auto-completion after bulk publish
+    checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed after publish-all', err);
+    });
+
     return {
       success: true,
       publishedCount: draftPolicies.length,
@@ -304,6 +315,15 @@ export class PoliciesService {
       });
 
       this.logger.log(`Created policy: ${policy.name} (${policy.id})`);
+
+      // Check timeline auto-completion after policy creation
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
       return policy;
     } catch (error) {
       this.logger.error(
@@ -406,6 +426,15 @@ export class PoliciesService {
       });
 
       this.logger.log(`Updated policy: ${updatedPolicy.name} (${id})`);
+
+      // Check timeline auto-completion after policy update (status may have changed)
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
       return updatedPolicy;
     } catch (error) {
       if (error instanceof NotFoundException) {
@@ -476,6 +505,15 @@ export class PoliciesService {
       });
 
       this.logger.log(`Deleted policy: ${policy.name} (${id})`);
+
+      // Check timeline auto-completion after policy deletion
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
       return { success: true, deletedPolicy: policy };
     } catch (error) {
       if (error instanceof NotFoundException) {
@@ -837,7 +875,7 @@ export class PoliciesService {
 
     for (let attempt = 1; attempt <= this.versionCreateRetries; attempt += 1) {
       try {
-        return await db.$transaction(async (tx) => {
+        const result = await db.$transaction(async (tx) => {
           const latestVersion = await tx.policyVersion.findFirst({
             where: { policyId },
             orderBy: { version: 'desc' },
@@ -880,6 +918,16 @@ export class PoliciesService {
             version: nextVersion,
           };
         });
+
+        // Check timeline auto-completion after publishing a version
+        checkAutoCompletePhases({
+          organizationId,
+          timelinesService: this.timelinesService,
+        }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
+        return result;
       } catch (error) {
         if (
           this.isUniqueConstraintError(error) &&
@@ -935,6 +983,14 @@ export class PoliciesService {
       },
     });
 
+    // Check timeline auto-completion after setting active version
+    checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
     return {
       versionId: version.id,
       version: version.version,
@@ -1087,6 +1143,14 @@ export class PoliciesService {
       });
     });
 
+    // Check timeline auto-completion after accepting changes (policy published)
+    checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
     return { versionId: version.id, version: version.version };
   }
 
diff --git a/apps/api/src/tasks/tasks.module.ts b/apps/api/src/tasks/tasks.module.ts
index 888d2503e3..0693bf30cf 100644
--- a/apps/api/src/tasks/tasks.module.ts
+++ b/apps/api/src/tasks/tasks.module.ts
@@ -2,13 +2,14 @@ import { Module, forwardRef } from '@nestjs/common';
 import { AttachmentsModule } from '../attachments/attachments.module';
 import { AuthModule } from '../auth/auth.module';
 import { AutomationsModule } from './automations/automations.module';
+import { TimelinesModule } from '../timelines/timelines.module';
 import { NovuService } from '../notifications/novu.service';
 import { TasksController } from './tasks.controller';
 import { TasksService } from './tasks.service';
 import { TaskNotifierService } from './task-notifier.service';
 
 @Module({
-  imports: [AuthModule, AttachmentsModule, forwardRef(() => AutomationsModule)],
+  imports: [AuthModule, AttachmentsModule, forwardRef(() => AutomationsModule), TimelinesModule],
   controllers: [TasksController],
   providers: [TasksService, TaskNotifierService, NovuService],
   exports: [TasksService, TaskNotifierService],
diff --git a/apps/api/src/tasks/tasks.service.ts b/apps/api/src/tasks/tasks.service.ts
index dd19c9dda6..ae4896ad14 100644
--- a/apps/api/src/tasks/tasks.service.ts
+++ b/apps/api/src/tasks/tasks.service.ts
@@ -3,12 +3,15 @@ import {
   ForbiddenException,
   Injectable,
   InternalServerErrorException,
+  Logger,
   NotFoundException,
 } from '@nestjs/common';
 import { filterDescriptionByFrameworks } from './description-framework-filter';
 import { db, TaskStatus, Prisma, TaskFrequency, Departments } from '@db';
 import { TaskResponseDto } from './dto/task-responses.dto';
 import { TaskNotifierService } from './task-notifier.service';
+import { checkAutoCompletePhases } from '../frameworks/frameworks-timeline.helper';
+import { TimelinesService } from '../timelines/timelines.service';
 
 function computeNextTaskReviewDate(
   frequency: TaskFrequency | null | undefined,
@@ -32,7 +35,12 @@ function computeNextTaskReviewDate(
 
 @Injectable()
 export class TasksService {
-  constructor(private readonly taskNotifierService: TaskNotifierService) {}
+  private readonly logger = new Logger(TasksService.name);
+
+  constructor(
+    private readonly taskNotifierService: TaskNotifierService,
+    private readonly timelinesService: TimelinesService,
+  ) {}
 
   /**
    * Resolve a user actor for API-key authenticated requests.
@@ -406,6 +414,17 @@ export class TasksService {
           );
         });
 
+      // Any task status change can shift AUTO_TASKS metric in either
+      // direction (done/not_relevant can complete a phase; back to
+      // todo/in_progress can regress one). checkAutoCompletePhases also
+      // kicks off regression reconciliation, so fire on every change.
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
       return { updatedCount: result.count };
     } catch (error) {
       console.error('Error updating task statuses:', error);
@@ -505,6 +524,14 @@ export class TasksService {
         );
       }
 
+      // Check timeline auto-completion after bulk task deletion (total task count changed)
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
       return { deletedCount: result.count };
     } catch (error) {
       console.error('Error deleting tasks:', error);
@@ -691,6 +718,15 @@ export class TasksService {
           .catch((error) => {
             console.error('Failed to send status change notifications:', error);
           });
+
+        // Any status change can shift AUTO_TASKS metric in either direction,
+        // and checkAutoCompletePhases also triggers regression reconciliation.
+        checkAutoCompletePhases({
+          organizationId,
+          timelinesService: this.timelinesService,
+        }).catch((err) => {
+          this.logger.warn('timeline auto-complete check failed', err);
+        });
       }
 
       // Write audit logs and send notifications for assignee changes
@@ -821,6 +857,16 @@ export class TasksService {
         },
       });
 
+      // Task creation drops the AUTO_TASKS completion % (denominator up,
+      // numerator unchanged), so reconciliation can regress a COMPLETED
+      // phase back to IN_PROGRESS if we're now under 100%.
+      checkAutoCompletePhases({
+        organizationId,
+        timelinesService: this.timelinesService,
+      }).catch((err) => {
+        this.logger.warn('timeline auto-complete check failed', err);
+      });
+
       return {
         id: task.id,
         title: task.title,
@@ -900,6 +946,14 @@ export class TasksService {
     await db.task.delete({
       where: { id: taskId },
     });
+
+    // Check timeline auto-completion after task deletion (total task count changed)
+    checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
   }
 
   /**
@@ -1164,6 +1218,14 @@ export class TasksService {
       return updated;
     });
 
+    // Check timeline auto-completion when task is approved (status changed to done)
+    checkAutoCompletePhases({
+      organizationId,
+      timelinesService: this.timelinesService,
+    }).catch((err) => {
+      this.logger.warn('timeline auto-complete check failed', err);
+    });
+
     return updatedTask;
   }
 
diff --git a/apps/api/src/timelines/admin-org-timelines.controller.ts b/apps/api/src/timelines/admin-org-timelines.controller.ts
new file mode 100644
index 0000000000..d794f8e245
--- /dev/null
+++ b/apps/api/src/timelines/admin-org-timelines.controller.ts
@@ -0,0 +1,181 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Patch,
+  Delete,
+  Param,
+  Body,
+  Req,
+  BadRequestException,
+  UseGuards,
+  UseInterceptors,
+  UsePipes,
+  ValidationPipe,
+} from '@nestjs/common';
+import { ApiExcludeController } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
+import { PlatformAdminGuard } from '../auth/platform-admin.guard';
+import { AdminAuditLogInterceptor } from '../admin-organizations/admin-audit-log.interceptor';
+import { TimelinesService } from './timelines.service';
+import { TimelinesPhasesService } from './timelines-phases.service';
+import { ActivateTimelineDto } from './dto/activate-timeline.dto';
+import { UpdatePhaseDto } from './dto/update-phase.dto';
+import { AddPhaseToInstanceDto } from './dto/create-phase-template.dto';
+import { UnlockTimelineDto } from './dto/unlock-timeline.dto';
+import { PhaseCompletionType } from '@db';
+
+@ApiExcludeController()
+@Controller({ path: 'admin/organizations', version: '1' })
+@UseGuards(PlatformAdminGuard)
+@UseInterceptors(AdminAuditLogInterceptor)
+@Throttle({ default: { ttl: 60000, limit: 30 } })
+@UsePipes(
+  new ValidationPipe({
+    whitelist: true,
+    forbidNonWhitelisted: true,
+    transform: true,
+  }),
+)
+export class AdminOrgTimelinesController {
+  constructor(
+    private readonly timelinesService: TimelinesService,
+    private readonly phasesService: TimelinesPhasesService,
+  ) {}
+
+  @Get(':orgId/timelines')
+  async findAll(@Param('orgId') orgId: string) {
+    const data = await this.timelinesService.findAllForOrganization(orgId);
+    return { data, count: data.length };
+  }
+
+  @Post(':orgId/timelines/:id/activate')
+  async activate(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+    @Body() dto: ActivateTimelineDto,
+  ) {
+    return this.timelinesService.activate(
+      id,
+      orgId,
+      new Date(dto.startDate),
+    );
+  }
+
+  @Post(':orgId/timelines/:id/pause')
+  async pause(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+  ) {
+    return this.timelinesService.pauseTimeline(id, orgId);
+  }
+
+  @Post(':orgId/timelines/:id/resume')
+  async resume(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+  ) {
+    return this.timelinesService.resumeTimeline(id, orgId);
+  }
+
+  @Patch(':orgId/timelines/:id/phases/:phaseId')
+  async updatePhase(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+    @Param('phaseId') phaseId: string,
+    @Body() dto: UpdatePhaseDto,
+  ) {
+    return this.phasesService.updatePhase(id, phaseId, orgId, {
+      name: dto.name,
+      description: dto.description,
+      durationWeeks: dto.durationWeeks,
+      startDate: dto.startDate ? new Date(dto.startDate) : undefined,
+      endDate: dto.endDate ? new Date(dto.endDate) : undefined,
+      datesPinned: dto.datesPinned,
+      completionType: dto.completionType as PhaseCompletionType | undefined,
+      locksTimelineOnComplete: dto.locksTimelineOnComplete,
+    });
+  }
+
+  @Post(':orgId/timelines/:id/phases')
+  async addPhase(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+    @Body() dto: AddPhaseToInstanceDto,
+  ) {
+    return this.phasesService.addPhase(id, orgId, {
+      name: dto.name,
+      description: dto.description,
+      orderIndex: dto.orderIndex,
+      durationWeeks: dto.durationWeeks,
+      completionType: dto.completionType as PhaseCompletionType | undefined,
+    });
+  }
+
+  @Delete(':orgId/timelines/:id/phases/:phaseId')
+  async removePhase(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+    @Param('phaseId') phaseId: string,
+  ) {
+    return this.phasesService.removePhase(id, phaseId, orgId);
+  }
+
+  @Post(':orgId/timelines/:id/phases/:phaseId/complete')
+  async completePhase(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+    @Param('phaseId') phaseId: string,
+    @Req() req: { userId?: string },
+  ) {
+    return this.timelinesService.completePhase(id, phaseId, orgId, req.userId);
+  }
+
+  @Post(':orgId/timelines/:id/next-cycle')
+  async startNextCycle(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+  ) {
+    return this.timelinesService.startNextCycle(id, orgId);
+  }
+
+  @Post(':orgId/timelines/:id/reset')
+  async resetTimeline(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+  ) {
+    return this.timelinesService.resetInstance(id, orgId);
+  }
+
+  @Post(':orgId/timelines/:id/unlock')
+  async unlockTimeline(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+    @Body() dto: UnlockTimelineDto,
+    @Req() req: { userId?: string },
+  ) {
+    if (!req.userId) {
+      throw new BadRequestException('Unable to resolve acting admin user');
+    }
+
+    return this.timelinesService.unlockTimeline(
+      id,
+      orgId,
+      req.userId,
+      dto.unlockReason,
+    );
+  }
+
+  @Delete(':orgId/timelines/:id')
+  async deleteTimeline(
+    @Param('orgId') orgId: string,
+    @Param('id') id: string,
+  ) {
+    return this.timelinesService.deleteInstance(id, orgId);
+  }
+
+  @Post(':orgId/timelines/recreate')
+  async recreateTimelines(@Param('orgId') orgId: string) {
+    return this.timelinesService.recreateAllForOrganization(orgId);
+  }
+}
diff --git a/apps/api/src/timelines/admin-timeline-templates.controller.ts b/apps/api/src/timelines/admin-timeline-templates.controller.ts
new file mode 100644
index 0000000000..572051a20c
--- /dev/null
+++ b/apps/api/src/timelines/admin-timeline-templates.controller.ts
@@ -0,0 +1,112 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Patch,
+  Delete,
+  Param,
+  Body,
+  UseGuards,
+  UsePipes,
+  ValidationPipe,
+} from '@nestjs/common';
+import { ApiExcludeController } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
+import { PlatformAdminGuard } from '../auth/platform-admin.guard';
+import { TimelinesTemplatesService } from './timelines-templates.service';
+import { CreateTemplateDto } from './dto/create-template.dto';
+import { UpdateTemplateDto } from './dto/update-template.dto';
+import { CreatePhaseTemplateDto } from './dto/create-phase-template.dto';
+import { UpdatePhaseTemplateDto } from './dto/update-phase-template.dto';
+import { PhaseCompletionType } from '@db';
+
+@ApiExcludeController()
+@Controller({ path: 'admin/timeline-templates', version: '1' })
+@UseGuards(PlatformAdminGuard)
+@Throttle({ default: { ttl: 60000, limit: 30 } })
+@UsePipes(
+  new ValidationPipe({
+    whitelist: true,
+    forbidNonWhitelisted: true,
+    transform: true,
+  }),
+)
+export class AdminTimelineTemplatesController {
+  constructor(
+    private readonly templatesService: TimelinesTemplatesService,
+  ) {}
+
+  @Get()
+  async findAll() {
+    const data = await this.templatesService.findAll();
+    return { data, count: data.length };
+  }
+
+  @Get(':id')
+  async findOne(@Param('id') id: string) {
+    return this.templatesService.findOne(id);
+  }
+
+  @Post()
+  async create(@Body() dto: CreateTemplateDto) {
+    return this.templatesService.create({
+      frameworkId: dto.frameworkId,
+      name: dto.name,
+      cycleNumber: dto.cycleNumber,
+    });
+  }
+
+  @Patch(':id')
+  async update(@Param('id') id: string, @Body() dto: UpdateTemplateDto) {
+    return this.templatesService.update(id, {
+      name: dto.name,
+      cycleNumber: dto.cycleNumber,
+    });
+  }
+
+  @Delete(':id')
+  async delete(@Param('id') id: string) {
+    return this.templatesService.delete(id);
+  }
+
+  @Post(':id/phases')
+  async addPhase(
+    @Param('id') templateId: string,
+    @Body() dto: CreatePhaseTemplateDto,
+  ) {
+    return this.templatesService.addPhase(templateId, {
+      name: dto.name,
+      description: dto.description,
+      groupLabel: dto.groupLabel,
+      orderIndex: dto.orderIndex,
+      defaultDurationWeeks: dto.defaultDurationWeeks,
+      completionType: dto.completionType as PhaseCompletionType | undefined,
+      locksTimelineOnComplete: dto.locksTimelineOnComplete,
+    });
+  }
+
+  @Patch(':id/phases/:phaseId')
+  async updatePhase(
+    @Param('id') templateId: string,
+    @Param('phaseId') phaseId: string,
+    @Body() dto: UpdatePhaseTemplateDto,
+  ) {
+    return this.templatesService.updatePhase(templateId, phaseId, {
+      name: dto.name,
+      description: dto.description,
+      groupLabel: dto.groupLabel,
+      orderIndex: dto.orderIndex,
+      defaultDurationWeeks: dto.defaultDurationWeeks,
+      completionType: dto.completionType as PhaseCompletionType | undefined,
+      locksTimelineOnComplete: dto.locksTimelineOnComplete,
+    });
+  }
+
+  @Delete(':id/phases/:phaseId')
+  async deletePhase(
+    @Param('id') templateId: string,
+    @Param('phaseId') phaseId: string,
+  ) {
+    return this.templatesService.deletePhase(templateId, phaseId);
+  }
+}
diff --git a/apps/api/src/timelines/default-templates.spec.ts b/apps/api/src/timelines/default-templates.spec.ts
new file mode 100644
index 0000000000..34ac24e112
--- /dev/null
+++ b/apps/api/src/timelines/default-templates.spec.ts
@@ -0,0 +1,98 @@
+import {
+  getDefaultTemplateForCycle,
+  getDefaultTemplatesForFramework,
+  GENERIC_DEFAULT_TIMELINE_TEMPLATE,
+} from './default-templates';
+
+describe('default-templates', () => {
+  it('matches framework defaults using normalized names', () => {
+    const soc2Templates = getDefaultTemplatesForFramework('SOC2');
+
+    expect(soc2Templates.map((template) => template.cycleNumber).sort()).toEqual([1, 1, 2]);
+  });
+
+  it('defines independent SOC 2 tracks with their own cycle 1 templates', () => {
+    const soc2Templates = getDefaultTemplatesForFramework('SOC 2');
+
+    const cycle1Tracks = soc2Templates
+      .filter((template) => template.cycleNumber === 1)
+      .map((template) => template.trackKey);
+
+    expect(cycle1Tracks.sort()).toEqual(['soc2_type1', 'soc2_type2']);
+  });
+
+  it('returns SOC 2 Type 2 default with observation phase lock enabled', () => {
+    const template = getDefaultTemplateForCycle('SOC2', 1, {
+      trackKey: 'soc2_type2',
+    });
+
+    expect(template?.name).toBe('SOC 2 Type 2');
+    const observationPhase = template?.phases.find((phase) =>
+      phase.name.toLowerCase().includes('observation'),
+    );
+
+    expect(observationPhase).toBeDefined();
+    expect(observationPhase?.locksTimelineOnComplete).toBe(true);
+  });
+
+  it('sets Auditor Review phases to AUTO_FINDINGS for SOC 2 templates', () => {
+    const type1 = getDefaultTemplateForCycle('SOC 2', 1, {
+      trackKey: 'soc2_type1',
+    });
+    const type2 = getDefaultTemplateForCycle('SOC 2', 1, {
+      trackKey: 'soc2_type2',
+    });
+    const legacyType1 = getDefaultTemplateForCycle('SOC 2 v.1', 1, {
+      trackKey: 'primary',
+    });
+
+    const type1AuditorReview = type1?.phases.find((phase) => phase.name === 'Auditor Review');
+    const type2AuditorReview = type2?.phases.find((phase) => phase.name === 'Auditor Review');
+    const legacyAuditorReview = legacyType1?.phases.find(
+      (phase) => phase.name === 'Auditor Review',
+    );
+
+    expect(type1AuditorReview?.completionType).toBe('AUTO_FINDINGS');
+    expect(type2AuditorReview?.completionType).toBe('AUTO_FINDINGS');
+    expect(legacyAuditorReview?.completionType).toBe('AUTO_FINDINGS');
+  });
+
+  it('defines explicit SOC 2 progression within each independent track', () => {
+    const type1 = getDefaultTemplateForCycle('SOC 2', 1, {
+      trackKey: 'soc2_type1',
+    });
+    const type2Year1 = getDefaultTemplateForCycle('SOC 2', 1, {
+      trackKey: 'soc2_type2',
+    });
+    const renewal = getDefaultTemplateForCycle('SOC 2', 2, {
+      trackKey: 'soc2_type2',
+    });
+
+    expect(type1?.templateKey).toBe('soc2_type1');
+    expect(type1?.nextTemplateKey).toBe('soc2_type1');
+
+    expect(type2Year1?.templateKey).toBe('soc2_type2_year1');
+    expect(type2Year1?.nextTemplateKey).toBe('soc2_type2_renewal');
+
+    expect(renewal?.templateKey).toBe('soc2_type2_renewal');
+    expect(renewal?.nextTemplateKey).toBe('soc2_type2_renewal');
+    expect(renewal?.name).toBe('SOC 2 Type 2');
+  });
+
+  it('falls back to framework defaults when an unknown track key is requested', () => {
+    const template = getDefaultTemplateForCycle('SOC 2', 1, {
+      trackKey: 'unknown_track',
+    });
+
+    expect(template?.frameworkName).toBe('SOC 2');
+    expect(template?.name).toBe('SOC 2 Type 1');
+  });
+
+  it('returns generic fallback template when framework has no specific default', () => {
+    const template = getDefaultTemplateForCycle('Custom Framework XYZ', 1);
+
+    expect(template?.name).toBe(GENERIC_DEFAULT_TIMELINE_TEMPLATE.name);
+    expect(template?.phases.length).toBe(GENERIC_DEFAULT_TIMELINE_TEMPLATE.phases.length);
+    expect(template?.phases.some((phase) => phase.locksTimelineOnComplete)).toBe(false);
+  });
+});
diff --git a/apps/api/src/timelines/default-templates.ts b/apps/api/src/timelines/default-templates.ts
new file mode 100644
index 0000000000..93350b75fd
--- /dev/null
+++ b/apps/api/src/timelines/default-templates.ts
@@ -0,0 +1,487 @@
+/**
+ * Mirrors the PhaseCompletionType enum from packages/db/prisma/schema/timeline.prisma.
+ * Defined locally because the API's Prisma client hasn't been regenerated with
+ * the timeline schema yet. Values MUST stay in sync with the Prisma enum.
+ */
+export const PhaseCompletionType = {
+  AUTO_TASKS: 'AUTO_TASKS',
+  AUTO_POLICIES: 'AUTO_POLICIES',
+  AUTO_PEOPLE: 'AUTO_PEOPLE',
+  AUTO_FINDINGS: 'AUTO_FINDINGS',
+  AUTO_UPLOAD: 'AUTO_UPLOAD',
+  MANUAL: 'MANUAL',
+} as const;
+
+export type PhaseCompletionType =
+  (typeof PhaseCompletionType)[keyof typeof PhaseCompletionType];
+
+export interface DefaultPhaseTemplate {
+  name: string;
+  description: string;
+  groupLabel?: string;
+  orderIndex: number;
+  defaultDurationWeeks: number;
+  completionType: PhaseCompletionType;
+  /**
+   * When true, completing this phase should lock timeline automation state.
+   * This is intended for milestones like SOC 2 Observation Period completion.
+   */
+  locksTimelineOnComplete?: boolean;
+}
+
+export interface DefaultTimelineTemplate {
+  frameworkName: string; // Matched against normalized FrameworkEditorFramework.name
+  name: string; // Display name, e.g. "SOC 2 Type 2"
+  cycleNumber: number;
+  /**
+   * Independent track identifier within a framework.
+   * Example: SOC 2 has separate tracks for Type 1 and Type 2.
+   */
+  trackKey?: string;
+  /**
+   * Stable key to identify this template's semantic meaning.
+   * Enables deterministic transitions across cycles.
+   */
+  templateKey?: string;
+  /**
+   * Stable key for which template should be used on "next cycle".
+   */
+  nextTemplateKey?: string;
+  phases: DefaultPhaseTemplate[];
+}
+
+export const DEFAULT_TIMELINE_TEMPLATES: DefaultTimelineTemplate[] = [
+  // SOC 2 Type 1 - quick point-in-time snapshot (cycle 1)
+  {
+    frameworkName: 'SOC 2',
+    name: 'SOC 2 Type 1',
+    cycleNumber: 1,
+    trackKey: 'soc2_type1',
+    templateKey: 'soc2_type1',
+    nextTemplateKey: 'soc2_type1',
+    phases: [
+      {
+        name: 'Policies',
+        description: 'Review and publish all required compliance policies.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 0,
+        defaultDurationWeeks: 3,
+        completionType: PhaseCompletionType.AUTO_POLICIES,
+      },
+      {
+        name: 'Evidence',
+        description: 'Complete all evidence collection tasks.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 1,
+        defaultDurationWeeks: 4,
+        completionType: PhaseCompletionType.AUTO_TASKS,
+      },
+      {
+        name: 'People',
+        description: 'Ensure all employees complete security training and acknowledgements.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 2,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.AUTO_PEOPLE,
+      },
+      {
+        name: 'Auditor Review',
+        description: 'Auditor reviews your account.',
+        orderIndex: 3,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.AUTO_FINDINGS,
+      },
+      {
+        name: 'Draft Report',
+        description: 'Auditor delivers draft report for review.',
+        orderIndex: 4,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.MANUAL,
+      },
+      {
+        name: 'Final Report',
+        description: 'Final report delivered.',
+        orderIndex: 5,
+        defaultDurationWeeks: 1,
+        completionType: PhaseCompletionType.AUTO_UPLOAD,
+      },
+    ],
+  },
+
+  // SOC 2 Type 2 (cycle 1 in its own track)
+  {
+    frameworkName: 'SOC 2',
+    name: 'SOC 2 Type 2',
+    cycleNumber: 1,
+    trackKey: 'soc2_type2',
+    templateKey: 'soc2_type2_year1',
+    nextTemplateKey: 'soc2_type2_renewal',
+    phases: [
+      {
+        name: 'Policies',
+        description:
+          'Review and publish all required compliance policies.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 0,
+        defaultDurationWeeks: 3,
+        completionType: PhaseCompletionType.AUTO_POLICIES,
+      },
+      {
+        name: 'Evidence',
+        description: 'Complete all evidence collection tasks.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 1,
+        defaultDurationWeeks: 4,
+        completionType: PhaseCompletionType.AUTO_TASKS,
+      },
+      {
+        name: 'People',
+        description:
+          'Ensure all employees complete security training and acknowledgements.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 2,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.AUTO_PEOPLE,
+      },
+      {
+        name: 'Observation Period + Pentest',
+        description:
+          'Observation period to prove sustained compliance. Penetration test is arranged during this phase.',
+        orderIndex: 3,
+        defaultDurationWeeks: 4,
+        completionType: PhaseCompletionType.MANUAL,
+        locksTimelineOnComplete: true,
+      },
+      {
+        name: 'Auditor Review',
+        description: 'Auditor reviews evidence and addresses any feedback.',
+        orderIndex: 4,
+        defaultDurationWeeks: 4,
+        completionType: PhaseCompletionType.AUTO_FINDINGS,
+      },
+      {
+        name: 'Draft Report',
+        description: 'Auditor delivers draft report for review.',
+        orderIndex: 5,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.MANUAL,
+      },
+      {
+        name: 'Final Report',
+        description:
+          'Final report delivered. Your SOC 2 Type 2 certification is complete.',
+        orderIndex: 6,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.AUTO_UPLOAD,
+      },
+    ],
+  },
+
+  // SOC 2 Type 2 renewal (cycle 2+ in the same Type 2 track)
+  {
+    frameworkName: 'SOC 2',
+    name: 'SOC 2 Type 2',
+    cycleNumber: 2,
+    trackKey: 'soc2_type2',
+    templateKey: 'soc2_type2_renewal',
+    nextTemplateKey: 'soc2_type2_renewal',
+    phases: [
+      {
+        name: 'Policies',
+        description:
+          'Review and publish all required compliance policies.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 0,
+        defaultDurationWeeks: 3,
+        completionType: PhaseCompletionType.AUTO_POLICIES,
+      },
+      {
+        name: 'Evidence',
+        description: 'Complete all evidence collection tasks.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 1,
+        defaultDurationWeeks: 4,
+        completionType: PhaseCompletionType.AUTO_TASKS,
+      },
+      {
+        name: 'People',
+        description:
+          'Ensure all employees complete security training and acknowledgements.',
+        groupLabel: 'Preparing for Audit',
+        orderIndex: 2,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.AUTO_PEOPLE,
+      },
+      {
+        name: 'Observation Period + Pentest',
+        description:
+          'Observation period to prove sustained compliance. Penetration test is arranged during this phase.',
+        orderIndex: 3,
+        defaultDurationWeeks: 18,
+        completionType: PhaseCompletionType.MANUAL,
+        locksTimelineOnComplete: true,
+      },
+      {
+        name: 'Auditor Review',
+        description: 'Auditor reviews evidence and addresses any feedback.',
+        orderIndex: 4,
+        defaultDurationWeeks: 4,
+        completionType: PhaseCompletionType.AUTO_FINDINGS,
+      },
+      {
+        name: 'Draft Report',
+        description: 'Auditor delivers draft report for review.',
+        orderIndex: 5,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.MANUAL,
+      },
+      {
+        name: 'Final Report',
+        description:
+          'Final report delivered. Your SOC 2 Type 2 renewal is complete.',
+        orderIndex: 6,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.AUTO_UPLOAD,
+      },
+    ],
+  },
+
+  // SOC 2 v.1 (legacy separate framework - same as Type 1)
+  {
+    frameworkName: 'SOC 2 v.1',
+    name: 'SOC 2 Type 1',
+    cycleNumber: 1,
+    trackKey: 'soc2v1_type1',
+    templateKey: 'soc2v1_type1',
+    nextTemplateKey: 'soc2v1_type1',
+    phases: [
+      {
+        name: 'Evidence Gathering',
+        description:
+          'Complete all platform tasks. This is a point-in-time snapshot assessment.',
+        orderIndex: 0,
+        defaultDurationWeeks: 8,
+        completionType: PhaseCompletionType.AUTO_TASKS,
+      },
+      {
+        name: 'Auditor Review',
+        description: 'Auditor reviews your account.',
+        orderIndex: 1,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.AUTO_FINDINGS,
+      },
+      {
+        name: 'Final Report',
+        description: 'Final report delivered.',
+        orderIndex: 2,
+        defaultDurationWeeks: 1,
+        completionType: PhaseCompletionType.AUTO_UPLOAD,
+      },
+    ],
+  },
+
+  // ISO 27001
+  {
+    frameworkName: 'ISO27001',
+    name: 'ISO 27001',
+    cycleNumber: 1,
+    trackKey: 'primary',
+    templateKey: 'iso27001_primary',
+    nextTemplateKey: 'iso27001_primary',
+    phases: [
+      {
+        name: 'Evidence Gathering',
+        description:
+          'Complete all platform tasks and employee requirements.',
+        orderIndex: 0,
+        defaultDurationWeeks: 8,
+        completionType: PhaseCompletionType.AUTO_TASKS,
+      },
+      {
+        name: 'Stage 1 & 2 Audit',
+        description:
+          'Auditor conducts Stage 1 (Policy) and Stage 2 (Evidence) reviews.',
+        orderIndex: 1,
+        defaultDurationWeeks: 5,
+        completionType: PhaseCompletionType.MANUAL,
+      },
+      {
+        name: 'Certification',
+        description: 'Certification delivered.',
+        orderIndex: 2,
+        defaultDurationWeeks: 1,
+        completionType: PhaseCompletionType.AUTO_UPLOAD,
+      },
+    ],
+  },
+
+  // HIPAA
+  {
+    frameworkName: 'HIPAA',
+    name: 'HIPAA',
+    cycleNumber: 1,
+    trackKey: 'primary',
+    templateKey: 'hipaa_primary',
+    nextTemplateKey: 'hipaa_primary',
+    phases: [
+      {
+        name: 'Evidence Gathering & Training',
+        description:
+          'Complete all platform tasks, evidence, and employee training.',
+        orderIndex: 0,
+        defaultDurationWeeks: 8,
+        completionType: PhaseCompletionType.AUTO_TASKS,
+      },
+      {
+        name: 'Review',
+        description:
+          'We review your compliance and address any findings.',
+        orderIndex: 1,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.MANUAL,
+      },
+      {
+        name: 'Attestation',
+        description: 'Attestation report delivered.',
+        orderIndex: 2,
+        defaultDurationWeeks: 1,
+        completionType: PhaseCompletionType.AUTO_UPLOAD,
+      },
+    ],
+  },
+
+  // GDPR
+  {
+    frameworkName: 'GDPR',
+    name: 'GDPR',
+    cycleNumber: 1,
+    trackKey: 'primary',
+    templateKey: 'gdpr_primary',
+    nextTemplateKey: 'gdpr_primary',
+    phases: [
+      {
+        name: 'Evidence Gathering & Training',
+        description:
+          'Complete all platform tasks, evidence, and employee training.',
+        orderIndex: 0,
+        defaultDurationWeeks: 8,
+        completionType: PhaseCompletionType.AUTO_TASKS,
+      },
+      {
+        name: 'Review',
+        description:
+          'We review your compliance and address any findings.',
+        orderIndex: 1,
+        defaultDurationWeeks: 2,
+        completionType: PhaseCompletionType.MANUAL,
+      },
+      {
+        name: 'Attestation',
+        description: 'Attestation report delivered.',
+        orderIndex: 2,
+        defaultDurationWeeks: 1,
+        completionType: PhaseCompletionType.AUTO_UPLOAD,
+      },
+    ],
+  },
+];
+
+/**
+ * Fallback used when a framework has no explicit code-default timeline.
+ * This provides a safe, editable baseline for CX/admin teams.
+ */
+export const GENERIC_DEFAULT_TIMELINE_TEMPLATE: DefaultTimelineTemplate = {
+  frameworkName: '*',
+  name: 'Baseline Compliance Timeline',
+  cycleNumber: 1,
+  trackKey: 'primary',
+  templateKey: 'baseline_primary',
+  nextTemplateKey: 'baseline_primary',
+  phases: [
+    {
+      name: 'Scoping & Planning',
+      description: 'Define scope, owners, and audit goals for this cycle.',
+      orderIndex: 0,
+      defaultDurationWeeks: 2,
+      completionType: PhaseCompletionType.MANUAL,
+    },
+    {
+      name: 'Evidence Collection',
+      description: 'Collect required evidence and complete implementation tasks.',
+      orderIndex: 1,
+      defaultDurationWeeks: 6,
+      completionType: PhaseCompletionType.MANUAL,
+    },
+    {
+      name: 'Internal Review',
+      description: 'Validate readiness and resolve open findings before external review.',
+      orderIndex: 2,
+      defaultDurationWeeks: 2,
+      completionType: PhaseCompletionType.MANUAL,
+    },
+    {
+      name: 'Final Report',
+      description: 'Upload final attestation, report, or certification deliverable.',
+      orderIndex: 3,
+      defaultDurationWeeks: 1,
+      completionType: PhaseCompletionType.AUTO_UPLOAD,
+    },
+  ],
+};
+
+function normalizeFrameworkName(value: string): string {
+  return value.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+
+/**
+ * Find matching default templates for a framework by name.
+ * Returns all matching templates (could be multiple for different cycle numbers).
+ */
+export function getDefaultTemplatesForFramework(
+  frameworkName: string,
+): DefaultTimelineTemplate[] {
+  const normalized = normalizeFrameworkName(frameworkName);
+  return DEFAULT_TIMELINE_TEMPLATES.filter(
+    (t) => normalizeFrameworkName(t.frameworkName) === normalized,
+  );
+}
+
+/**
+ * Find a specific default template for a framework and cycle number.
+ * Falls back to highest cycle number <= requested (same as DB fallback logic).
+ */
+export function getDefaultTemplateForCycle(
+  frameworkName: string,
+  cycleNumber: number,
+  options?: { trackKey?: string },
+): DefaultTimelineTemplate | undefined {
+  const trackKey = options?.trackKey;
+  const templatesForFramework = getDefaultTemplatesForFramework(frameworkName);
+  const trackScopedTemplates = trackKey
+    ? templatesForFramework.filter((t) => (t.trackKey ?? 'primary') === trackKey)
+    : templatesForFramework;
+  const templates =
+    trackScopedTemplates.length > 0
+      ? trackScopedTemplates
+      : templatesForFramework;
+
+  // Unknown framework: use a generic baseline that admins can customize.
+  if (templates.length === 0) {
+    if (cycleNumber < GENERIC_DEFAULT_TIMELINE_TEMPLATE.cycleNumber) {
+      return undefined;
+    }
+    return {
+      ...GENERIC_DEFAULT_TIMELINE_TEMPLATE,
+      phases: GENERIC_DEFAULT_TIMELINE_TEMPLATE.phases.map((phase) => ({ ...phase })),
+    };
+  }
+
+  // Exact match first
+  const exact = templates.find((t) => t.cycleNumber === cycleNumber);
+  if (exact) return exact;
+
+  // Fallback to highest cycle <= requested
+  return templates
+    .filter((t) => t.cycleNumber <= cycleNumber)
+    .sort((a, b) => b.cycleNumber - a.cycleNumber)[0];
+}
diff --git a/apps/api/src/timelines/dto/activate-timeline.dto.ts b/apps/api/src/timelines/dto/activate-timeline.dto.ts
new file mode 100644
index 0000000000..e7e6299ad3
--- /dev/null
+++ b/apps/api/src/timelines/dto/activate-timeline.dto.ts
@@ -0,0 +1,11 @@
+import { IsDateString } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class ActivateTimelineDto {
+  @ApiProperty({
+    description: 'The start date for the timeline',
+    example: '2026-05-01T00:00:00.000Z',
+  })
+  @IsDateString()
+  startDate: string;
+}
diff --git a/apps/api/src/timelines/dto/create-phase-template.dto.ts b/apps/api/src/timelines/dto/create-phase-template.dto.ts
new file mode 100644
index 0000000000..1f1250da5c
--- /dev/null
+++ b/apps/api/src/timelines/dto/create-phase-template.dto.ts
@@ -0,0 +1,99 @@
+import {
+  IsString,
+  IsNotEmpty,
+  IsOptional,
+  IsInt,
+  IsIn,
+  Min,
+  IsBoolean,
+} from 'class-validator';
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { COMPLETION_TYPES, type CompletionType } from '../timeline-constants';
+
+export class CreatePhaseTemplateDto {
+  @ApiProperty({ description: 'Phase name', example: 'Gap Assessment' })
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+
+  @ApiPropertyOptional({ description: 'Phase description' })
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @ApiPropertyOptional({ description: 'Group label for sub-phase grouping' })
+  @IsOptional()
+  @IsString()
+  groupLabel?: string;
+
+  @ApiProperty({
+    description: 'Position in the phase sequence (0-based)',
+    minimum: 0,
+  })
+  @IsInt()
+  @Min(0)
+  orderIndex: number;
+
+  @ApiProperty({
+    description: 'Default duration in weeks',
+    minimum: 1,
+    example: 4,
+  })
+  @IsInt()
+  @Min(1)
+  defaultDurationWeeks: number;
+
+  @ApiPropertyOptional({
+    description: 'How the phase is completed',
+    enum: COMPLETION_TYPES,
+  })
+  @IsOptional()
+  @IsIn(COMPLETION_TYPES)
+  completionType?: CompletionType;
+
+  @ApiPropertyOptional({
+    description:
+      'If true, completing this phase locks timeline automation state',
+    default: false,
+  })
+  @IsOptional()
+  @IsBoolean()
+  locksTimelineOnComplete?: boolean;
+}
+
+export class AddPhaseToInstanceDto {
+  @ApiProperty({ description: 'Phase name', example: 'Remediation' })
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+
+  @ApiPropertyOptional({ description: 'Phase description' })
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @ApiProperty({
+    description: 'Position in the phase sequence (0-based)',
+    minimum: 0,
+  })
+  @IsInt()
+  @Min(0)
+  orderIndex: number;
+
+  @ApiProperty({
+    description: 'Duration in weeks',
+    minimum: 1,
+    example: 4,
+  })
+  @IsInt()
+  @Min(1)
+  durationWeeks: number;
+
+  @ApiPropertyOptional({
+    description: 'How the phase is completed',
+    enum: COMPLETION_TYPES,
+  })
+  @IsOptional()
+  @IsIn(COMPLETION_TYPES)
+  completionType?: CompletionType;
+}
diff --git a/apps/api/src/timelines/dto/create-template.dto.ts b/apps/api/src/timelines/dto/create-template.dto.ts
new file mode 100644
index 0000000000..7cbfc2262b
--- /dev/null
+++ b/apps/api/src/timelines/dto/create-template.dto.ts
@@ -0,0 +1,26 @@
+import { IsString, IsNotEmpty, IsInt, Min } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class CreateTemplateDto {
+  @ApiProperty({ description: 'Framework ID this template belongs to' })
+  @IsString()
+  @IsNotEmpty()
+  frameworkId: string;
+
+  @ApiProperty({
+    description: 'Template name',
+    example: 'SOC 2 Initial Audit',
+  })
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+
+  @ApiProperty({
+    description: 'Cycle number (1 = initial, 2+ = renewal)',
+    minimum: 1,
+    example: 1,
+  })
+  @IsInt()
+  @Min(1)
+  cycleNumber: number;
+}
diff --git a/apps/api/src/timelines/dto/unlock-timeline.dto.ts b/apps/api/src/timelines/dto/unlock-timeline.dto.ts
new file mode 100644
index 0000000000..01b2f8eedd
--- /dev/null
+++ b/apps/api/src/timelines/dto/unlock-timeline.dto.ts
@@ -0,0 +1,16 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { Transform } from 'class-transformer';
+import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+
+export class UnlockTimelineDto {
+  @ApiProperty({
+    description: 'Required reason for unlocking a locked timeline',
+    example: 'Audit scope changed; reopening timeline for correction.',
+  })
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(2000)
+  unlockReason: string;
+}
+
diff --git a/apps/api/src/timelines/dto/update-phase-template.dto.ts b/apps/api/src/timelines/dto/update-phase-template.dto.ts
new file mode 100644
index 0000000000..1fbc963b2b
--- /dev/null
+++ b/apps/api/src/timelines/dto/update-phase-template.dto.ts
@@ -0,0 +1,61 @@
+import {
+  IsOptional,
+  IsString,
+  IsInt,
+  IsIn,
+  Min,
+  IsBoolean,
+} from 'class-validator';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { COMPLETION_TYPES, type CompletionType } from '../timeline-constants';
+
+export class UpdatePhaseTemplateDto {
+  @ApiPropertyOptional({ description: 'Phase name' })
+  @IsOptional()
+  @IsString()
+  name?: string;
+
+  @ApiPropertyOptional({ description: 'Phase description' })
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @ApiPropertyOptional({ description: 'Group label for sub-phase grouping' })
+  @IsOptional()
+  @IsString()
+  groupLabel?: string;
+
+  @ApiPropertyOptional({
+    description: 'Position in the phase sequence (0-based)',
+    minimum: 0,
+  })
+  @IsOptional()
+  @IsInt()
+  @Min(0)
+  orderIndex?: number;
+
+  @ApiPropertyOptional({
+    description: 'Default duration in weeks',
+    minimum: 1,
+  })
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  defaultDurationWeeks?: number;
+
+  @ApiPropertyOptional({
+    description: 'How the phase is completed',
+    enum: COMPLETION_TYPES,
+  })
+  @IsOptional()
+  @IsIn(COMPLETION_TYPES)
+  completionType?: CompletionType;
+
+  @ApiPropertyOptional({
+    description:
+      'If true, completing this phase locks timeline automation state',
+  })
+  @IsOptional()
+  @IsBoolean()
+  locksTimelineOnComplete?: boolean;
+}
diff --git a/apps/api/src/timelines/dto/update-phase.dto.ts b/apps/api/src/timelines/dto/update-phase.dto.ts
new file mode 100644
index 0000000000..04a9abbff3
--- /dev/null
+++ b/apps/api/src/timelines/dto/update-phase.dto.ts
@@ -0,0 +1,67 @@
+import {
+  IsOptional,
+  IsString,
+  IsInt,
+  IsDateString,
+  IsBoolean,
+  IsIn,
+  Min,
+} from 'class-validator';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { COMPLETION_TYPES, type CompletionType } from '../timeline-constants';
+
+export class UpdatePhaseDto {
+  @ApiPropertyOptional({ description: 'Phase name' })
+  @IsOptional()
+  @IsString()
+  name?: string;
+
+  @ApiPropertyOptional({ description: 'Phase description' })
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @ApiPropertyOptional({ description: 'Duration in weeks', minimum: 1 })
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  durationWeeks?: number;
+
+  @ApiPropertyOptional({
+    description: 'Phase start date',
+    example: '2026-05-01T00:00:00.000Z',
+  })
+  @IsOptional()
+  @IsDateString()
+  startDate?: string;
+
+  @ApiPropertyOptional({
+    description: 'Phase end date',
+    example: '2026-06-01T00:00:00.000Z',
+  })
+  @IsOptional()
+  @IsDateString()
+  endDate?: string;
+
+  @ApiPropertyOptional({
+    description: 'Whether dates are pinned (not recalculated automatically)',
+  })
+  @IsOptional()
+  @IsBoolean()
+  datesPinned?: boolean;
+
+  @ApiPropertyOptional({
+    description: 'How the phase is completed',
+    enum: COMPLETION_TYPES,
+  })
+  @IsOptional()
+  @IsIn(COMPLETION_TYPES)
+  completionType?: CompletionType;
+
+  @ApiPropertyOptional({
+    description: 'Whether completing this phase should lock the timeline',
+  })
+  @IsOptional()
+  @IsBoolean()
+  locksTimelineOnComplete?: boolean;
+}
diff --git a/apps/api/src/timelines/dto/update-template.dto.ts b/apps/api/src/timelines/dto/update-template.dto.ts
new file mode 100644
index 0000000000..752e40ce4f
--- /dev/null
+++ b/apps/api/src/timelines/dto/update-template.dto.ts
@@ -0,0 +1,18 @@
+import { IsOptional, IsString, IsInt, Min } from 'class-validator';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+
+export class UpdateTemplateDto {
+  @ApiPropertyOptional({ description: 'Template name' })
+  @IsOptional()
+  @IsString()
+  name?: string;
+
+  @ApiPropertyOptional({
+    description: 'Cycle number',
+    minimum: 1,
+  })
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  cycleNumber?: number;
+}
diff --git a/apps/api/src/timelines/timeline-constants.ts b/apps/api/src/timelines/timeline-constants.ts
new file mode 100644
index 0000000000..64704c9b5a
--- /dev/null
+++ b/apps/api/src/timelines/timeline-constants.ts
@@ -0,0 +1,10 @@
+export const COMPLETION_TYPES = [
+  'AUTO_TASKS',
+  'AUTO_POLICIES',
+  'AUTO_PEOPLE',
+  'AUTO_FINDINGS',
+  'AUTO_UPLOAD',
+  'MANUAL',
+] as const;
+
+export type CompletionType = (typeof COMPLETION_TYPES)[number];
diff --git a/apps/api/src/timelines/timelines-backfill.helper.ts b/apps/api/src/timelines/timelines-backfill.helper.ts
new file mode 100644
index 0000000000..e818ab9dbb
--- /dev/null
+++ b/apps/api/src/timelines/timelines-backfill.helper.ts
@@ -0,0 +1,360 @@
+import { db, TimelineStatus, TimelinePhaseStatus } from '@db';
+import {
+  resolveTemplate,
+  createInstanceFromTemplate,
+} from './timelines-template-resolver';
+import { recalculatePhaseDates } from './timelines-date.helper';
+
+// ---------------------------------------------------------------------------
+// Framework name -> Trust field mapping
+// ---------------------------------------------------------------------------
+
+const FRAMEWORK_TRUST_MAP: Record<
+  string,
+  { statusField: string; trustFramework: string }
+> = {
+  'SOC 2': { statusField: 'soc2type2_status', trustFramework: 'soc2_type2' },
+  'SOC 2 v.1': { statusField: 'soc2type1_status', trustFramework: 'soc2_type1' },
+  'ISO 27001': { statusField: 'iso27001_status', trustFramework: 'iso_27001' },
+  ISO27001: { statusField: 'iso27001_status', trustFramework: 'iso_27001' },
+  'ISO 42001': { statusField: 'iso42001_status', trustFramework: 'iso_42001' },
+  HIPAA: { statusField: 'hipaa_status', trustFramework: 'hipaa' },
+  GDPR: { statusField: 'gdpr_status', trustFramework: 'gdpr' },
+  'PCI DSS': { statusField: 'pci_dss_status', trustFramework: 'pci_dss' },
+  'NEN 7510': { statusField: 'nen7510_status', trustFramework: 'nen_7510' },
+  'ISO 9001': { statusField: 'iso9001_status', trustFramework: 'iso_9001' },
+};
+
+// ---------------------------------------------------------------------------
+// Shared types
+// ---------------------------------------------------------------------------
+
+interface PhaseInput {
+  id: string;
+  orderIndex: number;
+  durationWeeks: number;
+  datesPinned: boolean;
+  startDate: Date | null;
+  endDate: Date | null;
+}
+
+interface PhaseUpdate {
+  id: string;
+  status: TimelinePhaseStatus;
+  startDate: Date;
+  endDate: Date;
+  completedAt: Date | null;
+}
+
+// ---------------------------------------------------------------------------
+// Data queries
+// ---------------------------------------------------------------------------
+
+async function queryTrustData({
+  organizationId,
+  frameworkName,
+}: {
+  organizationId: string;
+  frameworkName: string;
+}): Promise<{ isCompliant: boolean; hasTrustResource: boolean }> {
+  const mapping = FRAMEWORK_TRUST_MAP[frameworkName];
+  if (!mapping) return { isCompliant: false, hasTrustResource: false };
+
+  const [trust, trustResource] = await Promise.all([
+    db.trust.findUnique({ where: { organizationId } }),
+    db.trustResource.findUnique({
+      where: {
+        organizationId_framework: {
+          organizationId,
+          framework: mapping.trustFramework as never,
+        },
+      },
+    }),
+  ]);
+
+  const statusValue = trust
+    ? (trust as Record<string, unknown>)[mapping.statusField]
+    : null;
+
+  return {
+    isCompliant: statusValue === 'compliant',
+    hasTrustResource: !!trustResource,
+  };
+}
+
+interface TaskScoreResult {
+  totalTasks: number;
+  allDone: boolean;
+  lastTaskCompletionDate: Date | null;
+}
+
+async function queryTaskScore(
+  frameworkInstanceId: string,
+): Promise<TaskScoreResult> {
+  const requirementMaps = await db.requirementMap.findMany({
+    where: { frameworkInstanceId },
+    select: { controlId: true },
+    distinct: ['controlId'],
+  });
+
+  const controlIds = requirementMaps.map((rm) => rm.controlId);
+  if (controlIds.length === 0) {
+    return { totalTasks: 0, allDone: false, lastTaskCompletionDate: null };
+  }
+
+  const tasks = await db.task.findMany({
+    where: { controls: { some: { id: { in: controlIds } } } },
+    select: { id: true, status: true, updatedAt: true },
+    distinct: ['id'],
+  });
+
+  const totalTasks = tasks.length;
+  const completed = tasks.filter(
+    (t) => t.status === 'done' || t.status === 'not_relevant',
+  );
+  const allDone = totalTasks > 0 && completed.length === totalTasks;
+
+  const doneOnly = completed.filter((t) => t.status === 'done');
+  const lastTaskCompletionDate =
+    doneOnly.length > 0
+      ? doneOnly.reduce(
+          (latest, t) => (t.updatedAt > latest ? t.updatedAt : latest),
+          doneOnly[0].updatedAt,
+        )
+      : null;
+
+  return { totalTasks, allDone, lastTaskCompletionDate };
+}
+
+// ---------------------------------------------------------------------------
+// Phase status assignment
+// ---------------------------------------------------------------------------
+
+function assignCompletedPhases(
+  phases: PhaseInput[],
+  startDate: Date,
+  completedAt: Date,
+): PhaseUpdate[] {
+  return recalculatePhaseDates(phases, startDate).map((p) => ({
+    id: p.id,
+    status: TimelinePhaseStatus.COMPLETED,
+    startDate: p.startDate,
+    endDate: p.endDate,
+    completedAt,
+  }));
+}
+
+function assignActivePhases(
+  phases: PhaseInput[],
+  startDate: Date,
+  evidenceGatheringDone: boolean,
+): PhaseUpdate[] {
+  const now = new Date();
+  const recalculated = recalculatePhaseDates(phases, startDate);
+
+  if (!evidenceGatheringDone) {
+    return recalculated.map((p, idx) => ({
+      id: p.id,
+      status: idx === 0 ? TimelinePhaseStatus.IN_PROGRESS : TimelinePhaseStatus.PENDING,
+      startDate: p.startDate,
+      endDate: p.endDate,
+      completedAt: null,
+    }));
+  }
+
+  // Evidence gathering done -- walk forward through phases
+  let foundCurrent = false;
+  return recalculated.map((p, idx) => {
+    // First phase is always completed
+    if (idx === 0) {
+      const endDate = p.endDate < now ? p.endDate : now;
+      return {
+        id: p.id, status: TimelinePhaseStatus.COMPLETED,
+        startDate: p.startDate, endDate, completedAt: endDate,
+      };
+    }
+    if (foundCurrent) {
+      return {
+        id: p.id, status: TimelinePhaseStatus.PENDING,
+        startDate: p.startDate, endDate: p.endDate, completedAt: null,
+      };
+    }
+    if (p.endDate < now) {
+      return {
+        id: p.id, status: TimelinePhaseStatus.COMPLETED,
+        startDate: p.startDate, endDate: p.endDate, completedAt: p.endDate,
+      };
+    }
+    // Current phase
+    foundCurrent = true;
+    return {
+      id: p.id, status: TimelinePhaseStatus.IN_PROGRESS,
+      startDate: p.startDate, endDate: p.endDate, completedAt: null,
+    };
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Shared DB update
+// ---------------------------------------------------------------------------
+
+async function applyBackfillState(
+  instanceId: string,
+  phaseUpdates: PhaseUpdate[],
+  instanceData: { status: TimelineStatus; startDate: Date; completedAt?: Date },
+) {
+  await db.$transaction(async (tx) => {
+    for (const phase of phaseUpdates) {
+      await tx.timelinePhase.update({
+        where: { id: phase.id },
+        data: {
+          status: phase.status,
+          startDate: phase.startDate,
+          endDate: phase.endDate,
+          completedAt: phase.completedAt,
+        },
+      });
+    }
+    await tx.timelineInstance.update({
+      where: { id: instanceId },
+      data: {
+        status: instanceData.status,
+        startDate: instanceData.startDate,
+        completedAt: instanceData.completedAt ?? null,
+      },
+    });
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Main backfill function
+// ---------------------------------------------------------------------------
+
+/**
+ * Frameworks that need multiple timelines per instance (e.g., SOC 2 has Type 1 + Type 2).
+ * Maps framework name → array of cycle numbers to create.
+ */
+const MULTI_TIMELINE_FRAMEWORKS: Record<
+  string,
+  Array<{ cycleNumber: number; trackKey: string }>
+> = {
+  // Type 1 and Type 2 are independent tracks with their own cycle 1.
+  'SOC 2': [
+    { cycleNumber: 1, trackKey: 'soc2_type1' },
+    { cycleNumber: 1, trackKey: 'soc2_type2' },
+  ],
+};
+
+export async function backfillTimeline({
+  organizationId,
+  frameworkInstance,
+  forceRefresh = false,
+}: {
+  organizationId: string;
+  frameworkInstance: {
+    id: string;
+    frameworkId: string;
+    framework: { id: string; name: string };
+  };
+  forceRefresh?: boolean;
+}): Promise<void> {
+  const { framework } = frameworkInstance;
+  const timelinesToCreate =
+    MULTI_TIMELINE_FRAMEWORKS[framework.name] ?? [
+      { cycleNumber: 1, trackKey: 'primary' },
+    ];
+
+  for (const timelineToCreate of timelinesToCreate) {
+    try {
+      await backfillSingleTimeline({
+        organizationId,
+        frameworkInstance,
+        cycleNumber: timelineToCreate.cycleNumber,
+        trackKey: timelineToCreate.trackKey,
+        forceRefresh,
+      });
+    } catch {
+      // Non-blocking per-cycle — continue with others
+    }
+  }
+}
+
+async function backfillSingleTimeline({
+  organizationId,
+  frameworkInstance,
+  cycleNumber,
+  trackKey,
+  forceRefresh = false,
+}: {
+  organizationId: string;
+  frameworkInstance: {
+    id: string;
+    frameworkId: string;
+    framework: { id: string; name: string };
+  };
+  cycleNumber: number;
+  trackKey: string;
+  forceRefresh?: boolean;
+}): Promise<void> {
+  const { framework } = frameworkInstance;
+
+  // Check if this specific cycle already exists
+  const existing = await db.timelineInstance.findFirst({
+    where: {
+      frameworkInstanceId: frameworkInstance.id,
+      trackKey,
+      cycleNumber,
+    },
+  });
+  if (existing) return;
+
+  // Step 1: Resolve and create DRAFT instance from template
+  const template = await resolveTemplate(
+    frameworkInstance.frameworkId,
+    framework.name,
+    cycleNumber,
+    { forceRefresh, trackKey },
+  );
+  if (!template) return;
+
+  const instance = await createInstanceFromTemplate({
+    organizationId,
+    frameworkInstanceId: frameworkInstance.id,
+    cycleNumber,
+    template,
+  });
+
+  // Step 2: Query trust + task data in parallel
+  const [trustData, taskScore] = await Promise.all([
+    queryTrustData({ organizationId, frameworkName: framework.name }),
+    queryTaskScore(frameworkInstance.id),
+  ]);
+
+  // Infer start date from latest task completion or fall back to ~6 months ago
+  const inferredStartDate =
+    taskScore.lastTaskCompletionDate ??
+    new Date(Date.now() - 26 * 7 * 24 * 60 * 60 * 1000);
+
+  // Step 3: Determine state and update
+
+  if (trustData.isCompliant || trustData.hasTrustResource) {
+    const completedAt = new Date();
+    await applyBackfillState(
+      instance.id,
+      assignCompletedPhases(instance.phases, inferredStartDate, completedAt),
+      { status: TimelineStatus.COMPLETED, startDate: inferredStartDate, completedAt },
+    );
+    return;
+  }
+
+  if (taskScore.totalTasks > 0) {
+    await applyBackfillState(
+      instance.id,
+      assignActivePhases(instance.phases, inferredStartDate, taskScore.allDone),
+      { status: TimelineStatus.ACTIVE, startDate: inferredStartDate },
+    );
+    return;
+  }
+
+  // No trust data, no tasks -- keep as DRAFT (already created that way)
+}
diff --git a/apps/api/src/timelines/timelines-date.helper.spec.ts b/apps/api/src/timelines/timelines-date.helper.spec.ts
new file mode 100644
index 0000000000..f101ceaa22
--- /dev/null
+++ b/apps/api/src/timelines/timelines-date.helper.spec.ts
@@ -0,0 +1,131 @@
+import { recalculatePhaseDates } from './timelines-date.helper';
+
+interface TestPhase {
+  orderIndex: number;
+  durationWeeks: number;
+  datesPinned: boolean;
+  startDate: Date | null;
+  endDate: Date | null;
+}
+
+describe('recalculatePhaseDates', () => {
+  it('calculates sequential dates from start date', () => {
+    const phases: TestPhase[] = [
+      {
+        orderIndex: 0,
+        durationWeeks: 8,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+      {
+        orderIndex: 1,
+        durationWeeks: 4,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+      {
+        orderIndex: 2,
+        durationWeeks: 2,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+    ];
+    const startDate = new Date('2026-01-15');
+    const result = recalculatePhaseDates(phases, startDate);
+
+    expect(result[0].startDate).toEqual(new Date('2026-01-15'));
+    expect(result[0].endDate).toEqual(new Date('2026-03-12'));
+    expect(result[1].startDate).toEqual(new Date('2026-03-12'));
+    expect(result[1].endDate).toEqual(new Date('2026-04-09'));
+    expect(result[2].startDate).toEqual(new Date('2026-04-09'));
+    expect(result[2].endDate).toEqual(new Date('2026-04-23'));
+  });
+
+  it('skips pinned phases but uses their endDate for the next phase', () => {
+    const phases: TestPhase[] = [
+      {
+        orderIndex: 0,
+        durationWeeks: 8,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+      {
+        orderIndex: 1,
+        durationWeeks: 4,
+        datesPinned: true,
+        startDate: new Date('2026-03-15'),
+        endDate: new Date('2026-04-20'),
+      },
+      {
+        orderIndex: 2,
+        durationWeeks: 2,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+    ];
+    const startDate = new Date('2026-01-15');
+    const result = recalculatePhaseDates(phases, startDate);
+
+    expect(result[0].startDate).toEqual(new Date('2026-01-15'));
+    // Phase 1 is pinned -- dates unchanged
+    expect(result[1].startDate).toEqual(new Date('2026-03-15'));
+    expect(result[1].endDate).toEqual(new Date('2026-04-20'));
+    // Phase 2 starts from pinned phase's endDate
+    expect(result[2].startDate).toEqual(new Date('2026-04-20'));
+    expect(result[2].endDate).toEqual(new Date('2026-05-04'));
+  });
+
+  it('handles single phase', () => {
+    const phases: TestPhase[] = [
+      {
+        orderIndex: 0,
+        durationWeeks: 8,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+    ];
+    const startDate = new Date('2026-01-15');
+    const result = recalculatePhaseDates(phases, startDate);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].startDate).toEqual(new Date('2026-01-15'));
+  });
+
+  it('sorts phases by orderIndex regardless of input order', () => {
+    const phases: TestPhase[] = [
+      {
+        orderIndex: 2,
+        durationWeeks: 2,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+      {
+        orderIndex: 0,
+        durationWeeks: 8,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+      {
+        orderIndex: 1,
+        durationWeeks: 4,
+        datesPinned: false,
+        startDate: null,
+        endDate: null,
+      },
+    ];
+    const startDate = new Date('2026-01-15');
+    const result = recalculatePhaseDates(phases, startDate);
+
+    expect(result[0].orderIndex).toBe(0);
+    expect(result[1].orderIndex).toBe(1);
+    expect(result[2].orderIndex).toBe(2);
+  });
+});
diff --git a/apps/api/src/timelines/timelines-date.helper.ts b/apps/api/src/timelines/timelines-date.helper.ts
new file mode 100644
index 0000000000..0cefa3dc9f
--- /dev/null
+++ b/apps/api/src/timelines/timelines-date.helper.ts
@@ -0,0 +1,40 @@
+interface PhaseForRecalculation {
+  orderIndex: number;
+  durationWeeks: number;
+  datesPinned: boolean;
+  startDate: Date | null;
+  endDate: Date | null;
+}
+
+function addWeeks(date: Date, weeks: number): Date {
+  const result = new Date(date);
+  result.setUTCDate(result.getUTCDate() + weeks * 7);
+  return result;
+}
+
+export function recalculatePhaseDates<T extends PhaseForRecalculation>(
+  phases: T[],
+  timelineStartDate: Date,
+): (T & { startDate: Date; endDate: Date })[] {
+  const sorted = [...phases].sort((a, b) => a.orderIndex - b.orderIndex);
+  // Defensively copy the caller's start date so downstream mutation of any
+  // returned startDate/endDate can't write back into the input.
+  let currentDate = new Date(timelineStartDate);
+
+  return sorted.map((phase) => {
+    if (phase.datesPinned && phase.startDate && phase.endDate) {
+      // Also defensively copy the pinned dates so the returned objects don't
+      // alias the input phase rows.
+      const pinnedStart = new Date(phase.startDate);
+      const pinnedEnd = new Date(phase.endDate);
+      currentDate = new Date(pinnedEnd);
+      return { ...phase, startDate: pinnedStart, endDate: pinnedEnd };
+    }
+
+    const startDate = new Date(currentDate);
+    const endDate = addWeeks(startDate, phase.durationWeeks);
+    currentDate = new Date(endDate);
+
+    return { ...phase, startDate, endDate };
+  });
+}
diff --git a/apps/api/src/timelines/timelines-lifecycle.service.spec.ts b/apps/api/src/timelines/timelines-lifecycle.service.spec.ts
new file mode 100644
index 0000000000..04a8c55fa7
--- /dev/null
+++ b/apps/api/src/timelines/timelines-lifecycle.service.spec.ts
@@ -0,0 +1,422 @@
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+import { TimelinesLifecycleService } from './timelines-lifecycle.service';
+
+jest.mock('@db', () => ({
+  db: {
+    timelineInstance: {
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
+    timelinePhase: {
+      update: jest.fn(),
+      findMany: jest.fn(),
+      count: jest.fn(),
+    },
+    $transaction: jest.fn(),
+  },
+  TimelineStatus: {
+    DRAFT: 'DRAFT',
+    ACTIVE: 'ACTIVE',
+    PAUSED: 'PAUSED',
+    COMPLETED: 'COMPLETED',
+  },
+  TimelinePhaseStatus: {
+    PENDING: 'PENDING',
+    IN_PROGRESS: 'IN_PROGRESS',
+    COMPLETED: 'COMPLETED',
+  },
+}));
+
+jest.mock('./timelines-slack.helper', () => ({
+  notifyPhaseCompleted: jest.fn(),
+  notifyTimelineCompleted: jest.fn(),
+}));
+
+import { db } from '@db';
+
+const mockDb = db as jest.Mocked<typeof db>;
+
+describe('TimelinesLifecycleService', () => {
+  let service: TimelinesLifecycleService;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    service = new TimelinesLifecycleService();
+  });
+
+  it('activates a draft timeline and marks only first phase as IN_PROGRESS', async () => {
+    const instance = {
+      id: 'tli_1',
+      organizationId: 'org_1',
+      status: 'DRAFT',
+      phases: [
+        {
+          id: 'p1',
+          orderIndex: 0,
+          durationWeeks: 2,
+          datesPinned: false,
+          startDate: null,
+          endDate: null,
+        },
+        {
+          id: 'p2',
+          orderIndex: 1,
+          durationWeeks: 3,
+          datesPinned: false,
+          startDate: null,
+          endDate: null,
+        },
+      ],
+    };
+
+    const tx = {
+      timelinePhase: { update: jest.fn() },
+      timelineInstance: {
+        update: jest.fn().mockResolvedValue({ id: 'tli_1', status: 'ACTIVE' }),
+      },
+    };
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue(instance);
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => fn(tx));
+
+    const startDate = new Date('2026-01-01T00:00:00.000Z');
+    await service.activate('tli_1', 'org_1', startDate);
+
+    expect(tx.timelinePhase.update).toHaveBeenCalledTimes(2);
+    expect(tx.timelinePhase.update).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        where: { id: 'p1' },
+        data: expect.objectContaining({ status: 'IN_PROGRESS' }),
+      }),
+    );
+    expect(tx.timelinePhase.update).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        where: { id: 'p2' },
+        data: expect.objectContaining({ status: 'PENDING' }),
+      }),
+    );
+  });
+
+  it('shifts only eligible phases on resume', async () => {
+    jest.useFakeTimers().setSystemTime(new Date('2026-01-08T00:00:00.000Z'));
+
+    const pausedAt = new Date('2026-01-01T00:00:00.000Z');
+    const instance = {
+      id: 'tli_1',
+      organizationId: 'org_1',
+      status: 'PAUSED',
+      pausedAt,
+      phases: [
+        {
+          id: 'shift_me',
+          status: 'PENDING',
+          datesPinned: false,
+          startDate: new Date('2026-01-02T00:00:00.000Z'),
+          endDate: new Date('2026-01-09T00:00:00.000Z'),
+        },
+        {
+          id: 'completed',
+          status: 'COMPLETED',
+          datesPinned: false,
+          startDate: new Date('2026-01-02T00:00:00.000Z'),
+          endDate: new Date('2026-01-09T00:00:00.000Z'),
+        },
+        {
+          id: 'pinned',
+          status: 'PENDING',
+          datesPinned: true,
+          startDate: new Date('2026-01-02T00:00:00.000Z'),
+          endDate: new Date('2026-01-09T00:00:00.000Z'),
+        },
+        {
+          id: 'no_dates',
+          status: 'PENDING',
+          datesPinned: false,
+          startDate: null,
+          endDate: null,
+        },
+      ],
+    };
+
+    const tx = {
+      timelinePhase: { update: jest.fn() },
+      timelineInstance: {
+        update: jest.fn().mockResolvedValue({ id: 'tli_1', status: 'ACTIVE' }),
+      },
+    };
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue(instance);
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => fn(tx));
+
+    await service.resume('tli_1', 'org_1');
+
+    expect(tx.timelinePhase.update).toHaveBeenCalledTimes(1);
+    expect(tx.timelinePhase.update).toHaveBeenCalledWith({
+      where: { id: 'shift_me' },
+      data: {
+        startDate: new Date('2026-01-09T00:00:00.000Z'),
+        endDate: new Date('2026-01-16T00:00:00.000Z'),
+      },
+    });
+
+    jest.useRealTimers();
+  });
+
+  it('throws when completing a phase that is not IN_PROGRESS', async () => {
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      phases: [
+        { id: 'p1', orderIndex: 0, status: 'IN_PROGRESS' },
+        { id: 'p2', orderIndex: 1, status: 'PENDING' },
+      ],
+    });
+
+    await expect(
+      service.completePhase('tli_1', 'p2', 'org_1', 'usr_1'),
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it('throws when prior phases are not completed', async () => {
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      phases: [
+        { id: 'p1', orderIndex: 0, status: 'PENDING' },
+        { id: 'p2', orderIndex: 1, status: 'IN_PROGRESS' },
+      ],
+    });
+
+    await expect(
+      service.completePhase('tli_1', 'p2', 'org_1', 'usr_1'),
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it('marks timeline completed when last phase is completed', async () => {
+    const tx = {
+      timelinePhase: {
+        update: jest.fn(),
+        findMany: jest.fn().mockResolvedValue([
+          {
+            id: 'p1',
+            orderIndex: 0,
+            status: 'COMPLETED',
+            durationWeeks: 2,
+            datesPinned: false,
+            startDate: new Date('2026-01-01T00:00:00.000Z'),
+            endDate: new Date('2026-01-08T00:00:00.000Z'),
+          },
+        ]),
+        count: jest.fn().mockResolvedValue(0),
+      },
+      timelineInstance: {
+        update: jest.fn(),
+        findUnique: jest.fn().mockResolvedValue({
+          id: 'tli_1',
+          status: 'COMPLETED',
+          phases: [{ id: 'p1', status: 'COMPLETED' }],
+          organization: { id: 'org_1', name: 'Acme' },
+          template: { id: 'tml_1', name: 'SOC 2 Type 2' },
+          frameworkInstance: { framework: { id: 'frk_1', name: 'SOC 2' } },
+        }),
+      },
+    };
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      startDate: new Date('2026-01-01T00:00:00.000Z'),
+      phases: [
+        {
+          id: 'p1',
+          name: 'Final Report',
+          completionType: 'AUTO_UPLOAD',
+          orderIndex: 0,
+          status: 'IN_PROGRESS',
+          durationWeeks: 2,
+          datesPinned: false,
+          startDate: new Date('2026-01-01T00:00:00.000Z'),
+          endDate: new Date('2099-01-15T00:00:00.000Z'),
+        },
+      ],
+    });
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => fn(tx));
+
+    await service.completePhase('tli_1', 'p1', 'org_1', 'usr_1');
+
+    expect(tx.timelineInstance.update).toHaveBeenCalledWith({
+      where: { id: 'tli_1' },
+      data: expect.objectContaining({
+        status: 'COMPLETED',
+        completedAt: expect.any(Date),
+        lockedAt: expect.any(Date),
+        lockedById: 'usr_1',
+      }),
+    });
+    expect(tx.timelinePhase.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: 'p1' },
+        data: expect.objectContaining({
+          status: 'COMPLETED',
+          completedById: 'usr_1',
+          datesPinned: true,
+          endDate: expect.any(Date),
+        }),
+      }),
+    );
+  });
+
+  it('locks timeline when completing a phase flagged to lock on completion', async () => {
+    const tx = {
+      timelinePhase: {
+        update: jest.fn(),
+        findMany: jest.fn().mockResolvedValue([
+          {
+            id: 'p1',
+            orderIndex: 0,
+            status: 'COMPLETED',
+            durationWeeks: 2,
+            datesPinned: false,
+            startDate: new Date('2026-01-01T00:00:00.000Z'),
+            endDate: new Date('2026-01-08T00:00:00.000Z'),
+          },
+          {
+            id: 'p2',
+            orderIndex: 1,
+            status: 'PENDING',
+            durationWeeks: 2,
+            datesPinned: false,
+            startDate: new Date('2026-01-08T00:00:00.000Z'),
+            endDate: new Date('2026-01-15T00:00:00.000Z'),
+          },
+        ]),
+        count: jest.fn().mockResolvedValue(1),
+      },
+      timelineInstance: {
+        update: jest.fn(),
+        findUnique: jest.fn().mockResolvedValue({
+          id: 'tli_1',
+          status: 'ACTIVE',
+          phases: [],
+          organization: { id: 'org_1', name: 'Acme' },
+          template: { id: 'tml_1', name: 'SOC 2 Type 2' },
+          frameworkInstance: { framework: { id: 'frk_1', name: 'SOC 2' } },
+        }),
+      },
+    };
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      lockedAt: null,
+      startDate: new Date('2026-01-01T00:00:00.000Z'),
+      phases: [
+        {
+          id: 'p1',
+          name: 'Observation',
+          completionType: 'MANUAL',
+          locksTimelineOnComplete: true,
+          orderIndex: 0,
+          status: 'IN_PROGRESS',
+          durationWeeks: 2,
+          datesPinned: false,
+          startDate: new Date('2026-01-01T00:00:00.000Z'),
+          endDate: new Date('2099-01-15T00:00:00.000Z'),
+        },
+        {
+          id: 'p2',
+          name: 'Audit Review',
+          completionType: 'MANUAL',
+          locksTimelineOnComplete: false,
+          orderIndex: 1,
+          status: 'PENDING',
+          durationWeeks: 2,
+          datesPinned: false,
+          startDate: new Date('2026-01-15T00:00:00.000Z'),
+          endDate: new Date('2099-01-29T00:00:00.000Z'),
+        },
+      ],
+    });
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => fn(tx));
+
+    await service.completePhase('tli_1', 'p1', 'org_1', 'usr_1');
+
+    expect(tx.timelineInstance.update).toHaveBeenCalledWith({
+      where: { id: 'tli_1' },
+      data: {
+        lockedAt: expect.any(Date),
+        lockedById: 'usr_1',
+        unlockedAt: null,
+        unlockedById: null,
+        unlockReason: null,
+      },
+    });
+  });
+
+  it('unlocks a locked timeline and stores unlock metadata', async () => {
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      status: 'ACTIVE',
+      lockedAt: new Date('2026-01-10T00:00:00.000Z'),
+    });
+    (mockDb.timelineInstance.update as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      lockedAt: null,
+      unlockedById: 'usr_admin',
+      unlockReason: 'Audit scope changed',
+    });
+
+    await service.unlock('tli_1', 'org_1', 'usr_admin', 'Audit scope changed');
+
+    expect(mockDb.timelineInstance.update).toHaveBeenCalledWith({
+      where: { id: 'tli_1' },
+      data: {
+        lockedAt: null,
+        lockedById: null,
+        unlockedAt: expect.any(Date),
+        unlockedById: 'usr_admin',
+        unlockReason: 'Audit scope changed',
+      },
+      include: expect.any(Object),
+    });
+  });
+
+  it('throws when unlocking a timeline that is not locked', async () => {
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      status: 'ACTIVE',
+      lockedAt: null,
+    });
+
+    await expect(
+      service.unlock('tli_1', 'org_1', 'usr_admin', 'Need to adjust phase data'),
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it('throws when unlocking a completed timeline', async () => {
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      status: 'COMPLETED',
+      lockedAt: new Date('2026-01-10T00:00:00.000Z'),
+    });
+
+    await expect(
+      service.unlock('tli_1', 'org_1', 'usr_admin', 'Need to adjust phase data'),
+    ).rejects.toThrow(BadRequestException);
+
+    expect(mockDb.timelineInstance.update).not.toHaveBeenCalled();
+  });
+
+  it('throws NotFoundException for missing timeline on activate', async () => {
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(
+      service.activate('missing', 'org_1', new Date('2026-01-01')),
+    ).rejects.toThrow(NotFoundException);
+  });
+});
diff --git a/apps/api/src/timelines/timelines-lifecycle.service.ts b/apps/api/src/timelines/timelines-lifecycle.service.ts
new file mode 100644
index 0000000000..8afcdc4308
--- /dev/null
+++ b/apps/api/src/timelines/timelines-lifecycle.service.ts
@@ -0,0 +1,331 @@
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { db, TimelineStatus, TimelinePhaseStatus } from '@db';
+import { recalculatePhaseDates } from './timelines-date.helper';
+import { notifyPhaseCompleted, notifyTimelineCompleted } from './timelines-slack.helper';
+
+/** Shared Prisma include for timeline instance queries. */
+const INSTANCE_INCLUDE = {
+  phases: { orderBy: { orderIndex: 'asc' } as const },
+  frameworkInstance: { include: { framework: true } },
+  organization: { select: { id: true, name: true } },
+  template: true,
+};
+
+@Injectable()
+export class TimelinesLifecycleService {
+  async activate(id: string, organizationId: string, startDate: Date) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id, organizationId },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    if (instance.status !== TimelineStatus.DRAFT) {
+      throw new BadRequestException('Only draft timelines can be activated');
+    }
+
+    const recalculated = recalculatePhaseDates(instance.phases, startDate);
+
+    return db.$transaction(async (tx) => {
+      for (const phase of recalculated) {
+        const isFirst = phase.orderIndex === recalculated[0].orderIndex;
+        await tx.timelinePhase.update({
+          where: { id: phase.id },
+          data: {
+            startDate: phase.startDate,
+            endDate: phase.endDate,
+            status: isFirst
+              ? TimelinePhaseStatus.IN_PROGRESS
+              : TimelinePhaseStatus.PENDING,
+          },
+        });
+      }
+
+      return tx.timelineInstance.update({
+        where: { id },
+        data: { startDate, status: TimelineStatus.ACTIVE },
+        include: INSTANCE_INCLUDE,
+      });
+    });
+  }
+
+  async pause(id: string, organizationId: string) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id, organizationId },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    if (instance.status !== TimelineStatus.ACTIVE) {
+      throw new BadRequestException('Only active timelines can be paused');
+    }
+
+    return db.timelineInstance.update({
+      where: { id },
+      data: { status: TimelineStatus.PAUSED, pausedAt: new Date() },
+      include: INSTANCE_INCLUDE,
+    });
+  }
+
+  async resume(id: string, organizationId: string) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id, organizationId },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    if (instance.status !== TimelineStatus.PAUSED) {
+      throw new BadRequestException('Only paused timelines can be resumed');
+    }
+
+    const pausedAt = instance.pausedAt;
+    if (!pausedAt) {
+      throw new BadRequestException('Timeline has no pause timestamp');
+    }
+
+    const pauseDurationMs = Date.now() - pausedAt.getTime();
+
+    return db.$transaction(async (tx) => {
+      for (const phase of instance.phases) {
+        if (phase.datesPinned) continue;
+        if (phase.status === TimelinePhaseStatus.COMPLETED) continue;
+        if (!phase.startDate || !phase.endDate) continue;
+
+        await tx.timelinePhase.update({
+          where: { id: phase.id },
+          data: {
+            startDate: new Date(phase.startDate.getTime() + pauseDurationMs),
+            endDate: new Date(phase.endDate.getTime() + pauseDurationMs),
+          },
+        });
+      }
+
+      return tx.timelineInstance.update({
+        where: { id },
+        data: { status: TimelineStatus.ACTIVE, pausedAt: null },
+        include: INSTANCE_INCLUDE,
+      });
+    });
+  }
+
+  async completePhase(
+    instanceId: string,
+    phaseId: string,
+    organizationId: string,
+    userId?: string,
+  ) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id: instanceId, organizationId },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    const phase = instance.phases.find((p) => p.id === phaseId);
+    if (!phase) {
+      throw new NotFoundException('Phase not found');
+    }
+
+    if (phase.status === TimelinePhaseStatus.COMPLETED) {
+      throw new BadRequestException('Phase is already completed');
+    }
+
+    if (phase.status !== TimelinePhaseStatus.IN_PROGRESS) {
+      throw new BadRequestException('Only in-progress phases can be completed');
+    }
+
+    const hasIncompletePrior = instance.phases
+      .filter((p) => p.orderIndex < phase.orderIndex)
+      .some((p) => p.status !== TimelinePhaseStatus.COMPLETED);
+
+    if (hasIncompletePrior) {
+      throw new BadRequestException(
+        'Cannot complete phase before prior phases are completed',
+      );
+    }
+
+    const txResult = await db.$transaction(async (tx) => {
+      const now = new Date();
+      let lockApplied = false;
+
+      // If completing before planned end, update endDate and pin it
+      // so downstream recalculation anchors off the actual completion date
+      const finishedEarly = !phase.endDate || now.getTime() < new Date(phase.endDate).getTime();
+
+      await tx.timelinePhase.update({
+        where: { id: phaseId },
+        data: {
+          status: TimelinePhaseStatus.COMPLETED,
+          completedAt: now,
+          completedById: userId ?? null,
+          ...(finishedEarly ? { endDate: now, datesPinned: true } : {}),
+        },
+      });
+
+      if (phase.locksTimelineOnComplete && !instance.lockedAt) {
+        await tx.timelineInstance.update({
+          where: { id: instanceId },
+          data: {
+            lockedAt: now,
+            lockedById: userId ?? null,
+            unlockedAt: null,
+            unlockedById: null,
+            unlockReason: null,
+          },
+        });
+        lockApplied = true;
+      }
+
+      // Advance next pending phase to IN_PROGRESS — but only if all prior phases are completed
+      const freshPhases = await tx.timelinePhase.findMany({
+        where: { instanceId },
+        orderBy: { orderIndex: 'asc' },
+      });
+
+      const nextPhase = freshPhases.find(
+        (p) => p.status === TimelinePhaseStatus.PENDING,
+      );
+
+      const allPriorCompleted = nextPhase
+        ? freshPhases
+            .filter((p) => p.orderIndex < nextPhase.orderIndex)
+            .every((p) => p.status === TimelinePhaseStatus.COMPLETED)
+        : false;
+
+      if (nextPhase && allPriorCompleted) {
+        await tx.timelinePhase.update({
+          where: { id: nextPhase.id },
+          data: { status: TimelinePhaseStatus.IN_PROGRESS },
+        });
+
+        // Recalculate downstream dates
+        if (instance.startDate) {
+          const allPhases = await tx.timelinePhase.findMany({
+            where: { instanceId },
+            orderBy: { orderIndex: 'asc' },
+          });
+
+          const recalculated = recalculatePhaseDates(
+            allPhases,
+            instance.startDate,
+          );
+
+          for (const rp of recalculated) {
+            if (rp.orderIndex <= phase.orderIndex) continue;
+            await tx.timelinePhase.update({
+              where: { id: rp.id },
+              data: { startDate: rp.startDate, endDate: rp.endDate },
+            });
+          }
+        }
+      }
+
+      // Check if all phases are now completed
+      const remainingPending = await tx.timelinePhase.count({
+        where: {
+          instanceId,
+          status: { not: TimelinePhaseStatus.COMPLETED },
+          id: { not: phaseId },
+        },
+      });
+
+      const allCompleted = remainingPending === 0;
+
+      if (allCompleted) {
+        await tx.timelineInstance.update({
+          where: { id: instanceId },
+          data: {
+            status: TimelineStatus.COMPLETED,
+            completedAt: now,
+            ...(!instance.lockedAt && !lockApplied
+              ? {
+                  lockedAt: now,
+                  lockedById: userId ?? null,
+                  unlockedAt: null,
+                  unlockedById: null,
+                  unlockReason: null,
+                }
+              : {}),
+          },
+        });
+      }
+
+      const result = await tx.timelineInstance.findUnique({
+        where: { id: instanceId },
+        include: INSTANCE_INCLUDE,
+      });
+
+      return { result, allCompleted, phaseName: phase.name, completionType: phase.completionType };
+    });
+
+    // Fire-and-forget Slack notifications
+    const orgName = txResult.result?.organization?.name ?? organizationId;
+    const frameworkName =
+      txResult.result?.template?.name ??
+      txResult.result?.frameworkInstance?.framework?.name ??
+      'Unknown';
+
+    notifyPhaseCompleted({
+      orgId: organizationId,
+      orgName,
+      frameworkName,
+      phaseName: txResult.phaseName,
+      completionType: txResult.completionType,
+    });
+
+    if (txResult.allCompleted) {
+      notifyTimelineCompleted({ orgId: organizationId, orgName, frameworkName });
+    }
+
+    return txResult.result;
+  }
+
+  async unlock(
+    id: string,
+    organizationId: string,
+    unlockedById: string,
+    unlockReason: string,
+  ) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id, organizationId },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    if (instance.status === TimelineStatus.COMPLETED) {
+      throw new BadRequestException('Completed timelines cannot be unlocked');
+    }
+
+    if (!instance.lockedAt) {
+      throw new BadRequestException('Timeline is not locked');
+    }
+
+    return db.timelineInstance.update({
+      where: { id },
+      data: {
+        lockedAt: null,
+        lockedById: null,
+        unlockedAt: new Date(),
+        unlockedById,
+        unlockReason,
+      },
+      include: INSTANCE_INCLUDE,
+    });
+  }
+}
diff --git a/apps/api/src/timelines/timelines-phases.service.spec.ts b/apps/api/src/timelines/timelines-phases.service.spec.ts
new file mode 100644
index 0000000000..e8c434a53b
--- /dev/null
+++ b/apps/api/src/timelines/timelines-phases.service.spec.ts
@@ -0,0 +1,238 @@
+import { NotFoundException } from '@nestjs/common';
+import { TimelinesPhasesService } from './timelines-phases.service';
+
+jest.mock('@db', () => ({
+  db: {
+    timelineInstance: {
+      findUnique: jest.fn(),
+    },
+    timelinePhase: {
+      update: jest.fn(),
+      findMany: jest.fn(),
+    },
+  },
+  PhaseCompletionType: {
+    AUTO_TASKS: 'AUTO_TASKS',
+    AUTO_POLICIES: 'AUTO_POLICIES',
+    AUTO_PEOPLE: 'AUTO_PEOPLE',
+    AUTO_FINDINGS: 'AUTO_FINDINGS',
+    AUTO_UPLOAD: 'AUTO_UPLOAD',
+    MANUAL: 'MANUAL',
+  },
+}));
+
+import { db } from '@db';
+
+const mockDb = db as jest.Mocked<typeof db>;
+
+describe('TimelinesPhasesService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('auto-completes AUTO_UPLOAD phase when documentUrl is provided', async () => {
+    const lifecycle = {
+      completePhase: jest.fn().mockResolvedValue({ id: 'phase_1', status: 'COMPLETED' }),
+    };
+    const service = new TimelinesPhasesService(lifecycle as any);
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      startDate: new Date('2026-01-01T00:00:00.000Z'),
+      phases: [
+        {
+          id: 'phase_1',
+          completionType: 'AUTO_UPLOAD',
+          status: 'IN_PROGRESS',
+          durationWeeks: 2,
+          startDate: new Date('2026-01-01T00:00:00.000Z'),
+        },
+      ],
+    });
+    (mockDb.timelinePhase.update as jest.Mock).mockResolvedValue({
+      id: 'phase_1',
+      completionType: 'AUTO_UPLOAD',
+      status: 'IN_PROGRESS',
+    });
+
+    const result = await service.updatePhase('tli_1', 'phase_1', 'org_1', {
+      documentUrl: 'https://files.example.com/final-report.pdf',
+    });
+
+    expect(lifecycle.completePhase).toHaveBeenCalledWith('tli_1', 'phase_1', 'org_1');
+    expect(result).toEqual({ id: 'phase_1', status: 'COMPLETED' });
+  });
+
+  it('does not auto-complete MANUAL phase when documentUrl is provided', async () => {
+    const lifecycle = {
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesPhasesService(lifecycle as any);
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      startDate: new Date('2026-01-01T00:00:00.000Z'),
+      phases: [
+        {
+          id: 'phase_1',
+          completionType: 'MANUAL',
+          status: 'IN_PROGRESS',
+          durationWeeks: 2,
+          startDate: new Date('2026-01-01T00:00:00.000Z'),
+        },
+      ],
+    });
+    (mockDb.timelinePhase.update as jest.Mock).mockResolvedValue({
+      id: 'phase_1',
+      completionType: 'MANUAL',
+      status: 'IN_PROGRESS',
+    });
+
+    const result = await service.updatePhase('tli_1', 'phase_1', 'org_1', {
+      documentUrl: 'https://files.example.com/evidence.pdf',
+    });
+
+    expect(lifecycle.completePhase).not.toHaveBeenCalled();
+    expect(result).toEqual({
+      id: 'phase_1',
+      completionType: 'MANUAL',
+      status: 'IN_PROGRESS',
+    });
+  });
+
+  it('does not auto-complete AUTO_UPLOAD phase when timeline is locked', async () => {
+    const lifecycle = {
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesPhasesService(lifecycle as any);
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      lockedAt: new Date('2026-01-20T00:00:00.000Z'),
+      startDate: new Date('2026-01-01T00:00:00.000Z'),
+      phases: [
+        {
+          id: 'phase_1',
+          completionType: 'AUTO_UPLOAD',
+          status: 'IN_PROGRESS',
+          durationWeeks: 2,
+          startDate: new Date('2026-01-01T00:00:00.000Z'),
+        },
+      ],
+    });
+    (mockDb.timelinePhase.update as jest.Mock).mockResolvedValue({
+      id: 'phase_1',
+      completionType: 'AUTO_UPLOAD',
+      status: 'IN_PROGRESS',
+    });
+
+    await service.updatePhase('tli_1', 'phase_1', 'org_1', {
+      documentUrl: 'https://files.example.com/final-report.pdf',
+    });
+
+    expect(lifecycle.completePhase).not.toHaveBeenCalled();
+  });
+
+  it('updates locksTimelineOnComplete when provided', async () => {
+    const lifecycle = {
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesPhasesService(lifecycle as any);
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      startDate: new Date('2026-01-01T00:00:00.000Z'),
+      phases: [
+        {
+          id: 'phase_1',
+          completionType: 'MANUAL',
+          status: 'IN_PROGRESS',
+          durationWeeks: 2,
+          startDate: new Date('2026-01-01T00:00:00.000Z'),
+          locksTimelineOnComplete: false,
+        },
+      ],
+    });
+
+    (mockDb.timelinePhase.update as jest.Mock).mockResolvedValue({
+      id: 'phase_1',
+      completionType: 'MANUAL',
+      status: 'IN_PROGRESS',
+      locksTimelineOnComplete: true,
+    });
+
+    const result = await service.updatePhase('tli_1', 'phase_1', 'org_1', {
+      locksTimelineOnComplete: true,
+    } as any);
+
+    expect(mockDb.timelinePhase.update).toHaveBeenCalledWith({
+      where: { id: 'phase_1' },
+      data: expect.objectContaining({
+        locksTimelineOnComplete: true,
+      }),
+    });
+    expect(result).toEqual(
+      expect.objectContaining({
+        id: 'phase_1',
+        locksTimelineOnComplete: true,
+      }),
+    );
+  });
+
+  it('updates completionType when provided', async () => {
+    const lifecycle = {
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesPhasesService(lifecycle as any);
+
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tli_1',
+      organizationId: 'org_1',
+      startDate: new Date('2026-01-01T00:00:00.000Z'),
+      phases: [
+        {
+          id: 'phase_1',
+          completionType: 'MANUAL',
+          status: 'IN_PROGRESS',
+          durationWeeks: 2,
+          startDate: new Date('2026-01-01T00:00:00.000Z'),
+        },
+      ],
+    });
+    (mockDb.timelinePhase.update as jest.Mock).mockResolvedValue({
+      id: 'phase_1',
+      completionType: 'AUTO_FINDINGS',
+      status: 'IN_PROGRESS',
+    });
+
+    const result = await service.updatePhase('tli_1', 'phase_1', 'org_1', {
+      completionType: 'AUTO_FINDINGS',
+    } as any);
+
+    expect(mockDb.timelinePhase.update).toHaveBeenCalledWith({
+      where: { id: 'phase_1' },
+      data: expect.objectContaining({
+        completionType: 'AUTO_FINDINGS',
+      }),
+    });
+    expect(result).toEqual(
+      expect.objectContaining({
+        id: 'phase_1',
+        completionType: 'AUTO_FINDINGS',
+      }),
+    );
+  });
+
+  it('throws when timeline instance is missing', async () => {
+    const service = new TimelinesPhasesService({ completePhase: jest.fn() } as any);
+    (mockDb.timelineInstance.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(
+      service.updatePhase('missing', 'phase_1', 'org_1', { name: 'Updated' }),
+    ).rejects.toThrow(NotFoundException);
+  });
+});
diff --git a/apps/api/src/timelines/timelines-phases.service.ts b/apps/api/src/timelines/timelines-phases.service.ts
new file mode 100644
index 0000000000..dec25f9cd7
--- /dev/null
+++ b/apps/api/src/timelines/timelines-phases.service.ts
@@ -0,0 +1,202 @@
+import {
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { db, PhaseCompletionType } from '@db';
+import { TimelinesLifecycleService } from './timelines-lifecycle.service';
+import { recalculatePhaseDates } from './timelines-date.helper';
+
+@Injectable()
+export class TimelinesPhasesService {
+  constructor(
+    private readonly lifecycle: TimelinesLifecycleService,
+  ) {}
+
+  async updatePhase(
+    instanceId: string,
+    phaseId: string,
+    organizationId: string,
+    data: {
+      name?: string;
+      description?: string;
+      startDate?: Date;
+      endDate?: Date;
+      durationWeeks?: number;
+      datesPinned?: boolean;
+      completionType?: PhaseCompletionType;
+      documentUrl?: string;
+      documentName?: string;
+      locksTimelineOnComplete?: boolean;
+    },
+  ) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id: instanceId, organizationId },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    const phase = instance.phases.find((p) => p.id === phaseId);
+    if (!phase) {
+      throw new NotFoundException('Phase not found');
+    }
+
+    // Resolve the effective endDate: prefer an explicit endDate from the
+    // caller, otherwise compute from startDate + duration when either changed.
+    const newDuration = data.durationWeeks ?? phase.durationWeeks;
+    const newStartDate = data.startDate ?? phase.startDate;
+    let newEndDate: Date | undefined = data.endDate;
+
+    if (newEndDate === undefined && (data.startDate || data.durationWeeks)) {
+      if (newStartDate) {
+        const end = new Date(newStartDate);
+        end.setUTCDate(end.getUTCDate() + newDuration * 7);
+        newEndDate = end;
+      }
+    }
+
+    // Pin dates when the caller explicitly sets any date field. If the user
+    // sets a date AND explicitly asks to unpin, the pin wins — storing a
+    // specific date with datesPinned=false would desynchronize this phase
+    // from the downstream recalc anchor and allow the next refresh to
+    // overwrite it. An explicit un-pin is only honored when no date field
+    // is provided in the same call.
+    const datesPinned =
+      data.startDate !== undefined || data.endDate !== undefined
+        ? true
+        : data.datesPinned;
+
+    const updated = await db.timelinePhase.update({
+      where: { id: phaseId },
+      data: {
+        ...(data.name !== undefined && { name: data.name }),
+        ...(data.description !== undefined && { description: data.description }),
+        ...(data.durationWeeks !== undefined && { durationWeeks: data.durationWeeks }),
+        ...(data.completionType !== undefined && {
+          completionType: data.completionType,
+        }),
+        ...(data.startDate !== undefined && { startDate: data.startDate }),
+        ...(newEndDate !== undefined && { endDate: newEndDate }),
+        ...(data.documentUrl !== undefined && { documentUrl: data.documentUrl }),
+        ...(data.documentName !== undefined && { documentName: data.documentName }),
+        ...(datesPinned !== undefined && { datesPinned }),
+        ...(data.locksTimelineOnComplete !== undefined && {
+          locksTimelineOnComplete: data.locksTimelineOnComplete,
+        }),
+      },
+    });
+
+    // Recalculate downstream phases when dates change
+    if (newEndDate && instance.startDate) {
+      const allPhases = await db.timelinePhase.findMany({
+        where: { instanceId },
+        orderBy: { orderIndex: 'asc' },
+      });
+      const recalculated = recalculatePhaseDates(allPhases, instance.startDate);
+      for (const rp of recalculated) {
+        if (rp.id === phaseId) continue; // already updated
+        if (rp.datesPinned || rp.status === 'COMPLETED') continue;
+        await db.timelinePhase.update({
+          where: { id: rp.id },
+          data: { startDate: rp.startDate, endDate: rp.endDate },
+        });
+      }
+    }
+
+    // Auto-complete if documentUrl is set on an AUTO_UPLOAD phase
+    if (
+      data.documentUrl &&
+      updated.completionType === PhaseCompletionType.AUTO_UPLOAD &&
+      !instance.lockedAt &&
+      updated.status !== 'COMPLETED'
+    ) {
+      return this.lifecycle.completePhase(instanceId, phaseId, organizationId);
+    }
+
+    return updated;
+  }
+
+  async addPhase(
+    instanceId: string,
+    organizationId: string,
+    data: {
+      name: string;
+      description?: string;
+      orderIndex: number;
+      durationWeeks: number;
+      completionType?: PhaseCompletionType;
+    },
+  ) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id: instanceId, organizationId },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    return db.$transaction(async (tx) => {
+      // Shift existing phases at or after the new orderIndex
+      await tx.timelinePhase.updateMany({
+        where: {
+          instanceId,
+          orderIndex: { gte: data.orderIndex },
+        },
+        data: { orderIndex: { increment: 1 } },
+      });
+
+      return tx.timelinePhase.create({
+        data: {
+          instanceId,
+          name: data.name,
+          description: data.description,
+          orderIndex: data.orderIndex,
+          durationWeeks: data.durationWeeks,
+          completionType: data.completionType ?? PhaseCompletionType.MANUAL,
+        },
+      });
+    });
+  }
+
+  async removePhase(
+    instanceId: string,
+    phaseId: string,
+    organizationId: string,
+  ) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id: instanceId, organizationId },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    const phase = instance.phases.find((p) => p.id === phaseId);
+    if (!phase) {
+      throw new NotFoundException('Phase not found');
+    }
+
+    return db.$transaction(async (tx) => {
+      await tx.timelinePhase.delete({ where: { id: phaseId } });
+
+      // Re-index remaining phases
+      const remaining = instance.phases
+        .filter((p) => p.id !== phaseId)
+        .sort((a, b) => a.orderIndex - b.orderIndex);
+
+      for (let i = 0; i < remaining.length; i++) {
+        if (remaining[i].orderIndex !== i) {
+          await tx.timelinePhase.update({
+            where: { id: remaining[i].id },
+            data: { orderIndex: i },
+          });
+        }
+      }
+
+      return { success: true };
+    });
+  }
+}
diff --git a/apps/api/src/timelines/timelines-slack.helper.ts b/apps/api/src/timelines/timelines-slack.helper.ts
new file mode 100644
index 0000000000..ee8f5d1991
--- /dev/null
+++ b/apps/api/src/timelines/timelines-slack.helper.ts
@@ -0,0 +1,153 @@
+import { Logger } from '@nestjs/common';
+
+const logger = new Logger('TimelinesSlack');
+
+function appUrl() {
+  return (
+    process.env.NEXT_PUBLIC_APP_URL ??
+    process.env.BETTER_AUTH_URL ??
+    process.env.APP_URL ??
+    'https://app.trycomp.ai'
+  );
+}
+
+function adminTimelineUrl(orgId: string) {
+  return `${appUrl()}/${orgId}/admin/organizations/${orgId}`;
+}
+
+/**
+ * Escape dynamic user-supplied text before interpolating into Slack mrkdwn.
+ * Prevents org names containing `<`, `>`, `&`, `|` from breaking link
+ * syntax like `<url|text>` or rendering as unintended markup.
+ */
+function escapeMrkdwn(text: string): string {
+  return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+async function sendSlack(blocks: unknown[], fallbackText: string): Promise<void> {
+  const webhookUrl = process.env.SLACK_CX_WEBHOOK_URL;
+  if (!webhookUrl) return;
+  try {
+    const response = await fetch(webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text: fallbackText, blocks }),
+    });
+    if (!response.ok) {
+      const body = await response.text().catch(() => '');
+      logger.warn(
+        `Slack webhook returned ${response.status}: ${body.slice(0, 200)}`,
+      );
+    }
+  } catch (err) {
+    logger.warn('Failed to send Slack notification', err);
+  }
+}
+
+function section(text: string) {
+  return { type: 'section', text: { type: 'mrkdwn', text } };
+}
+
+function context(...items: string[]) {
+  return {
+    type: 'context',
+    elements: items.map((t) => ({ type: 'mrkdwn', text: t })),
+  };
+}
+
+function divider() {
+  return { type: 'divider' };
+}
+
+export function notifyReadyForReview({
+  orgId,
+  orgName,
+  frameworkName,
+  phaseName,
+}: {
+  orgId: string;
+  orgName: string;
+  frameworkName: string;
+  phaseName: string;
+}): Promise<void> {
+  const link = adminTimelineUrl(orgId);
+  const safeOrg = escapeMrkdwn(orgName);
+  const safePhase = escapeMrkdwn(phaseName);
+  const safeFramework = escapeMrkdwn(frameworkName);
+  return sendSlack(
+    [
+      section(`:bell:  *Ready for Review*`),
+      section(
+        `*<${link}|${safeOrg}>*  (\`${orgId}\`)\n` +
+        `Marked *${safePhase}* as ready  ·  _${safeFramework}_`,
+      ),
+      context(':arrow_right:  Customer is waiting for CX to begin the next phase'),
+      divider(),
+    ],
+    `${orgName} - ${frameworkName}: ${phaseName} ready for review`,
+  );
+}
+
+export function notifyPhaseCompleted({
+  orgId,
+  orgName,
+  frameworkName,
+  phaseName,
+  completionType,
+}: {
+  orgId: string;
+  orgName: string;
+  frameworkName: string;
+  phaseName: string;
+  completionType: string;
+}): Promise<void> {
+  const typeLabel =
+    completionType === 'AUTO_TASKS' ? ':clipboard:  All evidence tasks completed' :
+    completionType === 'AUTO_POLICIES' ? ':page_facing_up:  All policies published' :
+    completionType === 'AUTO_PEOPLE' ? ':busts_in_silhouette:  All employees compliant' :
+    completionType === 'AUTO_FINDINGS' ? ':mag:  All auditor findings resolved' :
+    completionType === 'AUTO_UPLOAD' ? ':paperclip:  Document uploaded' :
+    ':pencil:  Manually completed';
+
+  const link = adminTimelineUrl(orgId);
+  const safeOrg = escapeMrkdwn(orgName);
+  const safePhase = escapeMrkdwn(phaseName);
+  const safeFramework = escapeMrkdwn(frameworkName);
+  return sendSlack(
+    [
+      section(`:white_check_mark:  *Phase Completed*`),
+      section(
+        `*<${link}|${safeOrg}>*  (\`${orgId}\`)\n` +
+        `Phase: *${safePhase}*  ·  _${safeFramework}_`,
+      ),
+      context(typeLabel),
+      divider(),
+    ],
+    `${orgName} - ${frameworkName}: ${phaseName} completed`,
+  );
+}
+
+export function notifyTimelineCompleted({
+  orgId,
+  orgName,
+  frameworkName,
+}: {
+  orgId: string;
+  orgName: string;
+  frameworkName: string;
+}): Promise<void> {
+  const link = adminTimelineUrl(orgId);
+  const safeOrg = escapeMrkdwn(orgName);
+  const safeFramework = escapeMrkdwn(frameworkName);
+  return sendSlack(
+    [
+      section(`:tada:  *Timeline Completed*`),
+      section(
+        `*<${link}|${safeOrg}>*  (\`${orgId}\`) has completed all phases for *${safeFramework}*`,
+      ),
+      context(':checkered_flag:  Ready for final report delivery'),
+      divider(),
+    ],
+    `${orgName} - ${frameworkName}: all phases complete`,
+  );
+}
diff --git a/apps/api/src/timelines/timelines-template-resolver.spec.ts b/apps/api/src/timelines/timelines-template-resolver.spec.ts
new file mode 100644
index 0000000000..88b756d923
--- /dev/null
+++ b/apps/api/src/timelines/timelines-template-resolver.spec.ts
@@ -0,0 +1,157 @@
+import {
+  findTemplateForCycle,
+  createInstanceFromTemplate,
+} from './timelines-template-resolver';
+
+jest.mock('@db', () => ({
+  db: {
+    timelineTemplate: {
+      findUnique: jest.fn(),
+      findFirst: jest.fn(),
+    },
+    timelineInstance: {
+      create: jest.fn(),
+      findUniqueOrThrow: jest.fn(),
+    },
+    timelinePhase: {
+      create: jest.fn(),
+    },
+    $transaction: jest.fn(),
+  },
+  TimelineStatus: {
+    DRAFT: 'DRAFT',
+    ACTIVE: 'ACTIVE',
+    PAUSED: 'PAUSED',
+    COMPLETED: 'COMPLETED',
+  },
+  PhaseCompletionType: {
+    AUTO_TASKS: 'AUTO_TASKS',
+    AUTO_POLICIES: 'AUTO_POLICIES',
+    AUTO_PEOPLE: 'AUTO_PEOPLE',
+    AUTO_UPLOAD: 'AUTO_UPLOAD',
+    MANUAL: 'MANUAL',
+  },
+}));
+
+import { db } from '@db';
+
+const mockDb = db as jest.Mocked<typeof db>;
+
+describe('timelines-template-resolver', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('returns exact cycle template when available', async () => {
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tml_2',
+      cycleNumber: 2,
+    });
+
+    const result = await findTemplateForCycle('frk_1', 2, 'soc2_type2');
+
+    expect(result).toEqual({ id: 'tml_2', cycleNumber: 2 });
+    expect(mockDb.timelineTemplate.findUnique).toHaveBeenCalledWith({
+      where: {
+        frameworkId_trackKey_cycleNumber: {
+          frameworkId: 'frk_1',
+          trackKey: 'soc2_type2',
+          cycleNumber: 2,
+        },
+      },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+    expect(mockDb.timelineTemplate.findFirst).not.toHaveBeenCalled();
+  });
+
+  it('falls back to highest template with cycle <= requested cycle', async () => {
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue(null);
+    (mockDb.timelineTemplate.findFirst as jest.Mock).mockResolvedValue({
+      id: 'tml_2',
+      cycleNumber: 2,
+    });
+
+    const result = await findTemplateForCycle('frk_1', 5, 'soc2_type2');
+
+    expect(mockDb.timelineTemplate.findFirst).toHaveBeenCalledWith({
+      where: {
+        frameworkId: 'frk_1',
+        trackKey: 'soc2_type2',
+        cycleNumber: { lte: 5 },
+      },
+      orderBy: { cycleNumber: 'desc' },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+    expect(result).toEqual({ id: 'tml_2', cycleNumber: 2 });
+  });
+
+  it('snapshots locksTimelineOnComplete from template phases to instance phases', async () => {
+    const tx = {
+      timelineInstance: {
+        create: jest.fn().mockResolvedValue({ id: 'tli_1' }),
+        findUniqueOrThrow: jest.fn().mockResolvedValue({
+          id: 'tli_1',
+          phases: [
+            { id: 'p1', locksTimelineOnComplete: true },
+            { id: 'p2', locksTimelineOnComplete: false },
+          ],
+        }),
+      },
+      timelinePhase: {
+        create: jest.fn(),
+      },
+    };
+
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => fn(tx));
+
+    await createInstanceFromTemplate({
+      organizationId: 'org_1',
+      frameworkInstanceId: 'fi_1',
+      cycleNumber: 2,
+      template: {
+        id: 'tml_1',
+        phases: [
+          {
+            id: 'tpt_1',
+            name: 'Observation',
+            description: null,
+            groupLabel: null,
+            orderIndex: 0,
+            defaultDurationWeeks: 4,
+            completionType: 'MANUAL' as any,
+            locksTimelineOnComplete: true,
+          },
+          {
+            id: 'tpt_2',
+            name: 'Auditor Review',
+            description: null,
+            groupLabel: null,
+            orderIndex: 1,
+            defaultDurationWeeks: 4,
+            completionType: 'MANUAL' as any,
+            locksTimelineOnComplete: false,
+          },
+        ],
+      },
+    });
+
+    expect(tx.timelinePhase.create).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        data: expect.objectContaining({
+          phaseTemplateId: 'tpt_1',
+          locksTimelineOnComplete: true,
+        }),
+      }),
+    );
+    expect(tx.timelinePhase.create).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        data: expect.objectContaining({
+          phaseTemplateId: 'tpt_2',
+          locksTimelineOnComplete: false,
+        }),
+      }),
+    );
+  });
+});
diff --git a/apps/api/src/timelines/timelines-template-resolver.ts b/apps/api/src/timelines/timelines-template-resolver.ts
new file mode 100644
index 0000000000..0edb0c7fe4
--- /dev/null
+++ b/apps/api/src/timelines/timelines-template-resolver.ts
@@ -0,0 +1,202 @@
+import { db, TimelineStatus, PhaseCompletionType } from '@db';
+import { getDefaultTemplateForCycle } from './default-templates';
+import type { DefaultTimelineTemplate } from './default-templates';
+
+/**
+ * Finds the best-matching DB template for a framework + cycle number.
+ * Tries exact cycleNumber match first, then falls back to highest cycle <= N.
+ */
+export async function findTemplateForCycle(
+  frameworkId: string,
+  cycleNumber: number,
+  trackKey = 'primary',
+) {
+  const exact = await db.timelineTemplate.findUnique({
+    where: {
+      frameworkId_trackKey_cycleNumber: { frameworkId, trackKey, cycleNumber },
+    },
+    include: { phases: { orderBy: { orderIndex: 'asc' } } },
+  });
+
+  if (exact) return exact;
+
+  return db.timelineTemplate.findFirst({
+    where: {
+      frameworkId,
+      trackKey,
+      cycleNumber: { lte: cycleNumber },
+    },
+    orderBy: { cycleNumber: 'desc' },
+    include: { phases: { orderBy: { orderIndex: 'asc' } } },
+  });
+}
+
+/**
+ * Upserts a code-default template into the DB so it can be referenced
+ * by TimelineInstance.templateId and later customized by admins.
+ */
+export async function upsertDefaultTemplate(
+  frameworkId: string,
+  defaultTemplate: DefaultTimelineTemplate,
+  { forceRefresh = false }: { forceRefresh?: boolean } = {},
+) {
+  return db.$transaction(async (tx) => {
+    const trackKey = defaultTemplate.trackKey ?? 'primary';
+
+    const template = await tx.timelineTemplate.upsert({
+      where: {
+        frameworkId_trackKey_cycleNumber: {
+          frameworkId,
+          trackKey,
+          cycleNumber: defaultTemplate.cycleNumber,
+        },
+      },
+      update: {
+        name: defaultTemplate.name,
+        trackKey,
+        templateKey: defaultTemplate.templateKey ?? null,
+        nextTemplateKey: defaultTemplate.nextTemplateKey ?? null,
+      },
+      create: {
+        frameworkId,
+        name: defaultTemplate.name,
+        trackKey,
+        cycleNumber: defaultTemplate.cycleNumber,
+        templateKey: defaultTemplate.templateKey,
+        nextTemplateKey: defaultTemplate.nextTemplateKey,
+      },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+
+    const shouldSeedPhases = template.phases.length === 0 || forceRefresh;
+
+    if (shouldSeedPhases) {
+      // Clear existing phases if refreshing
+      if (template.phases.length > 0) {
+        await tx.timelinePhaseTemplate.deleteMany({
+          where: { templateId: template.id },
+        });
+      }
+
+      for (const phase of defaultTemplate.phases) {
+        await tx.timelinePhaseTemplate.create({
+          data: {
+            templateId: template.id,
+            name: phase.name,
+            description: phase.description,
+            groupLabel: phase.groupLabel,
+            orderIndex: phase.orderIndex,
+            defaultDurationWeeks: phase.defaultDurationWeeks,
+            completionType: phase.completionType,
+            locksTimelineOnComplete: phase.locksTimelineOnComplete ?? false,
+          },
+        });
+      }
+
+      return tx.timelineTemplate.findUniqueOrThrow({
+        where: { id: template.id },
+        include: { phases: { orderBy: { orderIndex: 'asc' } } },
+      });
+    }
+
+    return template;
+  });
+}
+
+/**
+ * Resolves a template for a given framework + cycle, checking DB first,
+ * then falling back to code defaults (auto-upserting them into the DB).
+ */
+export async function resolveTemplate(
+  frameworkId: string,
+  frameworkName: string,
+  cycleNumber: number,
+  {
+    forceRefresh = false,
+    trackKey = 'primary',
+  }: { forceRefresh?: boolean; trackKey?: string } = {},
+) {
+  if (!forceRefresh) {
+    const dbTemplate = await findTemplateForCycle(frameworkId, cycleNumber, trackKey);
+    if (dbTemplate) return dbTemplate;
+  }
+
+  const codeDefault = getDefaultTemplateForCycle(frameworkName, cycleNumber, {
+    trackKey,
+  });
+  if (!codeDefault) {
+    // No code default — fall back to DB even if forceRefresh
+    return findTemplateForCycle(frameworkId, cycleNumber, trackKey);
+  }
+
+  return upsertDefaultTemplate(frameworkId, codeDefault, { forceRefresh });
+}
+
+/**
+ * Creates a TimelineInstance with phases copied from a resolved DB template.
+ */
+export async function createInstanceFromTemplate({
+  organizationId,
+  frameworkInstanceId,
+  cycleNumber,
+  template,
+}: {
+  organizationId: string;
+  frameworkInstanceId: string;
+  cycleNumber: number;
+  template: {
+    id: string;
+    frameworkId?: string;
+    trackKey?: string;
+    templateKey?: string | null;
+    nextTemplateKey?: string | null;
+    phases: Array<{
+      id: string;
+      name: string;
+      description: string | null;
+      groupLabel: string | null;
+      orderIndex: number;
+      defaultDurationWeeks: number;
+      completionType: PhaseCompletionType;
+      locksTimelineOnComplete: boolean;
+    }>;
+  };
+}) {
+  return db.$transaction(async (tx) => {
+    const instance = await tx.timelineInstance.create({
+      data: {
+        organizationId,
+        frameworkInstanceId,
+        templateId: template.id,
+        trackKey: template.trackKey ?? 'primary',
+        cycleNumber,
+        status: TimelineStatus.DRAFT,
+      },
+    });
+
+    for (const phase of template.phases) {
+      await tx.timelinePhase.create({
+        data: {
+          instanceId: instance.id,
+          phaseTemplateId: phase.id,
+          name: phase.name,
+          description: phase.description,
+          groupLabel: phase.groupLabel,
+          orderIndex: phase.orderIndex,
+          durationWeeks: phase.defaultDurationWeeks,
+          completionType: phase.completionType,
+          locksTimelineOnComplete: phase.locksTimelineOnComplete,
+        },
+      });
+    }
+
+    return tx.timelineInstance.findUniqueOrThrow({
+      where: { id: instance.id },
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        frameworkInstance: { include: { framework: true } },
+        template: true,
+      },
+    });
+  });
+}
diff --git a/apps/api/src/timelines/timelines-templates.service.spec.ts b/apps/api/src/timelines/timelines-templates.service.spec.ts
new file mode 100644
index 0000000000..f12af67f85
--- /dev/null
+++ b/apps/api/src/timelines/timelines-templates.service.spec.ts
@@ -0,0 +1,207 @@
+import { TimelinesTemplatesService } from './timelines-templates.service';
+
+jest.mock('@db', () => ({
+  db: {
+    frameworkEditorFramework: {
+      findMany: jest.fn(),
+    },
+    timelineTemplate: {
+      findMany: jest.fn(),
+      findUnique: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      delete: jest.fn(),
+    },
+    timelinePhaseTemplate: {
+      findFirst: jest.fn(),
+      updateMany: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      delete: jest.fn(),
+      findMany: jest.fn(),
+    },
+    $transaction: jest.fn(),
+  },
+  PhaseCompletionType: {
+    AUTO_TASKS: 'AUTO_TASKS',
+    AUTO_POLICIES: 'AUTO_POLICIES',
+    AUTO_PEOPLE: 'AUTO_PEOPLE',
+    AUTO_UPLOAD: 'AUTO_UPLOAD',
+    MANUAL: 'MANUAL',
+  },
+}));
+
+jest.mock('./timelines-template-resolver', () => ({
+  upsertDefaultTemplate: jest.fn(),
+}));
+
+jest.mock('./default-templates', () => ({
+  getDefaultTemplatesForFramework: jest.fn(),
+  GENERIC_DEFAULT_TIMELINE_TEMPLATE: {
+    frameworkName: '*',
+    name: 'Baseline Compliance Timeline',
+    cycleNumber: 1,
+    phases: [
+      {
+        name: 'Scoping & Planning',
+        description: 'Define scope, owners, and audit goals for this cycle.',
+        orderIndex: 0,
+        defaultDurationWeeks: 2,
+        completionType: 'MANUAL',
+      },
+    ],
+  },
+}));
+
+import { db } from '@db';
+import { upsertDefaultTemplate } from './timelines-template-resolver';
+import { getDefaultTemplatesForFramework } from './default-templates';
+
+const mockDb = db as jest.Mocked<typeof db>;
+
+describe('TimelinesTemplatesService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('seeds framework-specific defaults for all frameworks before listing templates', async () => {
+    const service = new TimelinesTemplatesService();
+
+    (mockDb.frameworkEditorFramework.findMany as jest.Mock).mockResolvedValue([
+      { id: 'frk_soc2', name: 'SOC2' },
+      { id: 'frk_iso', name: 'ISO 27001' },
+    ]);
+
+    (getDefaultTemplatesForFramework as jest.Mock)
+      .mockReturnValueOnce([
+        { frameworkName: 'SOC 2', name: 'SOC 2 Type 1', cycleNumber: 1, phases: [] },
+        { frameworkName: 'SOC 2', name: 'SOC 2 Type 2', cycleNumber: 2, phases: [] },
+      ])
+      .mockReturnValueOnce([
+        { frameworkName: 'ISO27001', name: 'ISO 27001', cycleNumber: 1, phases: [] },
+      ]);
+
+    (mockDb.timelineTemplate.findMany as jest.Mock).mockResolvedValue([]);
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await service.findAll();
+
+    expect(mockDb.frameworkEditorFramework.findMany).toHaveBeenCalledWith({
+      select: { id: true, name: true },
+    });
+
+    expect(upsertDefaultTemplate).toHaveBeenCalledWith(
+      'frk_soc2',
+      expect.objectContaining({ name: 'SOC 2 Type 1', cycleNumber: 1 }),
+    );
+    expect(upsertDefaultTemplate).toHaveBeenCalledWith(
+      'frk_soc2',
+      expect.objectContaining({ name: 'SOC 2 Type 2', cycleNumber: 2 }),
+    );
+    expect(upsertDefaultTemplate).toHaveBeenCalledWith(
+      'frk_iso',
+      expect.objectContaining({ name: 'ISO 27001', cycleNumber: 1 }),
+    );
+    expect(mockDb.timelineTemplate.findMany).toHaveBeenCalledWith({
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        framework: true,
+      },
+      orderBy: [{ frameworkId: 'asc' }, { trackKey: 'asc' }, { cycleNumber: 'asc' }],
+    });
+  });
+
+  it('seeds generic baseline template when framework has no specific default', async () => {
+    const service = new TimelinesTemplatesService();
+
+    (mockDb.frameworkEditorFramework.findMany as jest.Mock).mockResolvedValue([
+      { id: 'frk_custom', name: 'My Custom Framework' },
+    ]);
+    (getDefaultTemplatesForFramework as jest.Mock).mockReturnValue([]);
+    (mockDb.timelineTemplate.findMany as jest.Mock).mockResolvedValue([]);
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await service.findAll();
+
+    expect(upsertDefaultTemplate).toHaveBeenCalledWith(
+      'frk_custom',
+      expect.objectContaining({
+        cycleNumber: 1,
+        frameworkName: 'My Custom Framework',
+      }),
+    );
+  });
+
+  it('does not overwrite existing templates when framework cycle already exists', async () => {
+    const service = new TimelinesTemplatesService();
+
+    (mockDb.frameworkEditorFramework.findMany as jest.Mock).mockResolvedValue([
+      { id: 'frk_soc2', name: 'SOC2' },
+    ]);
+    (getDefaultTemplatesForFramework as jest.Mock).mockReturnValue([
+      { frameworkName: 'SOC 2', name: 'SOC 2 Type 1', cycleNumber: 1, phases: [] },
+    ]);
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue({ id: 'tml_existing' });
+    (mockDb.timelineTemplate.findMany as jest.Mock).mockResolvedValue([]);
+
+    await service.findAll();
+
+    expect(upsertDefaultTemplate).not.toHaveBeenCalled();
+  });
+
+  it('normalizes legacy default SOC 2 renewal template name', async () => {
+    const service = new TimelinesTemplatesService();
+
+    (mockDb.frameworkEditorFramework.findMany as jest.Mock).mockResolvedValue([
+      { id: 'frk_soc2', name: 'SOC 2' },
+    ]);
+    (getDefaultTemplatesForFramework as jest.Mock).mockReturnValue([
+      {
+        frameworkName: 'SOC 2',
+        name: 'SOC 2 Type 2',
+        cycleNumber: 2,
+        trackKey: 'soc2_type2',
+        templateKey: 'soc2_type2_renewal',
+        nextTemplateKey: 'soc2_type2_renewal',
+        phases: [],
+      },
+    ]);
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tml_soc2_renewal',
+      name: 'SOC 2 Type 2 - Year 2+',
+      templateKey: 'soc2_type2_renewal',
+      nextTemplateKey: 'soc2_type2_renewal',
+    });
+    (mockDb.timelineTemplate.findMany as jest.Mock).mockResolvedValue([]);
+
+    await service.findAll();
+
+    expect(mockDb.timelineTemplate.update).toHaveBeenCalledWith({
+      where: { id: 'tml_soc2_renewal' },
+      data: {
+        name: 'SOC 2 Type 2',
+        templateKey: 'soc2_type2_renewal',
+        nextTemplateKey: 'soc2_type2_renewal',
+      },
+    });
+    expect(upsertDefaultTemplate).not.toHaveBeenCalled();
+  });
+
+  it('returns an empty list when no frameworks exist', async () => {
+    const service = new TimelinesTemplatesService();
+
+    (mockDb.frameworkEditorFramework.findMany as jest.Mock).mockResolvedValue([]);
+    (mockDb.timelineTemplate.findMany as jest.Mock).mockResolvedValue([]);
+
+    const result = await service.findAll();
+
+    expect(result).toEqual([]);
+    expect(mockDb.timelineTemplate.findMany).toHaveBeenCalledWith({
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        framework: true,
+      },
+      orderBy: [{ frameworkId: 'asc' }, { trackKey: 'asc' }, { cycleNumber: 'asc' }],
+    });
+  });
+});
diff --git a/apps/api/src/timelines/timelines-templates.service.ts b/apps/api/src/timelines/timelines-templates.service.ts
new file mode 100644
index 0000000000..b6bbe74a52
--- /dev/null
+++ b/apps/api/src/timelines/timelines-templates.service.ts
@@ -0,0 +1,290 @@
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { db, PhaseCompletionType } from '@db';
+import { upsertDefaultTemplate } from './timelines-template-resolver';
+import {
+  GENERIC_DEFAULT_TIMELINE_TEMPLATE,
+  getDefaultTemplatesForFramework,
+} from './default-templates';
+
+const LEGACY_DEFAULT_TEMPLATE_NAME_BY_KEY: Record<string, string> = {
+  soc2_type2_renewal: 'SOC 2 Type 2 - Year 2+',
+};
+
+@Injectable()
+export class TimelinesTemplatesService {
+  private async ensureCatalogTemplatesExist() {
+    const frameworks = await db.frameworkEditorFramework.findMany({
+      select: { id: true, name: true },
+    });
+
+    for (const framework of frameworks) {
+      const defaults = getDefaultTemplatesForFramework(framework.name);
+
+      if (defaults.length > 0) {
+        for (const template of defaults) {
+          const trackKey = template.trackKey ?? 'primary';
+          const existing = await db.timelineTemplate.findUnique({
+            where: {
+              frameworkId_trackKey_cycleNumber: {
+                frameworkId: framework.id,
+                trackKey,
+                cycleNumber: template.cycleNumber,
+              },
+            },
+            select: {
+              id: true,
+              name: true,
+              templateKey: true,
+              nextTemplateKey: true,
+            },
+          });
+          if (existing) {
+            const expectedTemplateKey = template.templateKey ?? null;
+            const expectedNextTemplateKey = template.nextTemplateKey ?? null;
+            const legacyDefaultName =
+              expectedTemplateKey
+                ? LEGACY_DEFAULT_TEMPLATE_NAME_BY_KEY[expectedTemplateKey]
+                : undefined;
+            const shouldNormalizeLegacyDefaultName =
+              !!legacyDefaultName &&
+              existing.name === legacyDefaultName &&
+              template.name !== legacyDefaultName;
+
+            if (
+              existing.templateKey !== expectedTemplateKey ||
+              existing.nextTemplateKey !== expectedNextTemplateKey ||
+              shouldNormalizeLegacyDefaultName
+            ) {
+              await db.timelineTemplate.update({
+                where: { id: existing.id },
+                data: {
+                  ...(shouldNormalizeLegacyDefaultName
+                    ? { name: template.name }
+                    : {}),
+                  templateKey: expectedTemplateKey,
+                  nextTemplateKey: expectedNextTemplateKey,
+                },
+              });
+            }
+            continue;
+          }
+
+          await upsertDefaultTemplate(framework.id, template);
+        }
+        continue;
+      }
+
+      const existingGeneric = await db.timelineTemplate.findUnique({
+        where: {
+          frameworkId_trackKey_cycleNumber: {
+            frameworkId: framework.id,
+            trackKey: GENERIC_DEFAULT_TIMELINE_TEMPLATE.trackKey ?? 'primary',
+            cycleNumber: GENERIC_DEFAULT_TIMELINE_TEMPLATE.cycleNumber,
+          },
+        },
+        select: { id: true },
+      });
+      if (existingGeneric) continue;
+
+      await upsertDefaultTemplate(framework.id, {
+        ...GENERIC_DEFAULT_TIMELINE_TEMPLATE,
+        frameworkName: framework.name,
+        name: `${framework.name} Timeline`,
+        phases: GENERIC_DEFAULT_TIMELINE_TEMPLATE.phases.map((phase) => ({
+          ...phase,
+        })),
+      });
+    }
+  }
+
+  async findAll() {
+    await this.ensureCatalogTemplatesExist();
+
+    return db.timelineTemplate.findMany({
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        framework: true,
+      },
+      orderBy: [{ frameworkId: 'asc' }, { trackKey: 'asc' }, { cycleNumber: 'asc' }],
+    });
+  }
+
+  async findOne(id: string) {
+    const template = await db.timelineTemplate.findUnique({
+      where: { id },
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        framework: true,
+      },
+    });
+
+    if (!template) {
+      throw new NotFoundException('Timeline template not found');
+    }
+
+    return template;
+  }
+
+  async create(data: {
+    frameworkId: string;
+    name: string;
+    cycleNumber: number;
+  }) {
+    return db.timelineTemplate.create({
+      data: {
+        frameworkId: data.frameworkId,
+        name: data.name,
+        cycleNumber: data.cycleNumber,
+      },
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        framework: true,
+      },
+    });
+  }
+
+  async update(id: string, data: { name?: string; frameworkId?: string; cycleNumber?: number }) {
+    const template = await db.timelineTemplate.findUnique({
+      where: { id },
+    });
+
+    if (!template) {
+      throw new NotFoundException('Timeline template not found');
+    }
+
+    return db.timelineTemplate.update({
+      where: { id },
+      data,
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        framework: true,
+      },
+    });
+  }
+
+  async delete(id: string) {
+    const template = await db.timelineTemplate.findUnique({
+      where: { id },
+      include: { instances: { select: { id: true }, take: 1 } },
+    });
+
+    if (!template) {
+      throw new NotFoundException('Timeline template not found');
+    }
+
+    if (template.instances.length > 0) {
+      throw new BadRequestException(
+        'Cannot delete a template that has existing timeline instances',
+      );
+    }
+
+    await db.timelineTemplate.delete({ where: { id } });
+    return { success: true };
+  }
+
+  async addPhase(
+    templateId: string,
+    data: {
+      name: string;
+      description?: string;
+      groupLabel?: string;
+      orderIndex: number;
+      defaultDurationWeeks: number;
+      completionType?: PhaseCompletionType;
+      locksTimelineOnComplete?: boolean;
+    },
+  ) {
+    const template = await db.timelineTemplate.findUnique({
+      where: { id: templateId },
+    });
+
+    if (!template) {
+      throw new NotFoundException('Timeline template not found');
+    }
+
+    return db.$transaction(async (tx) => {
+      await tx.timelinePhaseTemplate.updateMany({
+        where: {
+          templateId,
+          orderIndex: { gte: data.orderIndex },
+        },
+        data: { orderIndex: { increment: 1 } },
+      });
+
+      return tx.timelinePhaseTemplate.create({
+        data: {
+          templateId,
+          name: data.name,
+          description: data.description,
+          groupLabel: data.groupLabel,
+          orderIndex: data.orderIndex,
+          defaultDurationWeeks: data.defaultDurationWeeks,
+          completionType: data.completionType ?? PhaseCompletionType.MANUAL,
+          locksTimelineOnComplete: data.locksTimelineOnComplete ?? false,
+        },
+      });
+    });
+  }
+
+  async updatePhase(
+    templateId: string,
+    phaseId: string,
+    data: {
+      name?: string;
+      description?: string;
+      groupLabel?: string;
+      orderIndex?: number;
+      defaultDurationWeeks?: number;
+      completionType?: PhaseCompletionType;
+      locksTimelineOnComplete?: boolean;
+    },
+  ) {
+    const phase = await db.timelinePhaseTemplate.findFirst({
+      where: { id: phaseId, templateId },
+    });
+
+    if (!phase) {
+      throw new NotFoundException('Phase template not found');
+    }
+
+    return db.timelinePhaseTemplate.update({
+      where: { id: phaseId },
+      data,
+    });
+  }
+
+  async deletePhase(templateId: string, phaseId: string) {
+    const phase = await db.timelinePhaseTemplate.findFirst({
+      where: { id: phaseId, templateId },
+    });
+
+    if (!phase) {
+      throw new NotFoundException('Phase template not found');
+    }
+
+    return db.$transaction(async (tx) => {
+      await tx.timelinePhaseTemplate.delete({ where: { id: phaseId } });
+
+      // Re-index remaining phases
+      const remaining = await tx.timelinePhaseTemplate.findMany({
+        where: { templateId },
+        orderBy: { orderIndex: 'asc' },
+      });
+
+      for (let i = 0; i < remaining.length; i++) {
+        if (remaining[i].orderIndex !== i) {
+          await tx.timelinePhaseTemplate.update({
+            where: { id: remaining[i].id },
+            data: { orderIndex: i },
+          });
+        }
+      }
+
+      return { success: true };
+    });
+  }
+}
diff --git a/apps/api/src/timelines/timelines.controller.ts b/apps/api/src/timelines/timelines.controller.ts
new file mode 100644
index 0000000000..6edddfde6d
--- /dev/null
+++ b/apps/api/src/timelines/timelines.controller.ts
@@ -0,0 +1,64 @@
+import { Controller, Get, Post, Param, UseGuards } from '@nestjs/common';
+import { ApiTags, ApiBearerAuth, ApiOperation } from '@nestjs/swagger';
+import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
+import { PermissionGuard } from '../auth/permission.guard';
+import { RequirePermission } from '../auth/require-permission.decorator';
+import { OrganizationId } from '../auth/auth-context.decorator';
+import { TimelinesService } from './timelines.service';
+import { notifyReadyForReview } from './timelines-slack.helper';
+
+@ApiTags('Timelines')
+@ApiBearerAuth()
+@UseGuards(HybridAuthGuard, PermissionGuard)
+@Controller({ path: 'timelines', version: '1' })
+export class TimelinesController {
+  constructor(private readonly timelinesService: TimelinesService) {}
+
+  @Get()
+  @RequirePermission('framework', 'read')
+  @ApiOperation({ summary: 'List timelines for the organization' })
+  async findAll(@OrganizationId() organizationId: string) {
+    const data =
+      await this.timelinesService.findAllForOrganization(organizationId);
+    return { data, count: data.length };
+  }
+
+  @Get(':id')
+  @RequirePermission('framework', 'read')
+  @ApiOperation({ summary: 'Get a single timeline instance with phases' })
+  async findOne(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+  ) {
+    return this.timelinesService.findOne(id, organizationId);
+  }
+
+  @Post(':id/phases/:phaseId/ready')
+  @RequirePermission('framework', 'update')
+  @ApiOperation({ summary: 'Mark a phase as ready for review' })
+  async markReadyForReview(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+    @Param('phaseId') phaseId: string,
+  ) {
+    const result = await this.timelinesService.markReadyForReview(
+      id,
+      phaseId,
+      organizationId,
+    );
+
+    // Only notify Slack on the first transition — service returns
+    // alreadyReady=true on retries / double-clicks so the CX channel
+    // doesn't get pinged repeatedly for the same phase.
+    if (!result.alreadyReady) {
+      notifyReadyForReview({
+        orgId: organizationId,
+        orgName: result.organization.name,
+        frameworkName: result.framework?.name ?? 'Unknown framework',
+        phaseName: result.phase.name,
+      });
+    }
+
+    return result;
+  }
+}
diff --git a/apps/api/src/timelines/timelines.module.ts b/apps/api/src/timelines/timelines.module.ts
new file mode 100644
index 0000000000..3fd0349924
--- /dev/null
+++ b/apps/api/src/timelines/timelines.module.ts
@@ -0,0 +1,26 @@
+import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { TimelinesController } from './timelines.controller';
+import { AdminTimelineTemplatesController } from './admin-timeline-templates.controller';
+import { AdminOrgTimelinesController } from './admin-org-timelines.controller';
+import { TimelinesService } from './timelines.service';
+import { TimelinesLifecycleService } from './timelines-lifecycle.service';
+import { TimelinesTemplatesService } from './timelines-templates.service';
+import { TimelinesPhasesService } from './timelines-phases.service';
+
+@Module({
+  imports: [AuthModule],
+  controllers: [
+    TimelinesController,
+    AdminTimelineTemplatesController,
+    AdminOrgTimelinesController,
+  ],
+  providers: [
+    TimelinesService,
+    TimelinesLifecycleService,
+    TimelinesTemplatesService,
+    TimelinesPhasesService,
+  ],
+  exports: [TimelinesService],
+})
+export class TimelinesModule {}
diff --git a/apps/api/src/timelines/timelines.service.spec.ts b/apps/api/src/timelines/timelines.service.spec.ts
new file mode 100644
index 0000000000..eb70ab885f
--- /dev/null
+++ b/apps/api/src/timelines/timelines.service.spec.ts
@@ -0,0 +1,753 @@
+import { TimelinesService } from './timelines.service';
+import { BadRequestException } from '@nestjs/common';
+
+jest.mock('@db', () => ({
+  db: {
+    frameworkInstance: {
+      findMany: jest.fn(),
+    },
+    timelineInstance: {
+      findMany: jest.fn(),
+      findFirst: jest.fn(),
+      findUnique: jest.fn(),
+      update: jest.fn(),
+      delete: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    timelineTemplate: {
+      findUnique: jest.fn(),
+    },
+    timelinePhase: {
+      update: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    $transaction: jest.fn(),
+  },
+  TimelinePhaseStatus: {
+    PENDING: 'PENDING',
+    IN_PROGRESS: 'IN_PROGRESS',
+    COMPLETED: 'COMPLETED',
+  },
+}));
+
+jest.mock('../frameworks/frameworks-scores.helper', () => ({
+  getOverviewScores: jest.fn(),
+}));
+
+jest.mock('./timelines-backfill.helper', () => ({
+  backfillTimeline: jest.fn(),
+}));
+
+jest.mock('./timelines-template-resolver', () => ({
+  resolveTemplate: jest.fn(),
+  createInstanceFromTemplate: jest.fn(),
+}));
+
+import { db } from '@db';
+import { getOverviewScores } from '../frameworks/frameworks-scores.helper';
+import { createInstanceFromTemplate } from './timelines-template-resolver';
+import { backfillTimeline } from './timelines-backfill.helper';
+
+const mockDb = db as jest.Mocked<typeof db>;
+
+function cloneTimeline<T>(value: T): T {
+  return JSON.parse(JSON.stringify(value)) as T;
+}
+
+describe('TimelinesService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('cascades AUTO_* phase completions when live metrics are already 100%', async () => {
+    const orgId = 'org_1';
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+
+    const service = new TimelinesService(lifecycle as any);
+
+    const timelineState = {
+      id: 'tli_1',
+      organizationId: orgId,
+      frameworkInstanceId: 'fi_1',
+      templateId: 'tml_1',
+      cycleNumber: 2,
+      status: 'ACTIVE',
+      startDate: '2026-01-01T00:00:00.000Z',
+      pausedAt: null,
+      completedAt: null,
+      phases: [
+        {
+          id: 'p1',
+          name: 'Policies',
+          orderIndex: 0,
+          status: 'IN_PROGRESS',
+          completionType: 'AUTO_POLICIES',
+          completedAt: null,
+        },
+        {
+          id: 'p2',
+          name: 'Evidence',
+          orderIndex: 1,
+          status: 'PENDING',
+          completionType: 'AUTO_TASKS',
+          completedAt: null,
+        },
+        {
+          id: 'p3',
+          name: 'People',
+          orderIndex: 2,
+          status: 'PENDING',
+          completionType: 'AUTO_PEOPLE',
+          completedAt: null,
+        },
+        {
+          id: 'p4',
+          name: 'Auditor Review',
+          orderIndex: 3,
+          status: 'PENDING',
+          completionType: 'MANUAL',
+          completedAt: null,
+        },
+      ],
+      frameworkInstance: { framework: { id: 'frk_1', name: 'SOC 2' } },
+      template: { id: 'tml_1', name: 'SOC 2 Type 2' },
+    };
+
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'fi_1',
+        frameworkId: 'frk_1',
+        framework: { id: 'frk_1', name: 'SOC 2' },
+        timelineInstances: [{ id: 'tli_1' }],
+      },
+    ]);
+
+    (mockDb.timelineInstance.findMany as jest.Mock).mockImplementation(() =>
+      Promise.resolve([cloneTimeline(timelineState)]),
+    );
+
+    (getOverviewScores as jest.Mock).mockResolvedValue({
+      policies: { total: 10, published: 10 },
+      tasks: { total: 20, done: 20 },
+      people: { total: 5, completed: 5 },
+    });
+
+    lifecycle.completePhase.mockImplementation(async (_instanceId: string, phaseId: string) => {
+      const phase = timelineState.phases.find((p) => p.id === phaseId);
+      if (!phase) return cloneTimeline(timelineState);
+
+      phase.status = 'COMPLETED';
+      phase.completedAt = '2026-01-10T00:00:00.000Z';
+
+      const nextPending = timelineState.phases.find((p) => p.status === 'PENDING');
+      if (nextPending) {
+        const allPriorComplete = timelineState.phases
+          .filter((p) => p.orderIndex < nextPending.orderIndex)
+          .every((p) => p.status === 'COMPLETED');
+
+        if (allPriorComplete) {
+          nextPending.status = 'IN_PROGRESS';
+        }
+      }
+
+      return cloneTimeline(timelineState);
+    });
+
+    const result = await service.findAllForOrganization(orgId);
+
+    expect(lifecycle.completePhase).toHaveBeenCalledTimes(3);
+    expect(result[0].phases.map((p) => p.status)).toEqual([
+      'COMPLETED',
+      'COMPLETED',
+      'COMPLETED',
+      'IN_PROGRESS',
+    ]);
+  });
+
+  it('does not auto-complete AUTO phases while a timeline is paused', async () => {
+    const orgId = 'org_1';
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    const timelineState = {
+      id: 'tli_paused',
+      organizationId: orgId,
+      frameworkInstanceId: 'fi_1',
+      templateId: 'tml_1',
+      cycleNumber: 2,
+      status: 'PAUSED',
+      startDate: '2026-01-01T00:00:00.000Z',
+      pausedAt: '2026-01-10T00:00:00.000Z',
+      completedAt: null,
+      phases: [
+        {
+          id: 'p1',
+          name: 'Policies',
+          orderIndex: 0,
+          status: 'IN_PROGRESS',
+          completionType: 'AUTO_POLICIES',
+          completedAt: null,
+        },
+      ],
+      frameworkInstance: { framework: { id: 'frk_1', name: 'SOC 2' } },
+      template: { id: 'tml_1', name: 'SOC 2 Type 2' },
+    };
+
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'fi_1',
+        frameworkId: 'frk_1',
+        framework: { id: 'frk_1', name: 'SOC 2' },
+        timelineInstances: [{ id: 'tli_paused' }],
+      },
+    ]);
+    (mockDb.timelineInstance.findMany as jest.Mock).mockImplementation(() =>
+      Promise.resolve([cloneTimeline(timelineState)]),
+    );
+    (getOverviewScores as jest.Mock).mockResolvedValue({
+      policies: { total: 10, published: 10 },
+      tasks: { total: 1, done: 1 },
+      people: { total: 1, completed: 1 },
+    });
+
+    const result = await service.findAllForOrganization(orgId);
+
+    expect(lifecycle.completePhase).not.toHaveBeenCalled();
+    expect(result[0].phases[0].status).toBe('IN_PROGRESS');
+  });
+
+  it('records regressedAt when a completed AUTO phase drops below 100%', async () => {
+    const orgId = 'org_1';
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    const timelineState = {
+      id: 'tli_reopen',
+      organizationId: orgId,
+      frameworkInstanceId: 'fi_1',
+      templateId: 'tml_1',
+      cycleNumber: 2,
+      status: 'ACTIVE',
+      startDate: '2026-01-01T00:00:00.000Z',
+      pausedAt: null,
+      completedAt: null,
+      phases: [
+        {
+          id: 'p1',
+          name: 'Policies',
+          orderIndex: 0,
+          status: 'COMPLETED',
+          completionType: 'AUTO_POLICIES',
+          completedAt: '2026-01-03T00:00:00.000Z',
+          regressedAt: null,
+        },
+      ],
+      frameworkInstance: { framework: { id: 'frk_1', name: 'SOC 2' } },
+      template: { id: 'tml_1', name: 'SOC 2 Type 2' },
+    };
+
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'fi_1',
+        frameworkId: 'frk_1',
+        framework: { id: 'frk_1', name: 'SOC 2' },
+        timelineInstances: [{ id: 'tli_reopen' }],
+      },
+    ]);
+    (mockDb.timelineInstance.findMany as jest.Mock).mockImplementation(() =>
+      Promise.resolve([cloneTimeline(timelineState)]),
+    );
+    (mockDb.timelinePhase.update as jest.Mock).mockImplementation(async ({ where, data }: any) => {
+      const phase = timelineState.phases.find((p) => p.id === where.id);
+      if (!phase) return null;
+      Object.assign(phase, data);
+      return phase;
+    });
+    (getOverviewScores as jest.Mock).mockResolvedValue({
+      policies: { total: 10, published: 8 },
+      tasks: { total: 1, done: 1 },
+      people: { total: 1, completed: 1 },
+    });
+
+    const result = await service.findAllForOrganization(orgId);
+
+    expect(mockDb.timelinePhase.update).toHaveBeenCalledWith({
+      where: { id: 'p1' },
+      data: { regressedAt: expect.any(Date) },
+    });
+    expect(result[0].phases[0].status).toBe('COMPLETED');
+    expect(result[0].phases[0].regressedAt).toBeTruthy();
+  });
+
+  it('re-opens AUTO_PEOPLE immediately when live people score drops below 100%', async () => {
+    const orgId = 'org_1';
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    const timelineState = {
+      id: 'tli_people_reopen',
+      organizationId: orgId,
+      frameworkInstanceId: 'fi_1',
+      templateId: 'tml_1',
+      cycleNumber: 1,
+      status: 'ACTIVE',
+      lockedAt: null,
+      startDate: '2026-01-01T00:00:00.000Z',
+      pausedAt: null,
+      completedAt: null,
+      phases: [
+        {
+          id: 'p1',
+          name: 'People',
+          orderIndex: 0,
+          status: 'COMPLETED',
+          completionType: 'AUTO_PEOPLE',
+          completedAt: '2026-01-10T00:00:00.000Z',
+          regressedAt: null,
+          completedById: null,
+          readyForReview: false,
+          readyForReviewAt: null,
+        },
+        {
+          id: 'p2',
+          name: 'Auditor Review',
+          orderIndex: 1,
+          status: 'PENDING',
+          completionType: 'MANUAL',
+          completedAt: null,
+          regressedAt: null,
+          completedById: null,
+          readyForReview: false,
+          readyForReviewAt: null,
+        },
+      ],
+      frameworkInstance: { framework: { id: 'frk_1', name: 'SOC 2' } },
+      template: { id: 'tml_1', name: 'SOC 2 Type 1' },
+    };
+
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'fi_1',
+        frameworkId: 'frk_1',
+        framework: { id: 'frk_1', name: 'SOC 2' },
+        timelineInstances: [{ id: 'tli_people_reopen' }],
+      },
+    ]);
+    (mockDb.timelineInstance.findMany as jest.Mock).mockImplementation(() =>
+      Promise.resolve([cloneTimeline(timelineState)]),
+    );
+
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => {
+      const tx = {
+        timelinePhase: {
+          findMany: jest.fn(async () => cloneTimeline(timelineState.phases)),
+          update: jest.fn(async ({ where, data }: any) => {
+            const phase = timelineState.phases.find((p) => p.id === where.id);
+            if (!phase) return null;
+            Object.assign(phase, data);
+            return phase;
+          }),
+        },
+      };
+      return fn(tx);
+    });
+
+    (getOverviewScores as jest.Mock).mockResolvedValue({
+      policies: { total: 10, published: 10 },
+      tasks: { total: 1, done: 1 },
+      people: { total: 2, completed: 1 },
+    });
+
+    const result = await service.findAllForOrganization(orgId);
+
+    expect(mockDb.$transaction).toHaveBeenCalledTimes(1);
+    expect(result[0].phases.map((phase) => phase.status)).toEqual([
+      'IN_PROGRESS',
+      'PENDING',
+    ]);
+    expect(result[0].phases[0].regressedAt).toBeNull();
+  });
+
+  it('re-opens a regressed AUTO phase after the 24-hour grace window', async () => {
+    jest.useFakeTimers().setSystemTime(new Date('2026-02-15T00:00:00.000Z'));
+
+    const orgId = 'org_1';
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    const timelineState = {
+      id: 'tli_reopen_after_grace',
+      organizationId: orgId,
+      frameworkInstanceId: 'fi_1',
+      templateId: 'tml_1',
+      cycleNumber: 2,
+      status: 'ACTIVE',
+      lockedAt: null,
+      startDate: '2026-01-01T00:00:00.000Z',
+      pausedAt: null,
+      completedAt: null,
+      phases: [
+        {
+          id: 'p1',
+          name: 'Policies',
+          orderIndex: 0,
+          status: 'COMPLETED',
+          completionType: 'AUTO_POLICIES',
+          completedAt: '2026-01-03T00:00:00.000Z',
+          regressedAt: '2026-02-10T00:00:00.000Z',
+          completedById: 'usr_1',
+          readyForReview: true,
+          readyForReviewAt: '2026-01-03T01:00:00.000Z',
+        },
+        {
+          id: 'p2',
+          name: 'Auditor Review',
+          orderIndex: 1,
+          status: 'COMPLETED',
+          completionType: 'MANUAL',
+          completedAt: '2026-01-20T00:00:00.000Z',
+          regressedAt: null,
+          completedById: 'usr_2',
+          readyForReview: false,
+          readyForReviewAt: null,
+        },
+      ],
+      frameworkInstance: { framework: { id: 'frk_1', name: 'SOC 2' } },
+      template: { id: 'tml_1', name: 'SOC 2 Type 2' },
+    };
+
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'fi_1',
+        frameworkId: 'frk_1',
+        framework: { id: 'frk_1', name: 'SOC 2' },
+        timelineInstances: [{ id: 'tli_reopen_after_grace' }],
+      },
+    ]);
+    (mockDb.timelineInstance.findMany as jest.Mock).mockImplementation(() =>
+      Promise.resolve([cloneTimeline(timelineState)]),
+    );
+
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => {
+      const tx = {
+        timelinePhase: {
+          findMany: jest.fn(async () => cloneTimeline(timelineState.phases)),
+          update: jest.fn(async ({ where, data }: any) => {
+            const phase = timelineState.phases.find((p) => p.id === where.id);
+            if (!phase) return null;
+            Object.assign(phase, data);
+            return phase;
+          }),
+        },
+      };
+      return fn(tx);
+    });
+
+    (getOverviewScores as jest.Mock).mockResolvedValue({
+      policies: { total: 10, published: 8 },
+      tasks: { total: 1, done: 1 },
+      people: { total: 1, completed: 1 },
+    });
+
+    const result = await service.findAllForOrganization(orgId);
+
+    expect(mockDb.$transaction).toHaveBeenCalledTimes(1);
+    expect(result[0].phases.map((phase) => phase.status)).toEqual([
+      'IN_PROGRESS',
+      'PENDING',
+    ]);
+    expect(result[0].phases[0].regressedAt).toBeNull();
+    jest.useRealTimers();
+  });
+
+  it('rejects starting next cycle when current timeline is not completed', async () => {
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    jest.spyOn(service, 'findOne').mockResolvedValue({
+      id: 'tli_1',
+      frameworkInstanceId: 'fi_1',
+      cycleNumber: 1,
+      status: 'ACTIVE',
+    } as any);
+
+    await expect(service.startNextCycle('tli_1', 'org_1')).rejects.toThrow(
+      BadRequestException,
+    );
+  });
+
+  it('rejects starting next cycle when next cycle already exists', async () => {
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    jest.spyOn(service, 'findOne').mockResolvedValue({
+      id: 'tli_1',
+      frameworkInstanceId: 'fi_1',
+      cycleNumber: 2,
+      status: 'COMPLETED',
+    } as any);
+    (mockDb.timelineInstance.findFirst as jest.Mock).mockResolvedValue({
+      id: 'existing_cycle_3',
+    });
+
+    await expect(service.startNextCycle('tli_1', 'org_1')).rejects.toThrow(
+      BadRequestException,
+    );
+  });
+
+  it('creates next cycle from template when eligible', async () => {
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    jest.spyOn(service, 'findOne').mockResolvedValue({
+      id: 'tli_1',
+      frameworkInstanceId: 'fi_1',
+      cycleNumber: 2,
+      status: 'COMPLETED',
+    } as any);
+    (mockDb.timelineInstance.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const createSpy = jest
+      .spyOn(service, 'createFromTemplate')
+      .mockResolvedValue({ id: 'tli_3', cycleNumber: 3 } as any);
+
+    const result = await service.startNextCycle('tli_1', 'org_1');
+
+    expect(createSpy).toHaveBeenCalledWith({
+      organizationId: 'org_1',
+      frameworkInstanceId: 'fi_1',
+      cycleNumber: 3,
+      trackKey: 'primary',
+    });
+    expect(result).toEqual({ id: 'tli_3', cycleNumber: 3 });
+  });
+
+  it('uses explicit template progression when current template defines nextTemplateKey', async () => {
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    jest.spyOn(service, 'findOne').mockResolvedValue({
+      id: 'tli_2',
+      frameworkInstanceId: 'fi_1',
+      cycleNumber: 2,
+      trackKey: 'soc2_type2',
+      status: 'COMPLETED',
+      template: {
+        id: 'tml_soc2_y1',
+        frameworkId: 'frk_soc2',
+        trackKey: 'soc2_type2',
+        templateKey: 'soc2_type2_year1',
+        nextTemplateKey: 'soc2_type2_renewal',
+      },
+    } as any);
+
+    (mockDb.timelineInstance.findFirst as jest.Mock).mockResolvedValue(null);
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tml_soc2_renewal',
+      phases: [],
+    });
+    (createInstanceFromTemplate as jest.Mock).mockResolvedValue({
+      id: 'tli_3',
+      cycleNumber: 3,
+    });
+
+    const createSpy = jest
+      .spyOn(service, 'createFromTemplate')
+      .mockResolvedValue({ id: 'fallback', cycleNumber: 3 } as any);
+
+    const result = await service.startNextCycle('tli_2', 'org_1');
+
+    expect(mockDb.timelineTemplate.findUnique).toHaveBeenCalledWith({
+      where: {
+        frameworkId_templateKey: {
+          frameworkId: 'frk_soc2',
+          templateKey: 'soc2_type2_renewal',
+        },
+      },
+      include: { phases: { orderBy: { orderIndex: 'asc' } } },
+    });
+    expect(createSpy).not.toHaveBeenCalled();
+    expect(result).toEqual(expect.objectContaining({ id: 'tli_3', cycleNumber: 3 }));
+  });
+
+  it('checks for existing next cycle within the same track only', async () => {
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    jest.spyOn(service, 'findOne').mockResolvedValue({
+      id: 'tli_type2_1',
+      frameworkInstanceId: 'fi_1',
+      cycleNumber: 1,
+      trackKey: 'soc2_type2',
+      status: 'COMPLETED',
+      template: {
+        id: 'tml_soc2_type2_y1',
+        frameworkId: 'frk_soc2',
+        trackKey: 'soc2_type2',
+        templateKey: 'soc2_type2_year1',
+        nextTemplateKey: 'soc2_type2_renewal',
+      },
+    } as any);
+    (mockDb.timelineInstance.findFirst as jest.Mock).mockResolvedValue(null);
+    (mockDb.timelineTemplate.findUnique as jest.Mock).mockResolvedValue({
+      id: 'tml_soc2_renewal',
+      trackKey: 'soc2_type2',
+      phases: [],
+    });
+    (createInstanceFromTemplate as jest.Mock).mockResolvedValue({
+      id: 'tli_type2_2',
+      cycleNumber: 2,
+      trackKey: 'soc2_type2',
+    });
+
+    await service.startNextCycle('tli_type2_1', 'org_1');
+
+    expect(mockDb.timelineInstance.findFirst).toHaveBeenCalledWith({
+      where: {
+        frameworkInstanceId: 'fi_1',
+        trackKey: 'soc2_type2',
+        cycleNumber: 2,
+      },
+    });
+  });
+
+  it('resets timeline instance and phases back to draft baseline', async () => {
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    jest.spyOn(service, 'findOne').mockResolvedValue({
+      id: 'tli_1',
+      phases: [
+        { id: 'p1' },
+        { id: 'p2' },
+      ],
+    } as any);
+
+    const tx = {
+      timelinePhase: { update: jest.fn() },
+      timelineInstance: { update: jest.fn() },
+    };
+    (mockDb.$transaction as jest.Mock).mockImplementation(async (fn: any) => fn(tx));
+
+    const refreshed = { id: 'tli_1', status: 'DRAFT' };
+    jest.spyOn(service, 'findOne').mockResolvedValueOnce({
+      id: 'tli_1',
+      phases: [{ id: 'p1' }, { id: 'p2' }],
+    } as any).mockResolvedValueOnce(refreshed as any);
+
+    const result = await service.resetInstance('tli_1', 'org_1');
+
+    expect(tx.timelinePhase.update).toHaveBeenCalledTimes(2);
+    expect(tx.timelinePhase.update).toHaveBeenCalledWith({
+      where: { id: 'p1' },
+      data: expect.objectContaining({ regressedAt: null }),
+    });
+    expect(tx.timelineInstance.update).toHaveBeenCalledWith({
+      where: { id: 'tli_1' },
+      data: {
+        status: 'DRAFT',
+        startDate: null,
+        pausedAt: null,
+        lockedAt: null,
+        lockedById: null,
+        unlockedAt: null,
+        unlockedById: null,
+        unlockReason: null,
+        completedAt: null,
+      },
+    });
+    expect(result).toEqual(refreshed);
+  });
+
+  it('recreate clears grace periods by bypassing regression grace on refresh', async () => {
+    const lifecycle = {
+      activate: jest.fn(),
+      pause: jest.fn(),
+      resume: jest.fn(),
+      completePhase: jest.fn(),
+    };
+    const service = new TimelinesService(lifecycle as any);
+
+    (mockDb.timelineInstance.findMany as jest.Mock).mockResolvedValue([
+      { id: 'tli_1' },
+    ]);
+    (mockDb.frameworkInstance.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: 'fi_1',
+        frameworkId: 'frk_1',
+        framework: { id: 'frk_1', name: 'SOC 2' },
+        timelineInstances: [],
+      },
+    ]);
+
+    const findAllSpy = jest
+      .spyOn(service, 'findAllForOrganization')
+      .mockResolvedValue([] as any);
+
+    await service.recreateAllForOrganization('org_1');
+
+    expect(backfillTimeline).toHaveBeenCalledWith({
+      organizationId: 'org_1',
+      frameworkInstance: expect.objectContaining({ id: 'fi_1' }),
+      forceRefresh: true,
+    });
+    expect(findAllSpy).toHaveBeenLastCalledWith('org_1', {
+      bypassRegressionGrace: true,
+    });
+  });
+});
diff --git a/apps/api/src/timelines/timelines.service.ts b/apps/api/src/timelines/timelines.service.ts
new file mode 100644
index 0000000000..3467a8f3a4
--- /dev/null
+++ b/apps/api/src/timelines/timelines.service.ts
@@ -0,0 +1,609 @@
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { db, TimelinePhaseStatus } from '@db';
+import { TimelinesLifecycleService } from './timelines-lifecycle.service';
+import { backfillTimeline } from './timelines-backfill.helper';
+import {
+  resolveTemplate,
+  createInstanceFromTemplate,
+} from './timelines-template-resolver';
+import { getOverviewScores } from '../frameworks/frameworks-scores.helper';
+
+const AUTO_PHASE_TYPES = new Set([
+  'AUTO_POLICIES',
+  'AUTO_TASKS',
+  'AUTO_PEOPLE',
+]);
+const AUTO_PHASE_TYPES_NO_GRACE = new Set(['AUTO_PEOPLE']);
+const REGRESSION_GRACE_MS = 24 * 60 * 60 * 1000;
+
+interface TimelinesQueryOptions {
+  bypassRegressionGrace?: boolean;
+}
+
+@Injectable()
+export class TimelinesService {
+  constructor(
+    private readonly lifecycle: TimelinesLifecycleService,
+  ) {}
+
+  // ---------------------------------------------------------------------------
+  // Customer-facing queries
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Customer-facing read of timelines.
+   *
+   * Pure read (except for the one-time ensureTimelinesExist backfill). The
+   * AUTO_* phase advancement + regression sync lives in
+   * reconcileAutoPhasesForOrganization and fires from mutation event hooks
+   * (task/policy/people/findings updates) so GET /timelines is idempotent.
+   */
+  async findAllForOrganization(organizationId: string) {
+    await this.ensureTimelinesExist(organizationId);
+
+    const timelines = await db.timelineInstance.findMany({
+      where: { organizationId },
+      include: {
+        phases: { orderBy: { orderIndex: 'asc' } },
+        frameworkInstance: { include: { framework: true } },
+        template: true,
+      },
+    });
+
+    // Enrich AUTO_* phases with live completion percentages in-memory.
+    const scores = await getOverviewScores(organizationId).catch(() => null);
+    if (!scores) return timelines;
+
+    const pctMap = this.buildAutoPctMap(scores);
+
+    for (const timeline of timelines) {
+      if (timeline.status !== 'ACTIVE') continue;
+      for (const phase of timeline.phases) {
+        const livePct = pctMap[phase.completionType];
+        if (livePct !== undefined) {
+          (phase as any).completionPercent = livePct;
+        }
+      }
+    }
+
+    return timelines;
+  }
+
+  /**
+   * Reconcile AUTO_* phase status with live metrics. Handles both directions:
+   * advances phases when metrics hit 100% and reverts completed phases whose
+   * metric dropped below 100% (respecting the regression grace period).
+   *
+   * Called from mutation hooks in tasks/policies/people/findings services
+   * after events that could shift the underlying scores.
+   */
+  async reconcileAutoPhasesForOrganization(
+    organizationId: string,
+    options: TimelinesQueryOptions = {},
+  ): Promise<void> {
+    const scores = await getOverviewScores(organizationId).catch(() => null);
+    if (!scores) return;
+
+    const pctMap = this.buildAutoPctMap(scores);
+
+    const fetchTimelines = () =>
+      db.timelineInstance.findMany({
+        where: { organizationId },
+        include: { phases: { orderBy: { orderIndex: 'asc' } } },
+      });
+
+    let timelines = await fetchTimelines();
+
+    const maxSyncPasses = 20;
+    for (let pass = 0; pass < maxSyncPasses; pass++) {
+      let changed = false;
+
+      for (const timeline of timelines) {
+        if (timeline.status !== 'ACTIVE' && timeline.status !== 'COMPLETED') {
+          continue;
+        }
+
+        const locked =
+          timeline.status === 'COMPLETED' || !!timeline.lockedAt;
+        const canAutoTransition = timeline.status === 'ACTIVE' && !locked;
+
+        for (const phase of timeline.phases) {
+          if (!AUTO_PHASE_TYPES.has(phase.completionType)) continue;
+
+          const livePct = pctMap[phase.completionType];
+          if (livePct === undefined) continue;
+
+          // Non-completed phase: clear regression flag if it somehow lingers.
+          if (
+            phase.status !== TimelinePhaseStatus.COMPLETED &&
+            phase.regressedAt
+          ) {
+            await db.timelinePhase.update({
+              where: { id: phase.id },
+              data: { regressedAt: null },
+            });
+            changed = true;
+            break;
+          }
+
+          if (phase.status === TimelinePhaseStatus.COMPLETED) {
+            if (livePct < 100) {
+              if (
+                canAutoTransition &&
+                (AUTO_PHASE_TYPES_NO_GRACE.has(phase.completionType) ||
+                  options.bypassRegressionGrace === true)
+              ) {
+                await this.reopenFromRegressedPhase(
+                  timeline.id,
+                  phase.orderIndex,
+                );
+                changed = true;
+                break;
+              }
+
+              if (!phase.regressedAt) {
+                await db.timelinePhase.update({
+                  where: { id: phase.id },
+                  data: { regressedAt: new Date() },
+                });
+                changed = true;
+                break;
+              }
+
+              if (canAutoTransition) {
+                const elapsedMs =
+                  Date.now() - new Date(phase.regressedAt).getTime();
+                if (elapsedMs >= REGRESSION_GRACE_MS) {
+                  await this.reopenFromRegressedPhase(
+                    timeline.id,
+                    phase.orderIndex,
+                  );
+                  changed = true;
+                  break;
+                }
+              }
+            } else if (phase.regressedAt) {
+              await db.timelinePhase.update({
+                where: { id: phase.id },
+                data: { regressedAt: null },
+              });
+              changed = true;
+              break;
+            }
+          }
+
+          if (
+            canAutoTransition &&
+            phase.status === TimelinePhaseStatus.IN_PROGRESS &&
+            livePct >= 100
+          ) {
+            try {
+              await this.completePhase(
+                timeline.id,
+                phase.id,
+                timeline.organizationId,
+              );
+              changed = true;
+              break;
+            } catch {
+              // Phase may not be completable (e.g., prior phases not done).
+            }
+          }
+        }
+
+        if (changed) break;
+      }
+
+      if (!changed) break;
+      timelines = await fetchTimelines();
+    }
+  }
+
+  private buildAutoPctMap(scores: {
+    policies: { total: number; published: number };
+    tasks: { total: number; done: number };
+    people: { total: number; completed: number };
+  }): Record<string, number> {
+    const pct = (num: number, den: number) =>
+      den > 0 ? Math.round((num / den) * 100) : 0;
+    return {
+      AUTO_POLICIES: pct(scores.policies.published, scores.policies.total),
+      AUTO_TASKS: pct(scores.tasks.done, scores.tasks.total),
+      AUTO_PEOPLE: pct(scores.people.completed, scores.people.total),
+    };
+  }
+
+  private async reopenFromRegressedPhase(
+    timelineId: string,
+    regressedOrderIndex: number,
+  ): Promise<void> {
+    await db.$transaction(async (tx) => {
+      const freshPhases = await tx.timelinePhase.findMany({
+        where: { instanceId: timelineId },
+        orderBy: { orderIndex: 'asc' },
+      });
+
+      const affected = freshPhases.filter(
+        (p) => p.orderIndex >= regressedOrderIndex,
+      );
+      for (let i = 0; i < affected.length; i++) {
+        const phase = affected[i];
+        await tx.timelinePhase.update({
+          where: { id: phase.id },
+          data: {
+            status:
+              i === 0
+                ? TimelinePhaseStatus.IN_PROGRESS
+                : TimelinePhaseStatus.PENDING,
+            completedAt: null,
+            completedById: null,
+            readyForReview: false,
+            readyForReviewAt: null,
+            regressedAt: null,
+          },
+        });
+      }
+
+      // If the timeline was COMPLETED, regression means it's no longer
+      // complete — flip it back to ACTIVE to stay consistent with phases.
+      await tx.timelineInstance.updateMany({
+        where: { id: timelineId, status: 'COMPLETED' },
+        data: { status: 'ACTIVE', completedAt: null },
+      });
+    });
+  }
+
+  /**
+   * Auto-create timelines for any framework instances that don't have one yet.
+   * Uses smart backfill: infers timeline state from Trust status, compliance
+   * scores, and task completion data for existing orgs.
+   */
+  private async ensureTimelinesExist(organizationId: string) {
+    const frameworkInstances = await db.frameworkInstance.findMany({
+      where: { organizationId },
+      include: { framework: true, timelineInstances: { select: { id: true } } },
+    });
+
+    for (const fi of frameworkInstances) {
+      // Custom frameworks don't have a platform Framework record, so there's
+      // no template to backfill from — skip them.
+      if (!fi.frameworkId || !fi.framework) continue;
+      // Always call backfillTimeline — it's idempotent per-track and repairs
+      // partial state (e.g. SOC 2 with only Type 1 created, missing Type 2).
+      try {
+        await backfillTimeline({
+          organizationId,
+          frameworkInstance: {
+            id: fi.id,
+            frameworkId: fi.frameworkId,
+            framework: fi.framework,
+          },
+        });
+      } catch {
+        // Non-blocking — don't fail the list if one timeline can't be created
+      }
+    }
+  }
+
+  async findOne(id: string, organizationId: string) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id, organizationId },
+      include: {
+        phases: {
+          orderBy: { orderIndex: 'asc' },
+          include: { completedBy: { select: { id: true, name: true, email: true } } },
+        },
+        frameworkInstance: { include: { framework: true } },
+        template: {
+          include: { phases: { orderBy: { orderIndex: 'asc' } } },
+        },
+      },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    return instance;
+  }
+
+  async markReadyForReview(
+    instanceId: string,
+    phaseId: string,
+    organizationId: string,
+  ) {
+    const instance = await db.timelineInstance.findUnique({
+      where: { id: instanceId, organizationId },
+      include: {
+        phases: true,
+        frameworkInstance: { include: { framework: true } },
+        organization: { select: { id: true, name: true } },
+      },
+    });
+
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+
+    const phase = instance.phases.find((p) => p.id === phaseId);
+    if (!phase) {
+      throw new NotFoundException('Phase not found');
+    }
+
+    if (phase.status !== TimelinePhaseStatus.IN_PROGRESS) {
+      throw new BadRequestException(
+        'Only in-progress phases can be marked ready for review',
+      );
+    }
+
+    // If already marked ready, return idempotently so retries / double-clicks
+    // don't re-ping Slack for the same transition. Caller checks
+    // `alreadyReady` to decide whether to fire the notification.
+    if (phase.readyForReview) {
+      return {
+        organization: instance.organization,
+        framework: instance.frameworkInstance.framework,
+        phase,
+        alreadyReady: true,
+      };
+    }
+
+    const updated = await db.timelinePhase.update({
+      where: { id: phaseId },
+      data: { readyForReview: true, readyForReviewAt: new Date() },
+    });
+
+    return {
+      organization: instance.organization,
+      framework: instance.frameworkInstance.framework,
+      phase: updated,
+      alreadyReady: false,
+    };
+  }
+
+  // ---------------------------------------------------------------------------
+  // Instance creation
+  // ---------------------------------------------------------------------------
+
+  async createFromTemplate({
+    organizationId,
+    frameworkInstanceId,
+    cycleNumber,
+    trackKey = 'primary',
+  }: {
+    organizationId: string;
+    frameworkInstanceId: string;
+    cycleNumber: number;
+    trackKey?: string;
+  }) {
+    const frameworkInstance = await db.frameworkInstance.findUnique({
+      where: { id: frameworkInstanceId, organizationId },
+      include: { framework: true },
+    });
+
+    if (!frameworkInstance) {
+      throw new NotFoundException('Framework instance not found');
+    }
+
+    // Timelines are only created for platform frameworks; custom frameworks
+    // don't have pre-built templates.
+    if (!frameworkInstance.frameworkId || !frameworkInstance.framework) {
+      return null;
+    }
+
+    const template = await resolveTemplate(
+      frameworkInstance.frameworkId,
+      frameworkInstance.framework.name,
+      cycleNumber,
+      { trackKey },
+    );
+
+    if (!template) {
+      return null;
+    }
+
+    return createInstanceFromTemplate({
+      organizationId,
+      frameworkInstanceId,
+      cycleNumber,
+      template,
+    });
+  }
+
+  // ---------------------------------------------------------------------------
+  // Lifecycle delegates — exposed for controllers
+  // ---------------------------------------------------------------------------
+
+  async activate(id: string, organizationId: string, startDate: Date) {
+    return this.lifecycle.activate(id, organizationId, startDate);
+  }
+
+  async pauseTimeline(id: string, organizationId: string) {
+    return this.lifecycle.pause(id, organizationId);
+  }
+
+  async resumeTimeline(id: string, organizationId: string) {
+    return this.lifecycle.resume(id, organizationId);
+  }
+
+  async completePhase(
+    instanceId: string,
+    phaseId: string,
+    organizationId: string,
+    userId?: string,
+  ) {
+    return this.lifecycle.completePhase(
+      instanceId,
+      phaseId,
+      organizationId,
+      userId,
+    );
+  }
+
+  async unlockTimeline(
+    id: string,
+    organizationId: string,
+    unlockedById: string,
+    unlockReason: string,
+  ) {
+    return this.lifecycle.unlock(id, organizationId, unlockedById, unlockReason);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Admin — next cycle, delete, reset, recreate
+  // ---------------------------------------------------------------------------
+
+  async startNextCycle(id: string, organizationId: string) {
+    const current = await this.findOne(id, organizationId);
+
+    if (current.status !== 'COMPLETED') {
+      throw new BadRequestException('Timeline must be completed to start the next cycle');
+    }
+
+    const nextCycleNumber = current.cycleNumber + 1;
+    const currentTrackKey =
+      current.trackKey ?? current.template?.trackKey ?? 'primary';
+
+    // Check if next cycle already exists
+    const existing = await db.timelineInstance.findFirst({
+      where: {
+        frameworkInstanceId: current.frameworkInstanceId,
+        trackKey: currentTrackKey,
+        cycleNumber: nextCycleNumber,
+      },
+    });
+
+    if (existing) {
+      throw new BadRequestException(`Cycle ${nextCycleNumber} already exists for this framework`);
+    }
+
+    // Prefer explicit template progression when configured.
+    const nextTemplateKey = current.template?.nextTemplateKey ?? null;
+    const templateFrameworkId = current.template?.frameworkId ?? null;
+
+    if (nextTemplateKey && templateFrameworkId) {
+      const progressedTemplate = await db.timelineTemplate.findUnique({
+        where: {
+          frameworkId_templateKey: {
+            frameworkId: templateFrameworkId,
+            templateKey: nextTemplateKey,
+          },
+        },
+        include: { phases: { orderBy: { orderIndex: 'asc' } } },
+      });
+
+      if (progressedTemplate) {
+        return createInstanceFromTemplate({
+          organizationId,
+          frameworkInstanceId: current.frameworkInstanceId,
+          cycleNumber: nextCycleNumber,
+          template: progressedTemplate,
+        });
+      }
+    }
+
+    return this.createFromTemplate({
+      organizationId,
+      frameworkInstanceId: current.frameworkInstanceId,
+      cycleNumber: nextCycleNumber,
+      trackKey: currentTrackKey,
+    });
+  }
+
+  async deleteInstance(id: string, organizationId: string) {
+    const instance = await db.timelineInstance.findFirst({
+      where: { id, organizationId },
+    });
+    if (!instance) {
+      throw new NotFoundException('Timeline instance not found');
+    }
+    await db.timelinePhase.deleteMany({ where: { instanceId: id } });
+    await db.timelineInstance.delete({ where: { id } });
+    return { deleted: true };
+  }
+
+  async resetInstance(id: string, organizationId: string) {
+    const instance = await this.findOne(id, organizationId);
+    await db.$transaction(async (tx) => {
+      for (const phase of instance.phases) {
+        await tx.timelinePhase.update({
+          where: { id: phase.id },
+          data: {
+            status: 'PENDING',
+            startDate: null,
+            endDate: null,
+            completedAt: null,
+            completedById: null,
+            readyForReview: false,
+            readyForReviewAt: null,
+            datesPinned: false,
+            regressedAt: null,
+          },
+        });
+      }
+      await tx.timelineInstance.update({
+        where: { id },
+        data: {
+          status: 'DRAFT',
+          startDate: null,
+          pausedAt: null,
+          lockedAt: null,
+          lockedById: null,
+          unlockedAt: null,
+          unlockedById: null,
+          unlockReason: null,
+          completedAt: null,
+        },
+      });
+    });
+    return this.findOne(id, organizationId);
+  }
+
+  async recreateAllForOrganization(organizationId: string) {
+    // Delete all existing timeline instances for this org
+    const existing = await db.timelineInstance.findMany({
+      where: { organizationId },
+      select: { id: true },
+    });
+    for (const inst of existing) {
+      await db.timelinePhase.deleteMany({ where: { instanceId: inst.id } });
+    }
+    await db.timelineInstance.deleteMany({ where: { organizationId } });
+
+    // Re-run backfill with forceRefresh to update templates from latest code defaults
+    const frameworkInstances = await db.frameworkInstance.findMany({
+      where: { organizationId },
+      include: { framework: true, timelineInstances: { select: { id: true } } },
+    });
+
+    for (const fi of frameworkInstances) {
+      // Skip custom frameworks — no template to backfill from.
+      if (!fi.frameworkId || !fi.framework) continue;
+      try {
+        await backfillTimeline({
+          organizationId,
+          frameworkInstance: {
+            id: fi.id,
+            frameworkId: fi.frameworkId,
+            framework: fi.framework,
+          },
+          forceRefresh: true,
+        });
+      } catch {
+        // Non-blocking
+      }
+    }
+
+    // After a full recreate, immediately reconcile AUTO phases against live
+    // metrics (bypassing regression grace) so the returned state is fresh.
+    await this.reconcileAutoPhasesForOrganization(organizationId, {
+      bypassRegressionGrace: true,
+    });
+
+    return this.findAllForOrganization(organizationId);
+  }
+}
diff --git a/apps/app/.gitignore b/apps/app/.gitignore
index 3ea39de1ef..3d0979a1c7 100644
--- a/apps/app/.gitignore
+++ b/apps/app/.gitignore
@@ -52,6 +52,7 @@ next-env.d.ts
 
 # Generated Prisma Client
 prisma/generated
+prisma/src/generated/
 src/generated/
 # Model files are copied here by db:getschema — only schema.prisma is committed
 prisma/schema/*.prisma
diff --git a/apps/app/package.json b/apps/app/package.json
index 508d84aa6e..a2a5f22020 100644
--- a/apps/app/package.json
+++ b/apps/app/package.json
@@ -191,7 +191,7 @@
         "db:getschema": "find ../../packages/db/prisma/schema -name '*.prisma' ! -name 'schema.prisma' -exec cp {} prisma/schema/ \\;",
         "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/app",
         "deploy:trigger-prod": "npx trigger.dev@4.4.3 deploy",
-        "dev": "bun i && bunx concurrently --kill-others --names \"next,trigger\" --prefix-colors \"yellow,blue\" \"NODE_OPTIONS='--no-deprecation' next dev --turbo -p 3000\" \"NODE_OPTIONS='--no-deprecation' trigger dev\"",
+        "dev": "bunx concurrently --kill-others --names \"next,trigger\" --prefix-colors \"yellow,blue\" \"NODE_OPTIONS='--no-deprecation' next dev --turbo -p 3000\" \"NODE_OPTIONS='--no-deprecation' trigger dev\"",
         "lint": "eslint . && prettier --check .",
         "prebuild": "bun run db:generate",
         "postinstall": "prisma generate --schema=./prisma/schema || exit 0",
diff --git a/apps/app/prisma/client.ts b/apps/app/prisma/client.ts
index 169de23539..21e833f75a 100644
--- a/apps/app/prisma/client.ts
+++ b/apps/app/prisma/client.ts
@@ -1,4 +1,4 @@
-import { PrismaClient } from '../src/generated/prisma/client';
+import { PrismaClient } from '@prisma/client';
 import { PrismaPg } from '@prisma/adapter-pg';
 
 const globalForPrisma = global as unknown as { prisma: PrismaClient };
diff --git a/apps/app/prisma/index.ts b/apps/app/prisma/index.ts
index ccdcea1dfa..b329db54e3 100644
--- a/apps/app/prisma/index.ts
+++ b/apps/app/prisma/index.ts
@@ -1 +1 @@
-export * from '../src/generated/prisma/browser';
+export * from '@prisma/client';
diff --git a/apps/app/prisma/schema/schema.prisma b/apps/app/prisma/schema/schema.prisma
index 45f4244cf6..c02b00f006 100644
--- a/apps/app/prisma/schema/schema.prisma
+++ b/apps/app/prisma/schema/schema.prisma
@@ -1,6 +1,6 @@
 generator client {
   provider        = "prisma-client"
-  output          = "../../src/generated/prisma"
+  output          = "../src/generated/prisma"
   previewFeatures = ["postgresqlExtensions"]
 }
 
diff --git a/apps/app/prisma/server.ts b/apps/app/prisma/server.ts
index 7969070f3c..54d1c4b9c9 100644
--- a/apps/app/prisma/server.ts
+++ b/apps/app/prisma/server.ts
@@ -1,2 +1,2 @@
-export * from '../src/generated/prisma/client';
+export * from '@prisma/client';
 export { db } from './client';
diff --git a/apps/app/src/app/(app)/[orgId]/admin/components/AdminSidebar.tsx b/apps/app/src/app/(app)/[orgId]/admin/components/AdminSidebar.tsx
index b30cdf22af..58cffeea82 100644
--- a/apps/app/src/app/(app)/[orgId]/admin/components/AdminSidebar.tsx
+++ b/apps/app/src/app/(app)/[orgId]/admin/components/AdminSidebar.tsx
@@ -14,6 +14,7 @@ export function AdminSidebar({ orgId }: AdminSidebarProps) {
   const items = [
     { id: 'organizations', label: 'Organizations', path: `/${orgId}/admin/organizations` },
     { id: 'integrations', label: 'Integrations', path: `/${orgId}/admin/integrations` },
+    { id: 'timeline-templates', label: 'Timeline Templates', path: `/${orgId}/admin/timeline-templates` },
   ];
 
   const isPathActive = (path: string) => pathname.startsWith(path);
diff --git a/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/AdminOrgTabs.tsx b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/AdminOrgTabs.tsx
index 6ab5aaa79f..7389f61bd4 100644
--- a/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/AdminOrgTabs.tsx
+++ b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/AdminOrgTabs.tsx
@@ -31,6 +31,8 @@ import { VendorsTab } from './VendorsTab';
 import { ContextTab } from './ContextTab';
 import { EvidenceTab } from './EvidenceTab';
 import { PoliciesTab } from './PoliciesTab';
+import { TimelineTab } from './TimelineTab';
+import { FeatureFlagsTab } from './FeatureFlagsTab';
 
 interface OrgMember {
   id: string;
@@ -131,6 +133,8 @@ export function AdminOrgTabs({
                 <TabsTrigger value="vendors">Vendors</TabsTrigger>
                 <TabsTrigger value="context">Context</TabsTrigger>
                 <TabsTrigger value="evidence">Evidence</TabsTrigger>
+                <TabsTrigger value="timeline">Timeline</TabsTrigger>
+                <TabsTrigger value="feature-flags">Feature Flags</TabsTrigger>
               </TabsList>
             }
           >
@@ -177,6 +181,12 @@ export function AdminOrgTabs({
         <TabsContent value="evidence">
           <EvidenceTab orgId={org.id} />
         </TabsContent>
+        <TabsContent value="timeline">
+          <TimelineTab orgId={org.id} />
+        </TabsContent>
+        <TabsContent value="feature-flags">
+          <FeatureFlagsTab orgId={org.id} />
+        </TabsContent>
       </PageLayout>
 
       <AlertDialog
diff --git a/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/FeatureFlagsTab.tsx b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/FeatureFlagsTab.tsx
new file mode 100644
index 0000000000..3d8fa01a36
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/FeatureFlagsTab.tsx
@@ -0,0 +1,167 @@
+'use client';
+
+import { useMemo, useState } from 'react';
+import { toast } from 'sonner';
+import {
+  Badge,
+  Button,
+  InputGroup,
+  InputGroupAddon,
+  InputGroupInput,
+  SettingGroup,
+  SettingRow,
+  Stack,
+  Switch,
+  Text,
+} from '@trycompai/design-system';
+import { Renew, Search } from '@trycompai/design-system/icons';
+import {
+  setAdminOrgFeatureFlag,
+  useAdminOrgFeatureFlags,
+  type AdminOrgFeatureFlag,
+} from '@/hooks/use-admin-feature-flags';
+
+interface FeatureFlagsTabProps {
+  orgId: string;
+}
+
+export function FeatureFlagsTab({ orgId }: FeatureFlagsTabProps) {
+  const { flags, isLoading, error, mutate } = useAdminOrgFeatureFlags(orgId);
+  const [updatingKey, setUpdatingKey] = useState<string | null>(null);
+  const [refreshing, setRefreshing] = useState(false);
+  const [searchTerm, setSearchTerm] = useState('');
+
+  const filteredFlags = useMemo(() => {
+    const q = searchTerm.trim().toLowerCase();
+    if (!q) return flags;
+    return flags.filter(
+      (f) =>
+        f.key.toLowerCase().includes(q) ||
+        f.description?.toLowerCase().includes(q),
+    );
+  }, [flags, searchTerm]);
+
+  const handleToggle = async (flag: AdminOrgFeatureFlag, enabled: boolean) => {
+    setUpdatingKey(flag.key);
+
+    // Snapshot previous state so we can roll back on error.
+    const previous = flags;
+
+    // Optimistic update — don't revalidate (PostHog has write-propagation lag).
+    mutate(
+      (prev) =>
+        (prev ?? []).map((f) => (f.key === flag.key ? { ...f, enabled } : f)),
+      { revalidate: false },
+    );
+
+    try {
+      await setAdminOrgFeatureFlag({ orgId, flagKey: flag.key, enabled });
+      toast.success(`"${flag.name}" ${enabled ? 'enabled' : 'disabled'} for this organization`);
+      // Trust the write. Skip revalidation — PostHog isFeatureEnabled may lag
+      // behind groupIdentify and temporarily return the old value.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to update feature flag');
+      // Roll back to the snapshot.
+      mutate(previous, { revalidate: false });
+    } finally {
+      setUpdatingKey(null);
+    }
+  };
+
+  const handleRefresh = async () => {
+    setRefreshing(true);
+    try {
+      await mutate();
+    } finally {
+      setRefreshing(false);
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center justify-center py-12 text-muted-foreground">
+        Loading feature flags…
+      </div>
+    );
+  }
+
+  if (error) {
+    return (
+      <Stack gap="xs">
+        <Text weight="semibold">Failed to load feature flags</Text>
+        <Text variant="muted">
+          {error instanceof Error ? error.message : 'Unknown error'}
+        </Text>
+      </Stack>
+    );
+  }
+
+  if (flags.length === 0) {
+    return (
+      <Stack gap="xs">
+        <Text weight="semibold">No feature flags found</Text>
+        <Text variant="muted">
+          Create a feature flag in PostHog and set <code>POSTHOG_PERSONAL_API_KEY</code> and{' '}
+          <code>POSTHOG_PROJECT_ID</code> on the API to manage it here.
+        </Text>
+      </Stack>
+    );
+  }
+
+  return (
+    <Stack gap="lg">
+      <div className="flex items-center justify-between gap-3">
+        <div className="w-full max-w-sm">
+          <InputGroup>
+            <InputGroupAddon>
+              <Search size={16} />
+            </InputGroupAddon>
+            <InputGroupInput
+              placeholder="Search flags..."
+              value={searchTerm}
+              onChange={(e) => setSearchTerm(e.target.value)}
+            />
+          </InputGroup>
+        </div>
+        <Button
+          variant="outline"
+          size="sm"
+          onClick={handleRefresh}
+          loading={refreshing}
+        >
+          <Renew />
+          Refresh from PostHog
+        </Button>
+      </div>
+      {filteredFlags.length === 0 ? (
+        <Text variant="muted">No flags match your search.</Text>
+      ) : (
+        <SettingGroup>
+          {filteredFlags.map((flag) => (
+            <SettingRow
+              key={flag.key}
+              size="lg"
+              label={flag.key}
+              description={
+                flag.description ||
+                (flag.active ? undefined : 'Inactive in PostHog')
+              }
+            >
+              <div className="flex items-center gap-2">
+                {!flag.active && <Badge variant="outline">Inactive</Badge>}
+                <Switch
+                  checked={flag.enabled}
+                  // Disable every switch while any flag is being updated —
+                  // prevents overlapping PATCHes where a late rollback could
+                  // overwrite a newer successful toggle.
+                  disabled={!flag.active || updatingKey !== null}
+                  onCheckedChange={(checked) => handleToggle(flag, checked)}
+                />
+              </div>
+            </SettingRow>
+          ))}
+        </SettingGroup>
+      )}
+    </Stack>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineActivateForm.tsx b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineActivateForm.tsx
new file mode 100644
index 0000000000..5662c77ef7
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineActivateForm.tsx
@@ -0,0 +1,78 @@
+'use client';
+
+import { useState } from 'react';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import { Button } from '@trycompai/design-system';
+import { Play } from '@trycompai/design-system/icons';
+import { Input } from '@trycompai/ui/input';
+
+interface TimelineActivateFormProps {
+  orgId: string;
+  timelineId: string;
+  onMutate: () => void;
+}
+
+export function TimelineActivateForm({
+  orgId,
+  timelineId,
+  onMutate,
+}: TimelineActivateFormProps) {
+  const [startDate, setStartDate] = useState('');
+  const [loading, setLoading] = useState(false);
+
+  const handleActivate = async () => {
+    if (!startDate) {
+      toast.error('Please select a start date');
+      return;
+    }
+
+    setLoading(true);
+    try {
+      // startDate comes from <input type="date"> as YYYY-MM-DD. Using
+      // `new Date(...)` would treat it as UTC midnight and shift the day
+      // in negative UTC offsets. Parse as local midnight so the user's
+      // chosen calendar day is preserved when serialized to ISO.
+      const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(startDate);
+      const parsed = match
+        ? new Date(Number(match[1]), Number(match[2]) - 1, Number(match[3]))
+        : new Date(NaN);
+      if (Number.isNaN(parsed.getTime())) {
+        toast.error('Invalid start date');
+        return;
+      }
+      const res = await api.post(
+        `/v1/admin/organizations/${orgId}/timelines/${timelineId}/activate`,
+        { startDate: parsed.toISOString() },
+      );
+      if (res.error) {
+        toast.error(res.error);
+        return;
+      }
+      toast.success('Timeline activated');
+      onMutate();
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <div className="flex items-center gap-2">
+      <Input
+        type="date"
+        value={startDate}
+        onChange={(e) => setStartDate(e.target.value)}
+        className="h-8 w-40 text-sm"
+      />
+      <Button
+        size="sm"
+        iconLeft={<Play size={14} />}
+        loading={loading}
+        onClick={handleActivate}
+        disabled={!startDate}
+      >
+        Activate
+      </Button>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineCard.tsx b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineCard.tsx
new file mode 100644
index 0000000000..a55d51ffd5
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineCard.tsx
@@ -0,0 +1,528 @@
+'use client';
+
+import { useState } from 'react';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminOrgTimeline } from '@/hooks/use-admin-timelines';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+  Badge,
+  Button,
+  Section,
+  Textarea,
+} from '@trycompai/design-system';
+import {
+  Checkmark,
+  CircleDash,
+  InProgress,
+  Locked,
+  Pause,
+  Play,
+  Edit,
+  Reset,
+  TrashCan,
+  Unlocked,
+} from '@trycompai/design-system/icons';
+import { TimelinePhaseBar } from '@/app/(app)/[orgId]/overview/components/TimelinePhaseBar';
+import { TimelineActivateForm } from './TimelineActivateForm';
+import { TimelinePhaseEditor } from './TimelinePhaseEditor';
+
+const STATUS_BADGE: Record<
+  AdminOrgTimeline['status'],
+  { label: string; variant: 'default' | 'outline' | 'destructive' }
+> = {
+  DRAFT: { label: 'Draft', variant: 'outline' },
+  ACTIVE: { label: 'Active', variant: 'default' },
+  PAUSED: { label: 'Paused', variant: 'destructive' },
+  COMPLETED: { label: 'Completed', variant: 'default' },
+};
+
+const PHASE_COMPLETION_LABEL: Record<
+  AdminOrgTimeline['phases'][number]['completionType'],
+  string
+> = {
+  MANUAL: 'Manual',
+  AUTO_TASKS: 'Auto (Tasks)',
+  AUTO_POLICIES: 'Auto (Policies)',
+  AUTO_PEOPLE: 'Auto (People)',
+  AUTO_FINDINGS: 'Auto (Findings)',
+  AUTO_UPLOAD: 'Auto (Upload)',
+};
+
+function formatDate(date: string | null): string {
+  if (!date) return '--';
+  return new Date(date).toLocaleDateString('en-US', {
+    month: 'short',
+    day: 'numeric',
+    year: 'numeric',
+  });
+}
+
+type PhaseEntry =
+  | { type: 'ungrouped'; phase: AdminOrgTimeline['phases'][number] }
+  | { type: 'group'; label: string; phases: AdminOrgTimeline['phases'] };
+
+function buildPhaseEntries(phases: AdminOrgTimeline['phases']): PhaseEntry[] {
+  const entries: PhaseEntry[] = [];
+  const seen = new Set<string>();
+  for (const phase of phases) {
+    if (!phase.groupLabel) {
+      entries.push({ type: 'ungrouped', phase });
+      continue;
+    }
+    if (seen.has(phase.groupLabel)) continue;
+    seen.add(phase.groupLabel);
+    entries.push({
+      type: 'group',
+      label: phase.groupLabel,
+      phases: phases.filter((p) => p.groupLabel === phase.groupLabel),
+    });
+  }
+  return entries;
+}
+
+interface TimelineCardProps {
+  timeline: AdminOrgTimeline;
+  orgId: string;
+  onMutate: () => void;
+}
+
+export function TimelineCard({ timeline, orgId, onMutate }: TimelineCardProps) {
+  const [actionLoading, setActionLoading] = useState(false);
+  const [editingPhaseId, setEditingPhaseId] = useState<string | null>(null);
+  const badge = STATUS_BADGE[timeline.status];
+  const frameworkName =
+    timeline.template?.name ??
+    timeline.frameworkInstance?.framework.name ??
+    'Unknown Framework';
+  const sortedPhases = [...timeline.phases].sort(
+    (a, b) => a.orderIndex - b.orderIndex,
+  );
+
+  const runAction = async (
+    method: 'post' | 'delete',
+    path: string,
+    successMsg: string,
+    body?: unknown,
+  ) => {
+    setActionLoading(true);
+    const res = await (
+      method === 'delete'
+        ? api.delete(path, undefined, body)
+        : api.post(path, body)
+    );
+    setActionLoading(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success(successMsg);
+    onMutate();
+  };
+
+  return (
+    <Section
+      title={frameworkName}
+      actions={
+        <div className="flex items-center gap-2">
+          <Badge variant={badge.variant}>{badge.label}</Badge>
+          {timeline.lockedAt ? (
+            <Badge variant="outline">
+              <Locked size={12} />
+              Locked
+            </Badge>
+          ) : null}
+          <TimelineActions
+            status={timeline.status}
+            lockedAt={timeline.lockedAt}
+            orgId={orgId}
+            timelineId={timeline.id}
+            loading={actionLoading}
+            onPause={() =>
+              runAction('post', `/v1/admin/organizations/${orgId}/timelines/${timeline.id}/pause`, 'Timeline paused')
+            }
+            onResume={() =>
+              runAction('post', `/v1/admin/organizations/${orgId}/timelines/${timeline.id}/resume`, 'Timeline resumed')
+            }
+            onReset={() =>
+              runAction('post', `/v1/admin/organizations/${orgId}/timelines/${timeline.id}/reset`, 'Timeline reset to draft')
+            }
+            onDelete={() =>
+              runAction('delete', `/v1/admin/organizations/${orgId}/timelines/${timeline.id}`, 'Timeline deleted')
+            }
+            onStartNextCycle={() =>
+              runAction('post', `/v1/admin/organizations/${orgId}/timelines/${timeline.id}/next-cycle`, 'Next cycle created as draft')
+            }
+            onUnlock={(unlockReason) =>
+              runAction(
+                'post',
+                `/v1/admin/organizations/${orgId}/timelines/${timeline.id}/unlock`,
+                'Timeline unlocked',
+                { unlockReason },
+              )
+            }
+            onMutate={onMutate}
+          />
+        </div>
+      }
+    >
+      <div className="pb-3">
+        <TimelinePhaseBar phases={sortedPhases} showDates />
+      </div>
+
+      <div className="flex flex-col gap-2">
+        {buildPhaseEntries(sortedPhases).map((entry) => {
+          if (entry.type === 'group') {
+            return (
+              <div key={`group-${entry.label}`} className="flex gap-2">
+                <div className="w-1 shrink-0 rounded-full bg-primary" />
+                <div className="flex-1 flex flex-col gap-1">
+                  <span className="text-xs text-muted-foreground px-1">{entry.label}</span>
+                  {entry.phases.map((phase) => (
+                    <PhaseRow
+                      key={phase.id}
+                      phase={phase}
+                      editable={timeline.status !== 'COMPLETED'}
+                      onEdit={() => setEditingPhaseId(phase.id)}
+                    />
+                  ))}
+                </div>
+              </div>
+            );
+          }
+          const phase = entry.phase;
+          return (
+            <PhaseRow
+              key={phase.id}
+              phase={phase}
+              editable={timeline.status !== 'COMPLETED'}
+              onEdit={() => setEditingPhaseId(phase.id)}
+            />
+          );
+        })}
+      </div>
+
+      {editingPhaseId && (
+        <TimelinePhaseEditor
+          open={!!editingPhaseId}
+          onClose={() => setEditingPhaseId(null)}
+          orgId={orgId}
+          timelineId={timeline.id}
+          phase={sortedPhases.find((p) => p.id === editingPhaseId) ?? null}
+          onMutate={onMutate}
+        />
+      )}
+    </Section>
+  );
+}
+
+function PhaseRow({
+  phase,
+  editable,
+  onEdit,
+}: {
+  phase: AdminOrgTimeline['phases'][number];
+  editable: boolean;
+  onEdit: () => void;
+}) {
+  const isCompleted = phase.status === 'COMPLETED';
+  const isActive = phase.status === 'IN_PROGRESS';
+  const borderClass = isCompleted
+    ? 'border-primary/30 bg-primary/5'
+    : isActive
+      ? 'border-primary/40 bg-primary/10'
+      : 'border-border bg-muted/20';
+
+  return (
+    <div className={`flex items-center gap-3 rounded-lg border px-3 py-2.5 ${borderClass}`}>
+      <div className="shrink-0">
+        <PhaseStatusIcon status={phase.status} />
+      </div>
+      <div className="flex min-w-0 flex-1 flex-col">
+        <span className="text-sm font-medium">{phase.name}</span>
+        <span className="text-xs text-muted-foreground">
+          {phase.durationWeeks}w · {formatDate(phase.startDate)} - {formatDate(phase.endDate)}
+        </span>
+      </div>
+      {phase.locksTimelineOnComplete ? (
+        <Badge variant="outline">
+          <Locked size={12} />
+          Lock
+        </Badge>
+      ) : null}
+      <Badge variant="outline">
+        {PHASE_COMPLETION_LABEL[phase.completionType]}
+      </Badge>
+      <Badge variant="outline">
+        {phase.status.replace('_', ' ')}
+      </Badge>
+      {editable && (
+        <button
+          onClick={onEdit}
+          className="shrink-0 rounded p-1 text-muted-foreground hover:bg-muted hover:text-foreground"
+        >
+          <Edit size={14} />
+        </button>
+      )}
+    </div>
+  );
+}
+
+function PhaseStatusIcon({ status }: { status: string }) {
+  if (status === 'COMPLETED') return <Checkmark size={16} className="text-primary" />;
+  if (status === 'IN_PROGRESS') return <InProgress size={16} className="text-primary" />;
+  return <CircleDash size={16} className="text-muted-foreground" />;
+}
+
+function ConfirmButton({
+  title,
+  description,
+  onConfirm,
+  loading,
+  variant = 'outline',
+  icon,
+  children,
+}: {
+  title: string;
+  description: string;
+  onConfirm: () => void;
+  loading: boolean;
+  variant?: 'outline' | 'destructive';
+  icon?: React.ReactNode;
+  children: React.ReactNode;
+}) {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <AlertDialog open={open} onOpenChange={setOpen}>
+      <AlertDialogTrigger
+        render={
+          <Button size="sm" variant={variant} iconLeft={icon} loading={loading}>
+            {children}
+          </Button>
+        }
+      />
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>{title}</AlertDialogTitle>
+          <AlertDialogDescription>{description}</AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction
+            onClick={() => {
+              setOpen(false);
+              onConfirm();
+            }}
+          >
+            Confirm
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
+
+function TimelineActions({
+  status,
+  lockedAt,
+  orgId,
+  timelineId,
+  loading,
+  onPause,
+  onResume,
+  onReset,
+  onDelete,
+  onStartNextCycle,
+  onUnlock,
+  onMutate,
+}: {
+  status: AdminOrgTimeline['status'];
+  lockedAt: string | null;
+  orgId: string;
+  timelineId: string;
+  loading: boolean;
+  onPause: () => void;
+  onResume: () => void;
+  onReset: () => void;
+  onDelete: () => void;
+  onStartNextCycle: () => void;
+  onUnlock: (unlockReason: string) => void;
+  onMutate: () => void;
+}) {
+  if (status === 'DRAFT') {
+    return (
+      <div className="flex items-center gap-2">
+        <TimelineActivateForm orgId={orgId} timelineId={timelineId} onMutate={onMutate} />
+        <ConfirmButton
+          title="Delete Timeline"
+          description="This will permanently delete this timeline and all its phases. This cannot be undone."
+          onConfirm={onDelete}
+          loading={loading}
+          variant="destructive"
+          icon={<TrashCan size={14} />}
+        >
+          Delete
+        </ConfirmButton>
+      </div>
+    );
+  }
+
+  if (status === 'ACTIVE') {
+    return (
+      <div className="flex items-center gap-2">
+        {lockedAt ? (
+          <UnlockDialogButton onConfirm={onUnlock} loading={loading} />
+        ) : null}
+        <ConfirmButton
+          title="Pause Timeline"
+          description="Pausing will stop auto-completion checks. You can resume later and dates will be adjusted."
+          onConfirm={onPause}
+          loading={loading}
+          icon={<Pause size={14} />}
+        >
+          Pause
+        </ConfirmButton>
+        <ConfirmButton
+          title="Reset Timeline"
+          description="This will reset all phases to pending and the timeline back to draft. All progress will be lost."
+          onConfirm={onReset}
+          loading={loading}
+          icon={<Reset size={14} />}
+        >
+          Reset
+        </ConfirmButton>
+      </div>
+    );
+  }
+
+  if (status === 'PAUSED') {
+    return (
+      <div className="flex items-center gap-2">
+        {lockedAt ? (
+          <UnlockDialogButton onConfirm={onUnlock} loading={loading} />
+        ) : null}
+        <ConfirmButton
+          title="Resume Timeline"
+          description="Resuming will adjust dates forward based on the pause duration."
+          onConfirm={onResume}
+          loading={loading}
+          icon={<Play size={14} />}
+        >
+          Resume
+        </ConfirmButton>
+        <ConfirmButton
+          title="Reset Timeline"
+          description="This will reset all phases to pending and the timeline back to draft. All progress will be lost."
+          onConfirm={onReset}
+          loading={loading}
+          icon={<Reset size={14} />}
+        >
+          Reset
+        </ConfirmButton>
+      </div>
+    );
+  }
+
+  if (status === 'COMPLETED') {
+    return (
+      <div className="flex items-center gap-2">
+        <ConfirmButton
+          title="Start Next Cycle"
+          description="This will create a new timeline for the next audit cycle using the appropriate template. The new timeline will start as a draft."
+          onConfirm={onStartNextCycle}
+          loading={loading}
+          icon={<Play size={14} />}
+        >
+          Start Next Cycle
+        </ConfirmButton>
+        <ConfirmButton
+          title="Delete Timeline"
+          description="This will permanently delete this completed timeline. This cannot be undone."
+          onConfirm={onDelete}
+          loading={loading}
+          variant="destructive"
+          icon={<TrashCan size={14} />}
+        >
+          Delete
+        </ConfirmButton>
+      </div>
+    );
+  }
+
+  return null;
+}
+
+function UnlockDialogButton({
+  onConfirm,
+  loading,
+}: {
+  onConfirm: (unlockReason: string) => void;
+  loading: boolean;
+}) {
+  const [open, setOpen] = useState(false);
+  const [unlockReason, setUnlockReason] = useState('');
+  const trimmedReason = unlockReason.trim();
+
+  return (
+    <AlertDialog
+      open={open}
+      onOpenChange={(nextOpen) => {
+        setOpen(nextOpen);
+        if (!nextOpen) setUnlockReason('');
+      }}
+    >
+      <AlertDialogTrigger
+        render={
+          <Button size="sm" variant="outline" iconLeft={<Unlocked size={14} />} loading={loading}>
+            Unlock
+          </Button>
+        }
+      />
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Unlock Timeline</AlertDialogTitle>
+          <AlertDialogDescription>
+            Unlocking will re-enable automation checks. A reason is required for audit history.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <div className="space-y-2">
+          <label htmlFor="timeline-unlock-reason" className="text-sm font-medium">
+            Unlock reason
+          </label>
+          <Textarea
+            id="timeline-unlock-reason"
+            value={unlockReason}
+            onChange={(event) => setUnlockReason(event.target.value)}
+            placeholder="Explain why this locked timeline is being reopened..."
+            rows={4}
+          />
+        </div>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction
+            disabled={loading || trimmedReason.length === 0}
+            onClick={(event) => {
+              if (trimmedReason.length === 0) {
+                event.preventDefault();
+                return;
+              }
+              setOpen(false);
+              onConfirm(trimmedReason);
+            }}
+          >
+            Unlock Timeline
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelinePhaseEditor.tsx b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelinePhaseEditor.tsx
new file mode 100644
index 0000000000..3fa778745c
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelinePhaseEditor.tsx
@@ -0,0 +1,277 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminOrgTimeline } from '@/hooks/use-admin-timelines';
+import {
+  Badge,
+  Button,
+  Sheet,
+  SheetBody,
+  SheetContent,
+  SheetHeader,
+  SheetTitle,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+import { Checkmark, Locked } from '@trycompai/design-system/icons';
+import { Input } from '@trycompai/ui/input';
+import { Label } from '@trycompai/ui/label';
+
+const COMPLETION_OPTIONS = [
+  { value: 'MANUAL', label: 'Manual' },
+  { value: 'AUTO_TASKS', label: 'Auto (Tasks)' },
+  { value: 'AUTO_POLICIES', label: 'Auto (Policies)' },
+  { value: 'AUTO_PEOPLE', label: 'Auto (People)' },
+  { value: 'AUTO_FINDINGS', label: 'Auto (Findings)' },
+  { value: 'AUTO_UPLOAD', label: 'Auto (Upload)' },
+] as const;
+
+const phaseUpdateSchema = z.object({
+  name: z.string().min(1, 'Name is required'),
+  description: z.string().optional(),
+  durationWeeks: z.number().min(1, 'Must be at least 1 week'),
+  startDate: z.string().optional(),
+  completionType: z.enum([
+    'AUTO_TASKS',
+    'AUTO_POLICIES',
+    'AUTO_PEOPLE',
+    'AUTO_FINDINGS',
+    'AUTO_UPLOAD',
+    'MANUAL',
+  ]),
+  locksTimelineOnComplete: z.boolean(),
+});
+
+type PhaseUpdateValues = z.infer<typeof phaseUpdateSchema>;
+type TimelinePhase = AdminOrgTimeline['phases'][number];
+
+interface TimelinePhaseEditorProps {
+  open: boolean;
+  onClose: () => void;
+  orgId: string;
+  timelineId: string;
+  phase: TimelinePhase | null;
+  onMutate: () => void;
+}
+
+function toDateInput(date: string | null): string {
+  if (!date) return '';
+  return new Date(date).toISOString().split('T')[0];
+}
+
+function addWeeks(dateStr: string, weeks: number): string {
+  if (!dateStr) return '';
+  const d = new Date(dateStr);
+  d.setUTCDate(d.getUTCDate() + weeks * 7);
+  return d.toLocaleDateString('en-US', { month: 'short', day: 'numeric', year: 'numeric' });
+}
+
+export function TimelinePhaseEditor({
+  open,
+  onClose,
+  orgId,
+  timelineId,
+  phase,
+  onMutate,
+}: TimelinePhaseEditorProps) {
+  const [saving, setSaving] = useState(false);
+  const [completing, setCompleting] = useState(false);
+
+  const {
+    register,
+    handleSubmit,
+    reset,
+    watch,
+    formState: { errors },
+  } = useForm<PhaseUpdateValues>({
+    resolver: zodResolver(phaseUpdateSchema),
+    defaultValues: phaseDefaults(phase),
+  });
+
+  useEffect(() => {
+    reset(phaseDefaults(phase));
+  }, [phase, reset]);
+
+  const watchedStart = watch('startDate');
+  const watchedDuration = watch('durationWeeks');
+  const watchedLock = watch('locksTimelineOnComplete');
+  const calculatedEnd = watchedStart && watchedDuration
+    ? addWeeks(watchedStart, watchedDuration)
+    : null;
+
+  const handleSave = async (values: PhaseUpdateValues) => {
+    if (!phase) return;
+    setSaving(true);
+    const res = await api.patch(
+      `/v1/admin/organizations/${orgId}/timelines/${timelineId}/phases/${phase.id}`,
+      {
+        name: values.name,
+        description: values.description || undefined,
+        durationWeeks: values.durationWeeks,
+        completionType: values.completionType,
+        startDate: values.startDate
+          ? new Date(values.startDate).toISOString()
+          : undefined,
+        locksTimelineOnComplete: values.locksTimelineOnComplete,
+      },
+    );
+    setSaving(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Phase updated — downstream dates recalculated');
+    onMutate();
+    onClose();
+  };
+
+  const handleComplete = async () => {
+    if (!phase) return;
+    setCompleting(true);
+    const res = await api.post(
+      `/v1/admin/organizations/${orgId}/timelines/${timelineId}/phases/${phase.id}/complete`,
+    );
+    setCompleting(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Phase marked as completed');
+    onMutate();
+    onClose();
+  };
+
+  if (!phase) return null;
+
+  return (
+    <Sheet open={open} onOpenChange={(o) => !o && onClose()}>
+      <SheetContent>
+        <SheetHeader>
+          <SheetTitle>Edit Phase: {phase.name}</SheetTitle>
+        </SheetHeader>
+        <SheetBody>
+          <form onSubmit={handleSubmit(handleSave)}>
+            <Stack gap="md">
+              <div className="flex items-center justify-between rounded-md border p-2">
+                <Text size="sm" variant="muted">Lock on completion</Text>
+                <Badge variant={watchedLock ? 'default' : 'outline'}>
+                  {watchedLock ? (
+                    <>
+                      <Locked size={12} />
+                      Enabled
+                    </>
+                  ) : 'Disabled'}
+                </Badge>
+              </div>
+
+              <div className="flex items-center gap-2">
+                <input
+                  id="phase-lock-toggle"
+                  type="checkbox"
+                  className="h-4 w-4 rounded border-input"
+                  {...register('locksTimelineOnComplete')}
+                />
+                <Label htmlFor="phase-lock-toggle">
+                  Lock timeline when this phase completes
+                </Label>
+              </div>
+
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="phase-name">Name</Label>
+                <Input id="phase-name" {...register('name')} />
+                {errors.name && (
+                  <Text size="xs" variant="destructive">{errors.name.message}</Text>
+                )}
+              </div>
+
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="phase-description">Description</Label>
+                <Input id="phase-description" {...register('description')} />
+              </div>
+
+              <div className="grid grid-cols-2 gap-3">
+                <div className="flex flex-col gap-1.5">
+                  <Label htmlFor="phase-duration">Duration (weeks)</Label>
+                  <Input
+                    id="phase-duration"
+                    type="number"
+                    min={1}
+                    {...register('durationWeeks', { valueAsNumber: true })}
+                  />
+                  {errors.durationWeeks && (
+                    <Text size="xs" variant="destructive">{errors.durationWeeks.message}</Text>
+                  )}
+                </div>
+                <div className="flex flex-col gap-1.5">
+                  <Label htmlFor="phase-start">Start Date</Label>
+                  <Input id="phase-start" type="date" {...register('startDate')} />
+                </div>
+                <div className="col-span-2 flex flex-col gap-1.5">
+                  <Label htmlFor="phase-completionType">Resolution</Label>
+                  <select
+                    id="phase-completionType"
+                    {...register('completionType')}
+                    className="flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+                  >
+                    {COMPLETION_OPTIONS.map((opt) => (
+                      <option key={opt.value} value={opt.value}>
+                        {opt.label}
+                      </option>
+                    ))}
+                  </select>
+                </div>
+              </div>
+
+              {calculatedEnd && (
+                <div className="text-sm text-muted-foreground">
+                  Calculated end date: <span className="font-medium text-foreground">{calculatedEnd}</span>
+                </div>
+              )}
+
+              <div className="flex items-center gap-2 pt-4">
+                <Button type="submit" loading={saving}>
+                  Save Changes
+                </Button>
+                {phase.status !== 'COMPLETED' && (
+                  <Button
+                    type="button"
+                    variant="outline"
+                    iconLeft={<Checkmark size={14} />}
+                    loading={completing}
+                    onClick={handleComplete}
+                  >
+                    Complete Phase
+                  </Button>
+                )}
+              </div>
+            </Stack>
+          </form>
+        </SheetBody>
+      </SheetContent>
+    </Sheet>
+  );
+}
+
+function phaseDefaults(phase: TimelinePhase | null): PhaseUpdateValues {
+  if (!phase) {
+    return {
+      name: '',
+      durationWeeks: 2,
+      completionType: 'MANUAL',
+      locksTimelineOnComplete: false,
+    };
+  }
+  return {
+    name: phase.name,
+    description: phase.description ?? '',
+    durationWeeks: phase.durationWeeks,
+    startDate: toDateInput(phase.startDate),
+    completionType: phase.completionType,
+    locksTimelineOnComplete: phase.locksTimelineOnComplete,
+  };
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineTab.tsx b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineTab.tsx
new file mode 100644
index 0000000000..c147e46214
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/TimelineTab.tsx
@@ -0,0 +1,107 @@
+'use client';
+
+import { useState } from 'react';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import { useAdminOrgTimelines } from '@/hooks/use-admin-timelines';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+  Button,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+import { Reset } from '@trycompai/design-system/icons';
+import { TimelineCard } from './TimelineCard';
+
+interface TimelineTabProps {
+  orgId: string;
+}
+
+export function TimelineTab({ orgId }: TimelineTabProps) {
+  const { timelines, isLoading, mutate } = useAdminOrgTimelines(orgId);
+  const [recreating, setRecreating] = useState(false);
+  const [recreateOpen, setRecreateOpen] = useState(false);
+
+  const handleRecreate = async () => {
+    setRecreateOpen(false);
+    setRecreating(true);
+    const res = await api.post(
+      `/v1/admin/organizations/${orgId}/timelines/recreate`,
+    );
+    setRecreating(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('All timelines recreated from latest templates');
+    mutate();
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center justify-center py-12 text-muted-foreground">
+        Loading timelines...
+      </div>
+    );
+  }
+
+  return (
+    <Stack gap="lg">
+      <div className="flex items-center justify-between">
+        <Text size="sm" variant="muted">
+          {timelines.length} timeline{timelines.length !== 1 ? 's' : ''}
+        </Text>
+        <AlertDialog open={recreateOpen} onOpenChange={setRecreateOpen}>
+          <AlertDialogTrigger
+            render={
+              <Button
+                size="sm"
+                variant="outline"
+                iconLeft={<Reset size={14} />}
+                loading={recreating}
+              >
+                Recreate All
+              </Button>
+            }
+          />
+          <AlertDialogContent>
+            <AlertDialogHeader>
+              <AlertDialogTitle>Recreate All Timelines</AlertDialogTitle>
+              <AlertDialogDescription>
+                This will delete all existing timelines for this organization and recreate them from the latest templates. All progress and customizations will be lost.
+              </AlertDialogDescription>
+            </AlertDialogHeader>
+            <AlertDialogFooter>
+              <AlertDialogCancel>Cancel</AlertDialogCancel>
+              <AlertDialogAction onClick={handleRecreate}>
+                Recreate All
+              </AlertDialogAction>
+            </AlertDialogFooter>
+          </AlertDialogContent>
+        </AlertDialog>
+      </div>
+      {timelines.length === 0 ? (
+        <div className="rounded-lg border border-dashed py-8 text-center text-sm text-muted-foreground">
+          No timelines found for this organization.
+        </div>
+      ) : (
+        timelines.map((timeline) => (
+          <TimelineCard
+            key={timeline.id}
+            timeline={timeline}
+            orgId={orgId}
+            onMutate={mutate}
+          />
+        ))
+      )}
+    </Stack>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseCard.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseCard.tsx
new file mode 100644
index 0000000000..886929804d
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseCard.tsx
@@ -0,0 +1,314 @@
+'use client';
+
+import { useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminTimelinePhaseTemplate } from '@/hooks/use-admin-timelines';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+  Button,
+  Card,
+  CardContent,
+  Input,
+  Label,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  Text,
+} from '@trycompai/design-system';
+import {
+  ArrowDown,
+  ArrowUp,
+  Save,
+  TrashCan,
+} from '@trycompai/design-system/icons';
+
+const COMPLETION_OPTIONS = [
+  { value: 'MANUAL', label: 'Manual' },
+  { value: 'AUTO_TASKS', label: 'Auto (Tasks)' },
+  { value: 'AUTO_POLICIES', label: 'Auto (Policies)' },
+  { value: 'AUTO_PEOPLE', label: 'Auto (People)' },
+  { value: 'AUTO_FINDINGS', label: 'Auto (Findings)' },
+  { value: 'AUTO_UPLOAD', label: 'Auto (Upload)' },
+] as const;
+
+const phaseSchema = z.object({
+  name: z.string().min(1, 'Name is required'),
+  description: z.string().optional(),
+  defaultDurationWeeks: z.number().min(1, 'Min 1 week'),
+  completionType: z.string().min(1),
+  groupLabel: z.string().optional(),
+  locksTimelineOnComplete: z.boolean().optional(),
+});
+
+type PhaseFormValues = z.infer<typeof phaseSchema>;
+
+interface PhaseCardProps {
+  phase: AdminTimelinePhaseTemplate;
+  templateId: string;
+  index: number;
+  totalPhases: number;
+  groupColor: string | null;
+  phaseNumber: number;
+  onMutate: () => void;
+  onMove: (direction: 'up' | 'down') => void;
+}
+
+export function PhaseCard({
+  phase,
+  templateId,
+  index,
+  totalPhases,
+  groupColor,
+  phaseNumber,
+  onMutate,
+  onMove,
+}: PhaseCardProps) {
+  const [saving, setSaving] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+  const [deleteOpen, setDeleteOpen] = useState(false);
+
+  const {
+    register,
+    handleSubmit,
+    setValue,
+    watch,
+    formState: { errors, isDirty },
+  } = useForm<PhaseFormValues>({
+    resolver: zodResolver(phaseSchema),
+    defaultValues: {
+      name: phase.name,
+      description: phase.description ?? '',
+      defaultDurationWeeks: phase.defaultDurationWeeks,
+      completionType: phase.completionType ?? 'MANUAL',
+      groupLabel: phase.groupLabel ?? '',
+      locksTimelineOnComplete: phase.locksTimelineOnComplete ?? false,
+    },
+  });
+
+  const completionType = watch('completionType');
+
+  const handleSave = async (values: PhaseFormValues) => {
+    setSaving(true);
+    const res = await api.patch(
+      `/v1/admin/timeline-templates/${templateId}/phases/${phase.id}`,
+      {
+        name: values.name,
+        description: values.description || undefined,
+        defaultDurationWeeks: values.defaultDurationWeeks,
+        completionType: values.completionType,
+        groupLabel: values.groupLabel || null,
+        locksTimelineOnComplete: values.locksTimelineOnComplete ?? false,
+      },
+    );
+    setSaving(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Phase updated');
+    onMutate();
+  };
+
+  const handleDelete = async () => {
+    setDeleting(true);
+    const res = await api.delete(
+      `/v1/admin/timeline-templates/${templateId}/phases/${phase.id}`,
+    );
+    setDeleting(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Phase deleted');
+    onMutate();
+  };
+
+  return (
+    <div className="flex gap-2">
+      {groupColor && (
+        <div
+          className="w-1 shrink-0 rounded-full"
+          style={{ backgroundColor: groupColor }}
+        />
+      )}
+      <div className="flex-1">
+        <Card>
+          <CardContent>
+            <form onSubmit={handleSubmit(handleSave)}>
+            <div className="flex items-start justify-between gap-4">
+              <div className="flex-1">
+                <div className="flex items-center gap-2 pb-3">
+                  <Text size="xs" variant="muted">
+                    Phase {phaseNumber}
+                  </Text>
+                  <div className="flex items-center gap-0.5">
+                    <Button
+                      type="button"
+                      size="sm"
+                      variant="ghost"
+                      iconLeft={<ArrowUp size={14} />}
+                      onClick={() => onMove('up')}
+                      disabled={index === 0}
+                    />
+                    <Button
+                      type="button"
+                      size="sm"
+                      variant="ghost"
+                      iconLeft={<ArrowDown size={14} />}
+                      onClick={() => onMove('down')}
+                      disabled={index === totalPhases - 1}
+                    />
+                  </div>
+                </div>
+
+                <div className="grid grid-cols-1 gap-3 md:grid-cols-2 lg:grid-cols-3">
+                  <div className="flex flex-col gap-1">
+                    <Label htmlFor={`phase-${phase.id}-name`}>Name</Label>
+                    <Input
+                      id={`phase-${phase.id}-name`}
+                      {...register('name')}
+                      placeholder="Phase name"
+                    />
+                    {errors.name && (
+                      <Text size="xs" variant="destructive">
+                        {errors.name.message}
+                      </Text>
+                    )}
+                  </div>
+
+                  <div className="flex flex-col gap-1">
+                    <Label htmlFor={`phase-${phase.id}-desc`}>
+                      Description
+                    </Label>
+                    <Input
+                      id={`phase-${phase.id}-desc`}
+                      {...register('description')}
+                      placeholder="Optional description"
+                    />
+                  </div>
+
+                  <div className="flex flex-col gap-1">
+                    <Label htmlFor={`phase-${phase.id}-duration`}>
+                      Duration (weeks)
+                    </Label>
+                    <Input
+                      id={`phase-${phase.id}-duration`}
+                      type="number"
+                      min={1}
+                      {...register('defaultDurationWeeks', {
+                        valueAsNumber: true,
+                      })}
+                    />
+                    {errors.defaultDurationWeeks && (
+                      <Text size="xs" variant="destructive">
+                        {errors.defaultDurationWeeks.message}
+                      </Text>
+                    )}
+                  </div>
+
+                  <div className="flex flex-col gap-1">
+                    <Label>Completion Type</Label>
+                    <Select
+                      value={completionType}
+                      onValueChange={(val) => {
+                        if (val) setValue('completionType', val, { shouldDirty: true });
+                      }}
+                    >
+                      <SelectTrigger size="sm">
+                        <span className="text-sm">
+                          {COMPLETION_OPTIONS.find(
+                            (o) => o.value === completionType,
+                          )?.label ?? completionType}
+                        </span>
+                      </SelectTrigger>
+                      <SelectContent alignItemWithTrigger={false}>
+                        {COMPLETION_OPTIONS.map((opt) => (
+                          <SelectItem key={opt.value} value={opt.value}>
+                            {opt.label}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </div>
+
+                  <div className="flex items-center gap-2 pt-5">
+                    <input
+                      id={`phase-${phase.id}-lock`}
+                      type="checkbox"
+                      className="h-4 w-4 rounded border-input"
+                      {...register('locksTimelineOnComplete')}
+                    />
+                    <Label htmlFor={`phase-${phase.id}-lock`}>
+                      Lock timeline when this phase completes
+                    </Label>
+                  </div>
+
+                </div>
+              </div>
+
+              <div className="flex shrink-0 flex-col gap-1 pt-6">
+                <Button
+                  type="submit"
+                  size="sm"
+                  variant="outline"
+                  iconLeft={<Save size={14} />}
+                  loading={saving}
+                  disabled={!isDirty}
+                >
+                  Save
+                </Button>
+                <AlertDialog open={deleteOpen} onOpenChange={setDeleteOpen}>
+                  <AlertDialogTrigger
+                    render={
+                      <Button
+                        type="button"
+                        size="sm"
+                        variant="ghost"
+                        iconLeft={<TrashCan size={14} />}
+                        loading={deleting}
+                      />
+                    }
+                  />
+                  <AlertDialogContent>
+                    <AlertDialogHeader>
+                      <AlertDialogTitle>Delete phase?</AlertDialogTitle>
+                      <AlertDialogDescription>
+                        This will permanently remove this phase and all its
+                        configuration from the template.
+                      </AlertDialogDescription>
+                    </AlertDialogHeader>
+                    <AlertDialogFooter>
+                      <AlertDialogCancel>Cancel</AlertDialogCancel>
+                      <AlertDialogAction
+                        onClick={() => {
+                          setDeleteOpen(false);
+                          handleDelete();
+                        }}
+                      >
+                        Delete
+                      </AlertDialogAction>
+                    </AlertDialogFooter>
+                  </AlertDialogContent>
+                </AlertDialog>
+              </div>
+            </div>
+            </form>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseGroupCard.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseGroupCard.tsx
new file mode 100644
index 0000000000..d78119a36c
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseGroupCard.tsx
@@ -0,0 +1,199 @@
+'use client';
+
+import { useState } from 'react';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminTimelinePhaseTemplate } from '@/hooks/use-admin-timelines';
+import {
+  Button,
+  Card,
+  CardContent,
+  Input,
+  Text,
+} from '@trycompai/design-system';
+import { Add, Save } from '@trycompai/design-system/icons';
+import { SubPhaseRow } from './SubPhaseRow';
+
+interface PhaseGroupCardProps {
+  groupLabel: string;
+  phases: AdminTimelinePhaseTemplate[];
+  templateId: string;
+  groupColor: string;
+  phaseNumber: number;
+  onMutate: () => void;
+  onSwapPhases: (
+    phaseIdA: string,
+    orderA: number,
+    phaseIdB: string,
+    orderB: number,
+  ) => Promise<void>;
+}
+
+export function PhaseGroupCard({
+  groupLabel,
+  phases,
+  templateId,
+  groupColor,
+  phaseNumber,
+  onMutate,
+  onSwapPhases,
+}: PhaseGroupCardProps) {
+  const [adding, setAdding] = useState(false);
+  const [editingLabel, setEditingLabel] = useState(groupLabel);
+  const [savingLabel, setSavingLabel] = useState(false);
+
+  const sorted = [...phases].sort((a, b) => a.orderIndex - b.orderIndex);
+  const totalDuration = sorted.reduce(
+    (sum, p) => sum + p.defaultDurationWeeks,
+    0,
+  );
+  const isLabelDirty = editingLabel !== groupLabel;
+
+  const handleAddSubPhase = async () => {
+    setAdding(true);
+    const maxOrder = Math.max(...sorted.map((p) => p.orderIndex), -1);
+    const res = await api.post(
+      `/v1/admin/timeline-templates/${templateId}/phases`,
+      {
+        name: 'New Sub-phase',
+        orderIndex: maxOrder + 1,
+        defaultDurationWeeks: 1,
+        completionType: 'MANUAL',
+        locksTimelineOnComplete: false,
+        groupLabel,
+      },
+    );
+    setAdding(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Sub-phase added');
+    onMutate();
+  };
+
+  const handleSaveGroupLabel = async () => {
+    if (!editingLabel.trim()) {
+      toast.error('Group label cannot be empty');
+      return;
+    }
+    setSavingLabel(true);
+    const results = await Promise.all(
+      sorted.map((phase) =>
+        api.patch(
+          `/v1/admin/timeline-templates/${templateId}/phases/${phase.id}`,
+          { groupLabel: editingLabel.trim() },
+        ),
+      ),
+    );
+    setSavingLabel(false);
+    const failed = results.find((r) => r.error);
+    if (failed) {
+      toast.error('Failed to update group label');
+      return;
+    }
+    toast.success('Group label updated');
+    onMutate();
+  };
+
+  const handleMoveWithinGroup = async (
+    phaseId: string,
+    direction: 'up' | 'down',
+  ) => {
+    const idx = sorted.findIndex((p) => p.id === phaseId);
+    if (idx < 0) return;
+    const targetIdx = direction === 'up' ? idx - 1 : idx + 1;
+    if (targetIdx < 0 || targetIdx >= sorted.length) return;
+
+    await onSwapPhases(
+      sorted[idx].id,
+      sorted[targetIdx].orderIndex,
+      sorted[targetIdx].id,
+      sorted[idx].orderIndex,
+    );
+  };
+
+  return (
+    <div className="flex gap-2">
+      <div
+        className="w-1 shrink-0 rounded-full"
+        style={{ backgroundColor: groupColor }}
+      />
+      <div className="flex-1">
+        <Card>
+          <CardContent>
+            <div className="flex flex-col gap-2 pb-3">
+              <div className="flex items-center justify-between gap-3">
+                <Text size="xs" variant="muted">Phase {phaseNumber}</Text>
+                <div className="flex items-center gap-3">
+                  <Text size="xs" variant="muted">
+                    {totalDuration}w total
+                  </Text>
+                  <Button
+                    size="sm"
+                    variant="outline"
+                    iconLeft={<Add size={14} />}
+                    loading={adding}
+                    onClick={handleAddSubPhase}
+                  >
+                    Add Sub-phase
+                  </Button>
+                </div>
+              </div>
+              <div className="flex items-center gap-2">
+                <div className="max-w-xs">
+                  <Input
+                    value={editingLabel}
+                    onChange={(e) => setEditingLabel(e.target.value)}
+                  />
+                </div>
+                {isLabelDirty && (
+                  <Button
+                    size="sm"
+                    variant="outline"
+                    iconLeft={<Save size={14} />}
+                    loading={savingLabel}
+                    onClick={handleSaveGroupLabel}
+                  >
+                    Rename
+                  </Button>
+                )}
+              </div>
+            </div>
+
+            <div className="flex flex-col gap-2">
+              {/* Column labels */}
+              <div className="flex items-center gap-2 px-3">
+                <div className="w-16 shrink-0" />
+                <div className="min-w-0 flex-1">
+                  <Text size="xs" variant="muted">Name</Text>
+                </div>
+                <div className="w-24 shrink-0">
+                  <Text size="xs" variant="muted">Duration (wk)</Text>
+                </div>
+                <div className="w-36 shrink-0">
+                  <Text size="xs" variant="muted">Completion</Text>
+                </div>
+                <div className="w-20 shrink-0 text-center">
+                  <Text size="xs" variant="muted">Lock</Text>
+                </div>
+                <div className="w-16 shrink-0" />
+              </div>
+              {sorted.map((phase, idx) => (
+                <SubPhaseRow
+                  key={phase.id}
+                  phase={phase}
+                  templateId={templateId}
+                  index={idx}
+                  totalInGroup={sorted.length}
+                  onMutate={onMutate}
+                  onMove={(dir) => handleMoveWithinGroup(phase.id, dir)}
+                />
+              ))}
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseList.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseList.tsx
new file mode 100644
index 0000000000..b3ed79ce74
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/PhaseList.tsx
@@ -0,0 +1,229 @@
+'use client';
+
+import { useState } from 'react';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminTimelinePhaseTemplate } from '@/hooks/use-admin-timelines';
+import { Button, Section, Text } from '@trycompai/design-system';
+import { Add, GroupObjects } from '@trycompai/design-system/icons';
+import { PhaseCard } from './PhaseCard';
+import { PhaseGroupCard } from './PhaseGroupCard';
+
+const GROUP_COLORS = [
+  'var(--primary)',
+  'var(--chart-2)',
+  'var(--chart-3)',
+  'var(--chart-4)',
+  'var(--chart-5)',
+];
+
+function getGroupColorMap(
+  phases: AdminTimelinePhaseTemplate[],
+): Record<string, string> {
+  const labels = new Set<string>();
+  for (const p of phases) {
+    if (p.groupLabel) labels.add(p.groupLabel);
+  }
+  const map: Record<string, string> = {};
+  let idx = 0;
+  for (const label of labels) {
+    map[label] = GROUP_COLORS[idx % GROUP_COLORS.length];
+    idx++;
+  }
+  return map;
+}
+
+type PhaseListEntry =
+  | { type: 'ungrouped'; phase: AdminTimelinePhaseTemplate }
+  | { type: 'group'; label: string; phases: AdminTimelinePhaseTemplate[] };
+
+function buildPhaseEntries(
+  phases: AdminTimelinePhaseTemplate[],
+): PhaseListEntry[] {
+  const sorted = [...phases].sort((a, b) => a.orderIndex - b.orderIndex);
+  const entries: PhaseListEntry[] = [];
+  const seenGroups = new Set<string>();
+
+  for (const phase of sorted) {
+    if (!phase.groupLabel) {
+      entries.push({ type: 'ungrouped', phase });
+      continue;
+    }
+    if (seenGroups.has(phase.groupLabel)) continue;
+    seenGroups.add(phase.groupLabel);
+    const groupPhases = sorted.filter(
+      (p) => p.groupLabel === phase.groupLabel,
+    );
+    entries.push({ type: 'group', label: phase.groupLabel, phases: groupPhases });
+  }
+
+  return entries;
+}
+
+interface PhaseListProps {
+  phases: AdminTimelinePhaseTemplate[];
+  templateId: string;
+  onMutate: () => void;
+}
+
+export function PhaseList({ phases, templateId, onMutate }: PhaseListProps) {
+  const [addingPhase, setAddingPhase] = useState(false);
+  const [addingGroup, setAddingGroup] = useState(false);
+
+  const sorted = [...phases].sort((a, b) => a.orderIndex - b.orderIndex);
+  const groupColors = getGroupColorMap(sorted);
+  const entries = buildPhaseEntries(phases);
+
+  const handleAddPhase = async () => {
+    setAddingPhase(true);
+    const res = await api.post(
+      `/v1/admin/timeline-templates/${templateId}/phases`,
+      {
+        name: 'New Phase',
+        orderIndex: sorted.length,
+        defaultDurationWeeks: 2,
+        completionType: 'MANUAL',
+        locksTimelineOnComplete: false,
+      },
+    );
+    setAddingPhase(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Phase added');
+    onMutate();
+  };
+
+  const handleAddGroup = async () => {
+    setAddingGroup(true);
+    const res = await api.post(
+      `/v1/admin/timeline-templates/${templateId}/phases`,
+      {
+        name: 'New Sub-phase',
+        orderIndex: sorted.length,
+        defaultDurationWeeks: 2,
+        completionType: 'MANUAL',
+        locksTimelineOnComplete: false,
+        groupLabel: 'New Group',
+      },
+    );
+    setAddingGroup(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Group created');
+    onMutate();
+  };
+
+  const handleSwapPhases = async (
+    phaseIdA: string,
+    orderA: number,
+    phaseIdB: string,
+    orderB: number,
+  ) => {
+    const [resA, resB] = await Promise.all([
+      api.patch(
+        `/v1/admin/timeline-templates/${templateId}/phases/${phaseIdA}`,
+        { orderIndex: orderA },
+      ),
+      api.patch(
+        `/v1/admin/timeline-templates/${templateId}/phases/${phaseIdB}`,
+        { orderIndex: orderB },
+      ),
+    ]);
+    if (resA.error || resB.error) {
+      toast.error('Failed to reorder phases');
+      return;
+    }
+    onMutate();
+  };
+
+  const handleMoveUngrouped = async (
+    phaseId: string,
+    direction: 'up' | 'down',
+  ) => {
+    const currentIndex = sorted.findIndex((p) => p.id === phaseId);
+    if (currentIndex < 0) return;
+    const targetIndex =
+      direction === 'up' ? currentIndex - 1 : currentIndex + 1;
+    if (targetIndex < 0 || targetIndex >= sorted.length) return;
+
+    await handleSwapPhases(
+      sorted[currentIndex].id,
+      sorted[targetIndex].orderIndex,
+      sorted[targetIndex].id,
+      sorted[currentIndex].orderIndex,
+    );
+  };
+
+  return (
+    <Section>
+      <div className="flex items-center justify-between pb-4">
+        <Text size="sm" weight="semibold">
+          Phases ({entries.length})
+        </Text>
+        <div className="flex items-center gap-2">
+          <Button
+            size="sm"
+            variant="outline"
+            iconLeft={<GroupObjects size={16} />}
+            loading={addingGroup}
+            onClick={handleAddGroup}
+          >
+            Add Group
+          </Button>
+          <Button
+            size="sm"
+            variant="outline"
+            iconLeft={<Add size={16} />}
+            loading={addingPhase}
+            onClick={handleAddPhase}
+          >
+            Add Phase
+          </Button>
+        </div>
+      </div>
+
+      {sorted.length === 0 ? (
+        <div className="rounded-lg border border-dashed py-8 text-center text-sm text-muted-foreground">
+          No phases yet. Add one to get started.
+        </div>
+      ) : (
+        <div className="flex flex-col gap-3">
+          {entries.map((entry, entryIdx) => {
+            const phaseNumber = entryIdx + 1;
+            if (entry.type === 'group') {
+              return (
+                <PhaseGroupCard
+                  key={`group-${entry.label}`}
+                  groupLabel={entry.label}
+                  phases={entry.phases}
+                  templateId={templateId}
+                  groupColor={groupColors[entry.label] ?? GROUP_COLORS[0]}
+                  phaseNumber={phaseNumber}
+                  onMutate={onMutate}
+                  onSwapPhases={handleSwapPhases}
+                />
+              );
+            }
+            return (
+              <PhaseCard
+                key={entry.phase.id}
+                phase={entry.phase}
+                templateId={templateId}
+                index={entryIdx}
+                totalPhases={entries.length}
+                groupColor={null}
+                phaseNumber={phaseNumber}
+                onMutate={onMutate}
+                onMove={(dir) => handleMoveUngrouped(entry.phase.id, dir)}
+              />
+            );
+          })}
+        </div>
+      )}
+    </Section>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/SubPhaseRow.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/SubPhaseRow.tsx
new file mode 100644
index 0000000000..fe2ec27d6c
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/SubPhaseRow.tsx
@@ -0,0 +1,238 @@
+'use client';
+
+import { useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminTimelinePhaseTemplate } from '@/hooks/use-admin-timelines';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+  Button,
+  Input,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  Text,
+} from '@trycompai/design-system';
+import {
+  ArrowDown,
+  ArrowUp,
+  Save,
+  TrashCan,
+} from '@trycompai/design-system/icons';
+
+const COMPLETION_OPTIONS = [
+  { value: 'MANUAL', label: 'Manual' },
+  { value: 'AUTO_TASKS', label: 'Auto (Tasks)' },
+  { value: 'AUTO_POLICIES', label: 'Auto (Policies)' },
+  { value: 'AUTO_PEOPLE', label: 'Auto (People)' },
+  { value: 'AUTO_FINDINGS', label: 'Auto (Findings)' },
+  { value: 'AUTO_UPLOAD', label: 'Auto (Upload)' },
+] as const;
+
+const subPhaseSchema = z.object({
+  name: z.string().min(1, 'Name is required'),
+  defaultDurationWeeks: z.number().min(1, 'Min 1 week'),
+  completionType: z.string().min(1),
+  locksTimelineOnComplete: z.boolean().optional(),
+});
+
+type SubPhaseFormValues = z.infer<typeof subPhaseSchema>;
+
+interface SubPhaseRowProps {
+  phase: AdminTimelinePhaseTemplate;
+  templateId: string;
+  index: number;
+  totalInGroup: number;
+  onMutate: () => void;
+  onMove: (direction: 'up' | 'down') => void;
+}
+
+export function SubPhaseRow({
+  phase,
+  templateId,
+  index,
+  totalInGroup,
+  onMutate,
+  onMove,
+}: SubPhaseRowProps) {
+  const [saving, setSaving] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+  const [deleteOpen, setDeleteOpen] = useState(false);
+
+  const {
+    register,
+    handleSubmit,
+    setValue,
+    watch,
+    formState: { isDirty },
+  } = useForm<SubPhaseFormValues>({
+    resolver: zodResolver(subPhaseSchema),
+    defaultValues: {
+      name: phase.name,
+      defaultDurationWeeks: phase.defaultDurationWeeks,
+      completionType: phase.completionType ?? 'MANUAL',
+      locksTimelineOnComplete: phase.locksTimelineOnComplete ?? false,
+    },
+  });
+
+  const completionType = watch('completionType');
+
+  const handleSave = async (values: SubPhaseFormValues) => {
+    setSaving(true);
+    const res = await api.patch(
+      `/v1/admin/timeline-templates/${templateId}/phases/${phase.id}`,
+      {
+        name: values.name,
+        defaultDurationWeeks: values.defaultDurationWeeks,
+        completionType: values.completionType,
+        locksTimelineOnComplete: values.locksTimelineOnComplete ?? false,
+      },
+    );
+    setSaving(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Sub-phase updated');
+    onMutate();
+  };
+
+  const handleDelete = async () => {
+    setDeleting(true);
+    const res = await api.delete(
+      `/v1/admin/timeline-templates/${templateId}/phases/${phase.id}`,
+    );
+    setDeleting(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Sub-phase deleted');
+    onMutate();
+  };
+
+  return (
+    <form
+      onSubmit={handleSubmit(handleSave)}
+      className="flex items-center gap-2 rounded-md border bg-muted/30 px-3 py-2"
+    >
+      <div className="flex items-center gap-0.5">
+        <Button
+          type="button"
+          size="sm"
+          variant="ghost"
+          iconLeft={<ArrowUp size={14} />}
+          onClick={() => onMove('up')}
+          disabled={index === 0}
+        />
+        <Button
+          type="button"
+          size="sm"
+          variant="ghost"
+          iconLeft={<ArrowDown size={14} />}
+          onClick={() => onMove('down')}
+          disabled={index === totalInGroup - 1}
+        />
+      </div>
+
+      <div className="min-w-0 flex-1">
+        <Input
+          {...register('name')}
+          placeholder="Sub-phase name"
+        />
+      </div>
+
+      <div className="w-24 shrink-0">
+        <Input
+          type="number"
+          min={1}
+          {...register('defaultDurationWeeks', { valueAsNumber: true })}
+        />
+      </div>
+
+      <div className="w-36 shrink-0">
+        <Select
+          value={completionType}
+          onValueChange={(val) => {
+            if (val) setValue('completionType', val, { shouldDirty: true });
+          }}
+        >
+          <SelectTrigger size="sm">
+            <span className="text-sm">
+              {COMPLETION_OPTIONS.find((o) => o.value === completionType)
+                ?.label ?? completionType}
+            </span>
+          </SelectTrigger>
+          <SelectContent alignItemWithTrigger={false}>
+            {COMPLETION_OPTIONS.map((opt) => (
+              <SelectItem key={opt.value} value={opt.value}>
+                {opt.label}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      </div>
+
+      <div className="w-20 shrink-0 text-center">
+        <input
+          type="checkbox"
+          className="h-4 w-4 rounded border-input"
+          {...register('locksTimelineOnComplete')}
+        />
+      </div>
+
+      <Button
+        type="submit"
+        size="sm"
+        variant="outline"
+        iconLeft={<Save size={14} />}
+        loading={saving}
+        disabled={!isDirty}
+      />
+      <AlertDialog open={deleteOpen} onOpenChange={setDeleteOpen}>
+        <AlertDialogTrigger
+          render={
+            <Button
+              type="button"
+              size="sm"
+              variant="ghost"
+              iconLeft={<TrashCan size={14} />}
+              loading={deleting}
+            />
+          }
+        />
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Delete sub-phase?</AlertDialogTitle>
+            <AlertDialogDescription>
+              This will permanently remove this sub-phase from the template.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={() => {
+                setDeleteOpen(false);
+                handleDelete();
+              }}
+            >
+              Delete
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </form>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/TemplateEditorPage.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/TemplateEditorPage.tsx
new file mode 100644
index 0000000000..17b3eb7885
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/TemplateEditorPage.tsx
@@ -0,0 +1,136 @@
+'use client';
+
+import { useAdminTimelineTemplate } from '@/hooks/use-admin-timelines';
+import {
+  PageHeader,
+  PageHeaderDescription,
+  PageLayout,
+  Section,
+  Text,
+} from '@trycompai/design-system';
+import { ArrowLeft } from '@trycompai/design-system/icons';
+import Link from 'next/link';
+import { TimelinePhaseBar } from '@/app/(app)/[orgId]/overview/components/TimelinePhaseBar';
+import { TemplateMetadataForm } from './TemplateMetadataForm';
+import { PhaseList } from './PhaseList';
+
+interface TemplateEditorPageProps {
+  orgId: string;
+  templateId: string;
+}
+
+export function TemplateEditorPage({
+  orgId,
+  templateId,
+}: TemplateEditorPageProps) {
+  const { template, isLoading, error, mutate } =
+    useAdminTimelineTemplate(templateId);
+
+  const phasesForBar =
+    template?.phases
+      .slice()
+      .sort((a, b) => a.orderIndex - b.orderIndex)
+      .map((p) => ({
+        id: p.id,
+        name: p.name,
+        groupLabel: p.groupLabel,
+        status: 'PENDING' as const,
+        durationWeeks: p.defaultDurationWeeks,
+        orderIndex: p.orderIndex,
+      })) ?? [];
+
+  const totalWeeks = phasesForBar.reduce(
+    (sum, p) => sum + p.durationWeeks,
+    0,
+  );
+
+  if (isLoading) {
+    return (
+      <PageLayout header={<PageHeader title="Loading..." />}>
+        <div className="flex items-center justify-center py-12 text-muted-foreground">
+          Loading template...
+        </div>
+      </PageLayout>
+    );
+  }
+
+  if (error) {
+    return (
+      <PageLayout header={<PageHeader title="Error" />}>
+        <div className="flex flex-col items-center gap-4 py-12">
+          <Text variant="muted">
+            Failed to load template:{' '}
+            {error instanceof Error ? error.message : 'Unknown error'}
+          </Text>
+          <Link
+            href={`/${orgId}/admin/timeline-templates`}
+            className="text-sm text-primary underline"
+          >
+            Back to templates
+          </Link>
+        </div>
+      </PageLayout>
+    );
+  }
+
+  if (!template) {
+    return (
+      <PageLayout header={<PageHeader title="Not Found" />}>
+        <div className="flex flex-col items-center gap-4 py-12">
+          <Text variant="muted">Template not found.</Text>
+          <Link
+            href={`/${orgId}/admin/timeline-templates`}
+            className="text-sm text-primary underline"
+          >
+            Back to templates
+          </Link>
+        </div>
+      </PageLayout>
+    );
+  }
+
+  return (
+    <PageLayout
+      header={
+        <PageHeader
+          title={template.name}
+          actions={
+            <Link
+              href={`/${orgId}/admin/timeline-templates`}
+              className="inline-flex items-center gap-1.5 text-sm text-muted-foreground transition-colors hover:text-foreground"
+            >
+              <ArrowLeft size={16} />
+              Back to templates
+            </Link>
+          }
+        >
+          <PageHeaderDescription>
+            {template.framework?.name ?? 'Unknown Framework'} &middot; Cycle{' '}
+            {template.cycleNumber} &middot; {totalWeeks} weeks total
+          </PageHeaderDescription>
+        </PageHeader>
+      }
+    >
+      <Section>
+        <TemplateMetadataForm template={template} onMutate={mutate} />
+      </Section>
+
+      {phasesForBar.length > 0 && (
+        <Section>
+          <Text size="sm" weight="semibold">
+            Preview
+          </Text>
+          <div className="mt-2">
+            <TimelinePhaseBar phases={phasesForBar} height={32} />
+          </div>
+        </Section>
+      )}
+
+      <PhaseList
+        phases={template.phases}
+        templateId={template.id}
+        onMutate={mutate}
+      />
+    </PageLayout>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/TemplateMetadataForm.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/TemplateMetadataForm.tsx
new file mode 100644
index 0000000000..24bbcef53f
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/components/TemplateMetadataForm.tsx
@@ -0,0 +1,167 @@
+'use client';
+
+import { useState } from 'react';
+import { useForm, Controller } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { toast } from 'sonner';
+import useSWR from 'swr';
+import { api, apiClient } from '@/lib/api-client';
+import type { AdminTimelineTemplate } from '@/hooks/use-admin-timelines';
+import {
+  Button,
+  Input,
+  Label,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+  Text,
+} from '@trycompai/design-system';
+import { Save } from '@trycompai/design-system/icons';
+
+const metadataSchema = z.object({
+  name: z.string().min(1, 'Template name is required'),
+  frameworkId: z.string().min(1, 'Please select a framework'),
+  cycleNumber: z.number().min(1, 'Cycle must be at least 1'),
+});
+
+type MetadataFormValues = z.infer<typeof metadataSchema>;
+
+interface Framework {
+  id: string;
+  name: string;
+}
+
+interface TemplateMetadataFormProps {
+  template: AdminTimelineTemplate;
+  onMutate: () => void;
+}
+
+export function TemplateMetadataForm({
+  template,
+  onMutate,
+}: TemplateMetadataFormProps) {
+  const [saving, setSaving] = useState(false);
+
+  const { data: frameworks = [] } = useSWR(
+    ['/v1/frameworks/available'],
+    async () => {
+      const res = await apiClient.get<{ data: Framework[] }>(
+        '/v1/frameworks/available',
+      );
+      if (res.error) throw new Error(res.error);
+      return res.data?.data ?? [];
+    },
+    { revalidateOnFocus: false },
+  );
+
+  const {
+    register,
+    handleSubmit,
+    control,
+    reset,
+    formState: { errors, isDirty },
+  } = useForm<MetadataFormValues>({
+    resolver: zodResolver(metadataSchema),
+    defaultValues: {
+      name: template.name,
+      frameworkId: template.frameworkId,
+      cycleNumber: template.cycleNumber,
+    },
+  });
+
+  const handleSave = async (values: MetadataFormValues) => {
+    setSaving(true);
+    try {
+      const res = await api.patch(
+        `/v1/admin/timeline-templates/${template.id}`,
+        values,
+      );
+      if (res.error) {
+        toast.error(res.error);
+        return;
+      }
+      toast.success('Template updated');
+      // Reset form defaults so isDirty flips back to false after a save.
+      reset(values);
+      onMutate();
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return (
+    <form onSubmit={handleSubmit(handleSave)}>
+      <div className="grid grid-cols-1 gap-4 md:grid-cols-4">
+        <div className="flex flex-col gap-1">
+          <Label htmlFor="template-name">Template Name</Label>
+          <Input
+            id="template-name"
+            {...register('name')}
+            placeholder="e.g. SOC 2 Type 2"
+          />
+          {errors.name && (
+            <Text size="xs" variant="destructive">{errors.name.message}</Text>
+          )}
+        </div>
+
+        <div className="flex flex-col gap-1">
+          <Label>Framework</Label>
+          <Controller
+            control={control}
+            name="frameworkId"
+            render={({ field }) => {
+              const selectedName = frameworks.find((fw) => fw.id === field.value)?.name
+                ?? template.framework?.name
+                ?? field.value;
+              return (
+              <Select value={field.value} onValueChange={field.onChange}>
+                <SelectTrigger>
+                  <SelectValue placeholder="Select a framework">{selectedName}</SelectValue>
+                </SelectTrigger>
+                <SelectContent>
+                  {frameworks.map((fw) => (
+                    <SelectItem key={fw.id} value={fw.id}>
+                      {fw.name}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+              );
+            }}
+          />
+          {errors.frameworkId && (
+            <Text size="xs" variant="destructive">{errors.frameworkId.message}</Text>
+          )}
+        </div>
+
+        <div className="flex flex-col gap-1">
+          <Label htmlFor="template-cycle">Cycle Number</Label>
+          <Input
+            id="template-cycle"
+            type="number"
+            min={1}
+            {...register('cycleNumber', { valueAsNumber: true })}
+          />
+          {errors.cycleNumber && (
+            <Text size="xs" variant="destructive">{errors.cycleNumber.message}</Text>
+          )}
+        </div>
+
+        <div className="flex items-end">
+          <Button
+            type="submit"
+            size="sm"
+            iconLeft={<Save size={16} />}
+            loading={saving}
+            disabled={!isDirty}
+          >
+            Save
+          </Button>
+        </div>
+      </div>
+    </form>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/page.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/page.tsx
new file mode 100644
index 0000000000..708c87a326
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/[templateId]/page.tsx
@@ -0,0 +1,11 @@
+import { TemplateEditorPage } from './components/TemplateEditorPage';
+
+interface PageProps {
+  params: Promise<{ orgId: string; templateId: string }>;
+}
+
+export default async function TimelineTemplateEditPage({ params }: PageProps) {
+  const { orgId, templateId } = await params;
+
+  return <TemplateEditorPage orgId={orgId} templateId={templateId} />;
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/NewTemplateDialog.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/NewTemplateDialog.tsx
new file mode 100644
index 0000000000..fc73cee8d5
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/NewTemplateDialog.tsx
@@ -0,0 +1,177 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useParams, useRouter } from 'next/navigation';
+import { useForm, Controller } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import { useAdminTimelineTemplates } from '@/hooks/use-admin-timelines';
+import {
+  Button,
+  Input,
+  Label,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+  Sheet,
+  SheetBody,
+  SheetContent,
+  SheetHeader,
+  SheetTitle,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+
+const newTemplateSchema = z.object({
+  name: z.string().min(1, 'Template name is required'),
+  frameworkId: z.string().min(1, 'Please select a framework'),
+  cycleNumber: z.number().min(1, 'Cycle must be at least 1'),
+});
+
+type NewTemplateFormValues = z.infer<typeof newTemplateSchema>;
+
+interface Framework {
+  id: string;
+  name: string;
+}
+
+interface NewTemplateDialogProps {
+  open: boolean;
+  onClose: () => void;
+}
+
+export function NewTemplateDialog({ open, onClose }: NewTemplateDialogProps) {
+  const { orgId } = useParams<{ orgId: string }>();
+  const router = useRouter();
+  const { mutate } = useAdminTimelineTemplates();
+  const [saving, setSaving] = useState(false);
+  const [frameworks, setFrameworks] = useState<Framework[]>([]);
+
+  useEffect(() => {
+    if (!open) return;
+    api
+      .get<{ data: Framework[] }>('/v1/frameworks/available')
+      .then((res) => {
+        if (res.data?.data) setFrameworks(res.data.data);
+      });
+  }, [open]);
+
+  const {
+    register,
+    handleSubmit,
+    reset,
+    control,
+    formState: { errors },
+  } = useForm<NewTemplateFormValues>({
+    resolver: zodResolver(newTemplateSchema),
+    defaultValues: { name: '', frameworkId: '', cycleNumber: 1 },
+  });
+
+  const handleCreate = async (values: NewTemplateFormValues) => {
+    setSaving(true);
+    const res = await api.post<{ id: string }>(
+      '/v1/admin/timeline-templates',
+      values,
+    );
+    setSaving(false);
+
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+
+    toast.success('Template created');
+    reset();
+    mutate();
+    onClose();
+
+    const created = res.data;
+    if (created?.id) {
+      router.push(`/${orgId}/admin/timeline-templates/${created.id}`);
+    }
+  };
+
+  const handleClose = () => {
+    reset();
+    onClose();
+  };
+
+  return (
+    <Sheet open={open} onOpenChange={(o) => !o && handleClose()}>
+      <SheetContent>
+        <SheetHeader>
+          <SheetTitle>New Template</SheetTitle>
+        </SheetHeader>
+        <SheetBody>
+          <form onSubmit={handleSubmit(handleCreate)}>
+            <Stack gap="md">
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="new-name">Template Name</Label>
+                <Input
+                  id="new-name"
+                  {...register('name')}
+                  placeholder="e.g. SOC 2 Type 2"
+                />
+                {errors.name && (
+                  <Text size="xs" variant="destructive">
+                    {errors.name.message}
+                  </Text>
+                )}
+              </div>
+
+              <div className="flex flex-col gap-1.5">
+                <Label>Framework</Label>
+                <Controller
+                  control={control}
+                  name="frameworkId"
+                  render={({ field }) => (
+                    <Select value={field.value} onValueChange={field.onChange}>
+                      <SelectTrigger>
+                        <SelectValue placeholder="Select a framework" />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {frameworks.map((fw) => (
+                          <SelectItem key={fw.id} value={fw.id}>
+                            {fw.name}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  )}
+                />
+                {errors.frameworkId && (
+                  <Text size="xs" variant="destructive">
+                    {errors.frameworkId.message}
+                  </Text>
+                )}
+              </div>
+
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="new-cycleNumber">Cycle Number</Label>
+                <Input
+                  id="new-cycleNumber"
+                  type="number"
+                  min={1}
+                  {...register('cycleNumber', { valueAsNumber: true })}
+                />
+                {errors.cycleNumber && (
+                  <Text size="xs" variant="destructive">
+                    {errors.cycleNumber.message}
+                  </Text>
+                )}
+              </div>
+
+              <Button type="submit" loading={saving}>
+                Create Template
+              </Button>
+            </Stack>
+          </form>
+        </SheetBody>
+      </SheetContent>
+    </Sheet>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/PhaseRow.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/PhaseRow.tsx
new file mode 100644
index 0000000000..a0b13d37f8
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/PhaseRow.tsx
@@ -0,0 +1,114 @@
+'use client';
+
+import type { FieldErrors, UseFormRegister } from 'react-hook-form';
+import { Button, Text } from '@trycompai/design-system';
+import { TrashCan } from '@trycompai/design-system/icons';
+import { Input } from '@trycompai/ui/input';
+import { Label } from '@trycompai/ui/label';
+import { COMPLETION_OPTIONS, type CompletionType } from './constants';
+
+interface PhaseFormValues {
+  name: string;
+  frameworkId: string;
+  cycleNumber: number;
+  phases: {
+    id?: string;
+    name: string;
+    description?: string;
+    defaultDurationWeeks: number;
+    completionType: CompletionType;
+    locksTimelineOnComplete?: boolean;
+  }[];
+}
+
+interface PhaseRowProps {
+  index: number;
+  register: UseFormRegister<PhaseFormValues>;
+  errors: FieldErrors<PhaseFormValues>;
+  onRemove: () => void;
+}
+
+export function PhaseRow({ index, register, errors, onRemove }: PhaseRowProps) {
+  const phaseErrors = errors.phases?.[index];
+
+  return (
+    <div className="rounded-lg border p-3">
+      <div className="flex items-center justify-between pb-2">
+        <Text size="xs" variant="muted">
+          Phase {index + 1}
+        </Text>
+        <Button
+          type="button"
+          size="sm"
+          variant="ghost"
+          iconLeft={<TrashCan size={14} />}
+          onClick={onRemove}
+        />
+      </div>
+
+      <div className="grid grid-cols-2 gap-3">
+        <div className="col-span-2 flex flex-col gap-1">
+          <Label htmlFor={`phases.${index}.name`}>Name</Label>
+          <Input
+            id={`phases.${index}.name`}
+            {...register(`phases.${index}.name`)}
+            placeholder="Phase name"
+          />
+          {phaseErrors?.name && (
+            <Text size="xs" variant="destructive">
+              {phaseErrors.name.message}
+            </Text>
+          )}
+        </div>
+
+        <div className="flex flex-col gap-1">
+          <Label htmlFor={`phases.${index}.defaultDurationWeeks`}>
+            Duration (weeks)
+          </Label>
+          <Input
+            id={`phases.${index}.defaultDurationWeeks`}
+            type="number"
+            min={1}
+            {...register(`phases.${index}.defaultDurationWeeks`, {
+              valueAsNumber: true,
+            })}
+          />
+          {phaseErrors?.defaultDurationWeeks && (
+            <Text size="xs" variant="destructive">
+              {phaseErrors.defaultDurationWeeks.message}
+            </Text>
+          )}
+        </div>
+
+        <div className="flex flex-col gap-1">
+          <Label htmlFor={`phases.${index}.completionType`}>
+            Completion
+          </Label>
+          <select
+            id={`phases.${index}.completionType`}
+            {...register(`phases.${index}.completionType`)}
+            className="flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+          >
+            {COMPLETION_OPTIONS.map((opt) => (
+              <option key={opt.value} value={opt.value}>
+                {opt.label}
+              </option>
+            ))}
+          </select>
+        </div>
+
+        <div className="col-span-2 flex items-center gap-2">
+          <input
+            id={`phases.${index}.locksTimelineOnComplete`}
+            type="checkbox"
+            className="h-4 w-4 rounded border-input"
+            {...register(`phases.${index}.locksTimelineOnComplete`)}
+          />
+          <Label htmlFor={`phases.${index}.locksTimelineOnComplete`}>
+            Lock timeline when this phase completes
+          </Label>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/TemplateEditor.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/TemplateEditor.tsx
new file mode 100644
index 0000000000..cdd1d5693b
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/TemplateEditor.tsx
@@ -0,0 +1,243 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useForm, useFieldArray } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminTimelineTemplate } from '@/hooks/use-admin-timelines';
+import {
+  Button,
+  Sheet,
+  SheetBody,
+  SheetContent,
+  SheetHeader,
+  SheetTitle,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+import { Add, TrashCan } from '@trycompai/design-system/icons';
+import { Input } from '@trycompai/ui/input';
+import { Label } from '@trycompai/ui/label';
+import { PhaseRow } from './PhaseRow';
+import {
+  getDefaults,
+  createNewTemplate,
+  saveExistingTemplate,
+} from './template-actions';
+
+const phaseSchema = z.object({
+  id: z.string().optional(),
+  name: z.string().min(1, 'Name is required'),
+  description: z.string().optional(),
+  defaultDurationWeeks: z.number().min(1, 'Must be at least 1 week'),
+  completionType: z.enum([
+    'AUTO_TASKS',
+    'AUTO_POLICIES',
+    'AUTO_PEOPLE',
+    'AUTO_FINDINGS',
+    'AUTO_UPLOAD',
+    'MANUAL',
+  ]),
+  locksTimelineOnComplete: z.boolean().optional(),
+});
+
+const templateSchema = z.object({
+  name: z.string().min(1, 'Template name is required'),
+  frameworkId: z.string().min(1, 'Framework ID is required'),
+  cycleNumber: z.number().min(1, 'Cycle must be at least 1'),
+  phases: z.array(phaseSchema),
+});
+
+type TemplateFormValues = z.infer<typeof templateSchema>;
+
+interface TemplateEditorProps {
+  open: boolean;
+  onClose: () => void;
+  template: AdminTimelineTemplate | null;
+  onMutate: () => void;
+}
+
+export function TemplateEditor({
+  open,
+  onClose,
+  template,
+  onMutate,
+}: TemplateEditorProps) {
+  const isEditing = !!template;
+  const [saving, setSaving] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+
+  const {
+    register,
+    control,
+    handleSubmit,
+    reset,
+    formState: { errors },
+  } = useForm<TemplateFormValues>({
+    resolver: zodResolver(templateSchema),
+    defaultValues: getDefaults(template),
+  });
+
+  const { fields, append, remove } = useFieldArray({
+    control,
+    name: 'phases',
+  });
+
+  useEffect(() => {
+    reset(getDefaults(template));
+  }, [template, reset]);
+
+  const handleSave = async (values: TemplateFormValues) => {
+    setSaving(true);
+    try {
+      if (isEditing) {
+        await saveExistingTemplate(template, values);
+      } else {
+        await createNewTemplate(values);
+      }
+      onMutate();
+      onClose();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Save failed');
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const handleDelete = async () => {
+    if (!template) return;
+    setDeleting(true);
+    const res = await api.delete(
+      `/v1/admin/timeline-templates/${template.id}`,
+    );
+    setDeleting(false);
+    if (res.error) {
+      toast.error(res.error);
+      return;
+    }
+    toast.success('Template deleted');
+    onMutate();
+    onClose();
+  };
+
+  const handleAddPhase = () => {
+    append({
+      name: '',
+      description: '',
+      defaultDurationWeeks: 2,
+      completionType: 'MANUAL',
+      locksTimelineOnComplete: false,
+    });
+  };
+
+  return (
+    <Sheet open={open} onOpenChange={(o) => !o && onClose()}>
+      <SheetContent>
+        <SheetHeader>
+          <SheetTitle>
+            {isEditing ? 'Edit Template' : 'New Template'}
+          </SheetTitle>
+        </SheetHeader>
+        <SheetBody>
+          <form onSubmit={handleSubmit(handleSave)}>
+            <Stack gap="md">
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="name">Template Name</Label>
+                <Input
+                  id="name"
+                  {...register('name')}
+                  placeholder="e.g. SOC 2 Initial Audit"
+                />
+                {errors.name && (
+                  <Text size="xs" variant="destructive">
+                    {errors.name.message}
+                  </Text>
+                )}
+              </div>
+
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="frameworkId">Framework ID</Label>
+                <Input
+                  id="frameworkId"
+                  {...register('frameworkId')}
+                  disabled={isEditing}
+                  placeholder="Framework ID"
+                />
+                {errors.frameworkId && (
+                  <Text size="xs" variant="destructive">
+                    {errors.frameworkId.message}
+                  </Text>
+                )}
+              </div>
+
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="cycleNumber">Cycle Number</Label>
+                <Input
+                  id="cycleNumber"
+                  type="number"
+                  min={1}
+                  {...register('cycleNumber', { valueAsNumber: true })}
+                />
+                {errors.cycleNumber && (
+                  <Text size="xs" variant="destructive">
+                    {errors.cycleNumber.message}
+                  </Text>
+                )}
+              </div>
+
+              <div className="flex items-center justify-between">
+                <Text size="sm" weight="semibold">
+                  Phases
+                </Text>
+                <Button
+                  type="button"
+                  size="sm"
+                  variant="outline"
+                  iconLeft={<Add size={16} />}
+                  onClick={handleAddPhase}
+                >
+                  Add Phase
+                </Button>
+              </div>
+
+              {fields.length === 0 && (
+                <div className="rounded-lg border border-dashed py-4 text-center text-sm text-muted-foreground">
+                  No phases yet. Add one above.
+                </div>
+              )}
+
+              {fields.map((field, index) => (
+                <PhaseRow
+                  key={field.id}
+                  index={index}
+                  register={register}
+                  errors={errors}
+                  onRemove={() => remove(index)}
+                />
+              ))}
+
+              <div className="flex items-center gap-2 pt-4">
+                <Button type="submit" loading={saving}>
+                  {isEditing ? 'Save Changes' : 'Create Template'}
+                </Button>
+                {isEditing && (
+                  <Button
+                    type="button"
+                    variant="destructive"
+                    iconLeft={<TrashCan size={16} />}
+                    loading={deleting}
+                    onClick={handleDelete}
+                  >
+                    Delete
+                  </Button>
+                )}
+              </div>
+            </Stack>
+          </form>
+        </SheetBody>
+      </SheetContent>
+    </Sheet>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/TemplateList.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/TemplateList.tsx
new file mode 100644
index 0000000000..965f7fae0e
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/TemplateList.tsx
@@ -0,0 +1,298 @@
+'use client';
+
+import { useState } from 'react';
+import { useParams, useRouter } from 'next/navigation';
+import {
+  useAdminTimelineTemplates,
+  type AdminTimelineTemplate,
+} from '@/hooks/use-admin-timelines';
+import {
+  Badge,
+  Button,
+  PageHeader,
+  PageLayout,
+  Section,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+  Text,
+} from '@trycompai/design-system';
+import { Add, Edit } from '@trycompai/design-system/icons';
+import { TimelinePhaseBar } from '@/app/(app)/[orgId]/overview/components/TimelinePhaseBar';
+import { NewTemplateDialog } from './NewTemplateDialog';
+
+interface TemplateTrackGroup {
+  key: string;
+  frameworkId: string;
+  frameworkName: string;
+  isVisible: boolean;
+  displayName: string;
+  templates: AdminTimelineTemplate[];
+}
+
+function groupByTrack(
+  templates: AdminTimelineTemplate[],
+): TemplateTrackGroup[] {
+  const groups = new Map<string, TemplateTrackGroup>();
+
+  for (const template of templates) {
+    const trackKey = template.trackKey ?? 'primary';
+    const key = `${template.frameworkId}:${trackKey}`;
+    const existing = groups.get(key);
+    if (!existing) {
+      groups.set(key, {
+        key,
+        frameworkId: template.frameworkId,
+        frameworkName: template.framework?.name ?? 'Unknown',
+        isVisible: template.framework?.visible === true,
+        displayName: template.name,
+        templates: [template],
+      });
+      continue;
+    }
+    existing.templates.push(template);
+  }
+
+  return Array.from(groups.values())
+    .map((group) => ({
+      ...group,
+      templates: [...group.templates].sort(
+        (a, b) => a.cycleNumber - b.cycleNumber,
+      ),
+    }))
+    .sort((a, b) => {
+      if (a.frameworkName !== b.frameworkName) {
+        return a.frameworkName.localeCompare(b.frameworkName);
+      }
+      return a.displayName.localeCompare(b.displayName);
+    });
+}
+
+export function TemplateList() {
+  const { templates, isLoading } = useAdminTimelineTemplates();
+  const { orgId } = useParams<{ orgId: string }>();
+  const router = useRouter();
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const [visibilityFilter, setVisibilityFilter] = useState<
+    'all' | 'visible' | 'hidden'
+  >('visible');
+
+  const handleEdit = (template: AdminTimelineTemplate) => {
+    router.push(`/${orgId}/admin/timeline-templates/${template.id}`);
+  };
+
+  const totalDurationWeeks = (template: AdminTimelineTemplate) =>
+    template.phases.reduce((sum, p) => sum + p.defaultDurationWeeks, 0);
+
+  const phasesForBar = (template: AdminTimelineTemplate) =>
+    template.phases.map((p) => ({
+      id: p.id,
+      name: p.name,
+      status: 'PENDING' as const,
+      durationWeeks: p.defaultDurationWeeks,
+      orderIndex: p.orderIndex,
+    }));
+
+  const groupedAllTemplates = groupByTrack(templates);
+  const groupedVisibleTemplates = groupByTrack(
+    templates.filter((template) => template.framework?.visible === true),
+  );
+  const groupedHiddenTemplates = groupByTrack(
+    templates.filter((template) => template.framework?.visible !== true),
+  );
+
+  const filteredTemplates = templates.filter((template) => {
+    if (visibilityFilter === 'all') return true;
+    if (visibilityFilter === 'visible') {
+      return template.framework?.visible === true;
+    }
+    return template.framework?.visible !== true;
+  });
+  const groupedFilteredTemplates = groupByTrack(filteredTemplates);
+  const filteredFrameworkCount = new Set(
+    groupedFilteredTemplates.map((template) => template.frameworkId),
+  ).size;
+
+  if (isLoading) {
+    return (
+      <PageLayout header={<PageHeader title="Timeline Templates" />}>
+        <div className="flex items-center justify-center py-12 text-muted-foreground">
+          Loading templates...
+        </div>
+      </PageLayout>
+    );
+  }
+
+  return (
+    <PageLayout
+      header={
+        <PageHeader
+          title="Timeline Templates"
+          actions={
+            <Button
+              size="sm"
+              iconLeft={<Add size={16} />}
+              onClick={() => setDialogOpen(true)}
+            >
+              New Template
+            </Button>
+          }
+        />
+      }
+    >
+      <Section>
+        <div className="mb-4 flex flex-wrap items-center gap-2">
+          <Text size="sm" variant="muted">
+            Filter:
+          </Text>
+          <Button
+            size="sm"
+            variant={visibilityFilter === 'all' ? 'default' : 'outline'}
+            onClick={() => setVisibilityFilter('all')}
+          >
+            All Templates ({groupedAllTemplates.length})
+          </Button>
+          <Button
+            size="sm"
+            variant={visibilityFilter === 'visible' ? 'default' : 'outline'}
+            onClick={() => setVisibilityFilter('visible')}
+          >
+            Visible Templates ({groupedVisibleTemplates.length})
+          </Button>
+          <Button
+            size="sm"
+            variant={visibilityFilter === 'hidden' ? 'default' : 'outline'}
+            onClick={() => setVisibilityFilter('hidden')}
+          >
+            Hidden Templates ({groupedHiddenTemplates.length})
+          </Button>
+        </div>
+        <div className="mb-4">
+          <Text size="sm" variant="muted">
+            Showing {groupedFilteredTemplates.length} template track
+            {groupedFilteredTemplates.length === 1 ? '' : 's'} across{' '}
+            {filteredFrameworkCount} framework
+            {filteredFrameworkCount === 1 ? '' : 's'}.
+          </Text>
+        </div>
+
+        {groupedFilteredTemplates.length === 0 ? (
+          <div className="rounded-lg border border-dashed py-8 text-center text-sm text-muted-foreground">
+            {groupedAllTemplates.length === 0
+              ? 'No timeline templates yet. Create one to get started.'
+              : 'No templates match the selected visibility filter.'}
+          </div>
+        ) : (
+          <Table variant="bordered">
+            <TableHeader>
+              <TableRow>
+                <TableHead>Template Name</TableHead>
+                <TableHead>Framework</TableHead>
+                <TableHead>Visibility</TableHead>
+                <TableHead>Cycle</TableHead>
+                <TableHead>Phases</TableHead>
+                <TableHead>Duration</TableHead>
+                <TableHead>Preview</TableHead>
+                <TableHead>Actions</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {groupedFilteredTemplates.map((group) => {
+                const baseTemplate = group.templates[0];
+                const phaseCounts = group.templates.map((t) => t.phases.length);
+                const minPhases = Math.min(...phaseCounts);
+                const maxPhases = Math.max(...phaseCounts);
+                const durations = group.templates.map(totalDurationWeeks);
+                const minDuration = Math.min(...durations);
+                const maxDuration = Math.max(...durations);
+
+                return (
+                <TableRow key={group.key}>
+                  <TableCell>
+                    <Text size="sm" weight="medium">
+                      {group.displayName}
+                    </Text>
+                  </TableCell>
+                  <TableCell>
+                    <Text size="sm" variant="muted">
+                      {group.frameworkName}
+                    </Text>
+                  </TableCell>
+                  <TableCell>
+                    <Badge
+                      variant={
+                        group.isVisible
+                          ? 'default'
+                          : 'outline'
+                      }
+                    >
+                      {group.isVisible
+                        ? 'Visible'
+                        : 'Hidden'}
+                    </Badge>
+                  </TableCell>
+                  <TableCell>
+                    <div className="flex flex-wrap gap-1">
+                      {group.templates.map((template) => (
+                        <Button
+                          key={template.id}
+                          size="sm"
+                          variant="outline"
+                          onClick={() => handleEdit(template)}
+                        >
+                          Cycle {template.cycleNumber}
+                        </Button>
+                      ))}
+                    </div>
+                  </TableCell>
+                  <TableCell>
+                    <Text size="sm">
+                      {minPhases === maxPhases
+                        ? minPhases
+                        : `${minPhases}-${maxPhases}`}
+                    </Text>
+                  </TableCell>
+                  <TableCell>
+                    <Text size="sm">
+                      {minDuration === maxDuration
+                        ? `${minDuration} weeks`
+                        : `${minDuration}-${maxDuration} weeks`}
+                    </Text>
+                  </TableCell>
+                  <TableCell>
+                    <div className="w-48">
+                      <TimelinePhaseBar
+                        phases={phasesForBar(baseTemplate)}
+                        height={20}
+                      />
+                    </div>
+                  </TableCell>
+                  <TableCell>
+                    <Button
+                      size="sm"
+                      variant="outline"
+                      iconLeft={<Edit size={16} />}
+                      onClick={() => handleEdit(baseTemplate)}
+                    >
+                      {group.templates.length > 1
+                        ? `Edit Cycle ${baseTemplate.cycleNumber}`
+                        : 'Edit'}
+                    </Button>
+                  </TableCell>
+                </TableRow>
+              )})}
+            </TableBody>
+          </Table>
+        )}
+      </Section>
+
+      <NewTemplateDialog
+        open={dialogOpen}
+        onClose={() => setDialogOpen(false)}
+      />
+    </PageLayout>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/constants.ts b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/constants.ts
new file mode 100644
index 0000000000..eddc802aaf
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/constants.ts
@@ -0,0 +1,10 @@
+export const COMPLETION_OPTIONS = [
+  { value: 'MANUAL', label: 'Manual' },
+  { value: 'AUTO_TASKS', label: 'Auto (Tasks)' },
+  { value: 'AUTO_POLICIES', label: 'Auto (Policies)' },
+  { value: 'AUTO_PEOPLE', label: 'Auto (People)' },
+  { value: 'AUTO_FINDINGS', label: 'Auto (Findings)' },
+  { value: 'AUTO_UPLOAD', label: 'Auto (Upload)' },
+] as const;
+
+export type CompletionType = (typeof COMPLETION_OPTIONS)[number]['value'];
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/template-actions.ts b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/template-actions.ts
new file mode 100644
index 0000000000..be3e2df78a
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/components/template-actions.ts
@@ -0,0 +1,141 @@
+import { toast } from 'sonner';
+import { api } from '@/lib/api-client';
+import type { AdminTimelineTemplate } from '@/hooks/use-admin-timelines';
+import type { CompletionType } from './constants';
+
+interface TemplateFormValues {
+  name: string;
+  frameworkId: string;
+  cycleNumber: number;
+  phases: {
+    id?: string;
+    name: string;
+    description?: string;
+    defaultDurationWeeks: number;
+    completionType: CompletionType;
+    locksTimelineOnComplete?: boolean;
+  }[];
+}
+
+export function getDefaults(
+  template: AdminTimelineTemplate | null,
+): TemplateFormValues {
+  if (!template) {
+    return { name: '', frameworkId: '', cycleNumber: 1, phases: [] };
+  }
+  return {
+    name: template.name,
+    frameworkId: template.frameworkId,
+    cycleNumber: template.cycleNumber,
+    phases: [...template.phases]
+      .sort((a, b) => a.orderIndex - b.orderIndex)
+      .map((p) => ({
+        id: p.id,
+        name: p.name,
+        description: p.description ?? '',
+        defaultDurationWeeks: p.defaultDurationWeeks,
+        completionType: p.completionType ?? 'MANUAL',
+        locksTimelineOnComplete: p.locksTimelineOnComplete ?? false,
+      })),
+  };
+}
+
+export async function createNewTemplate(values: TemplateFormValues) {
+  const res = await api.post('/v1/admin/timeline-templates', {
+    name: values.name,
+    frameworkId: values.frameworkId,
+    cycleNumber: values.cycleNumber,
+  });
+  if (res.error) throw new Error(res.error);
+
+  const created = res.data as { id: string };
+
+  // If any phase create fails, delete the template so we don't leave an
+  // orphan with zero phases sitting in the framework's template list.
+  try {
+    for (const [index, phase] of values.phases.entries()) {
+      const phaseRes = await api.post(
+        `/v1/admin/timeline-templates/${created.id}/phases`,
+        {
+          name: phase.name,
+          description: phase.description || undefined,
+          orderIndex: index,
+          defaultDurationWeeks: phase.defaultDurationWeeks,
+          completionType: phase.completionType,
+          locksTimelineOnComplete: phase.locksTimelineOnComplete ?? false,
+        },
+      );
+      if (phaseRes.error) throw new Error(phaseRes.error);
+    }
+  } catch (err) {
+    await api
+      .delete(`/v1/admin/timeline-templates/${created.id}`)
+      .catch(() => {
+        // Rollback best-effort; the original error is what matters.
+      });
+    throw err;
+  }
+
+  toast.success('Template created');
+}
+
+export async function saveExistingTemplate(
+  template: AdminTimelineTemplate,
+  values: TemplateFormValues,
+) {
+  const res = await api.patch(
+    `/v1/admin/timeline-templates/${template.id}`,
+    { name: values.name, cycleNumber: values.cycleNumber },
+  );
+  if (res.error) throw new Error(res.error);
+
+  const existingIds = new Set(template.phases.map((p) => p.id));
+  const formIds = new Set(
+    values.phases.filter((p) => p.id).map((p) => p.id),
+  );
+
+  // Upsert phases first — if any of these fail we abort with the original
+  // set still intact. Deletions happen only after all upserts succeed so a
+  // mid-save failure can't leave the template with missing phases.
+  for (const [index, phase] of values.phases.entries()) {
+    if (phase.id && existingIds.has(phase.id)) {
+      const patchRes = await api.patch(
+        `/v1/admin/timeline-templates/${template.id}/phases/${phase.id}`,
+        {
+          name: phase.name,
+          description: phase.description || undefined,
+          orderIndex: index,
+          defaultDurationWeeks: phase.defaultDurationWeeks,
+          completionType: phase.completionType,
+          locksTimelineOnComplete: phase.locksTimelineOnComplete ?? false,
+        },
+      );
+      if (patchRes.error) throw new Error(patchRes.error);
+    } else {
+      const postRes = await api.post(
+        `/v1/admin/timeline-templates/${template.id}/phases`,
+        {
+          name: phase.name,
+          description: phase.description || undefined,
+          orderIndex: index,
+          defaultDurationWeeks: phase.defaultDurationWeeks,
+          completionType: phase.completionType,
+          locksTimelineOnComplete: phase.locksTimelineOnComplete ?? false,
+        },
+      );
+      if (postRes.error) throw new Error(postRes.error);
+    }
+  }
+
+  // All upserts succeeded — safe to remove phases the user dropped.
+  for (const ep of template.phases) {
+    if (!formIds.has(ep.id)) {
+      const delRes = await api.delete(
+        `/v1/admin/timeline-templates/${template.id}/phases/${ep.id}`,
+      );
+      if (delRes.error) throw new Error(delRes.error);
+    }
+  }
+
+  toast.success('Template updated');
+}
diff --git a/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/page.tsx b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/page.tsx
new file mode 100644
index 0000000000..439e9d6769
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/admin/timeline-templates/page.tsx
@@ -0,0 +1,5 @@
+import { TemplateList } from './components/TemplateList';
+
+export default function TimelineTemplatesPage() {
+  return <TemplateList />;
+}
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkTimeline.tsx b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkTimeline.tsx
new file mode 100644
index 0000000000..ffb0cfafa0
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkTimeline.tsx
@@ -0,0 +1,265 @@
+'use client';
+
+import { Badge, Button, Heading, Text } from '@trycompai/design-system';
+import {
+  CheckmarkFilled,
+  CircleFilled,
+  CircleDash,
+  Time,
+} from '@trycompai/design-system/icons';
+import { useState } from 'react';
+import {
+  useTimelines,
+  markPhaseReadyForReview,
+  type Timeline,
+  type TimelinePhase,
+} from '@/hooks/use-timelines';
+import { TimelinePhaseBar } from '../../../overview/components/TimelinePhaseBar';
+
+interface FrameworkTimelineProps {
+  frameworkInstanceId: string;
+}
+
+function formatDate(date: string | Date | null): string {
+  if (!date) return '\u2014';
+  return new Date(date).toLocaleDateString('en-US', {
+    month: 'short',
+    day: 'numeric',
+    year: 'numeric',
+  });
+}
+
+function getTimeRemaining(endDate: string | null): string | null {
+  if (!endDate) return null;
+  const now = new Date();
+  const end = new Date(endDate);
+  const diffMs = end.getTime() - now.getTime();
+  if (diffMs <= 0) return 'Overdue';
+  const diffDays = Math.ceil(diffMs / (1000 * 60 * 60 * 24));
+  if (diffDays === 1) return '1 day remaining';
+  if (diffDays < 7) return `${diffDays} days remaining`;
+  const diffWeeks = Math.ceil(diffDays / 7);
+  if (diffWeeks === 1) return '1 week remaining';
+  return `${diffWeeks} weeks remaining`;
+}
+
+export function FrameworkTimeline({
+  frameworkInstanceId,
+}: FrameworkTimelineProps) {
+  const { timelines } = useTimelines();
+
+  const timeline = timelines.find(
+    (t) => t.frameworkInstanceId === frameworkInstanceId,
+  );
+
+  if (!timeline || timeline.phases.length === 0) return null;
+
+  const sortedPhases = [...timeline.phases].sort(
+    (a, b) => a.orderIndex - b.orderIndex,
+  );
+
+  const currentPhase = sortedPhases.find((p) => p.status === 'IN_PROGRESS');
+  const currentPhaseIndex = currentPhase
+    ? sortedPhases.indexOf(currentPhase) + 1
+    : timeline.status === 'COMPLETED'
+      ? sortedPhases.length
+      : 0;
+  const lastPhase = sortedPhases[sortedPhases.length - 1];
+  const estCompletion = lastPhase?.endDate
+    ? formatDate(lastPhase.endDate)
+    : null;
+
+  return (
+    <div className="flex flex-col gap-4">
+      <div className="flex items-baseline justify-between">
+        <Heading level="2">Compliance Timeline</Heading>
+        <div className="flex items-center gap-3 text-sm text-muted-foreground">
+          {currentPhaseIndex > 0 && (
+            <span>
+              Phase {currentPhaseIndex} of {sortedPhases.length}
+              {currentPhase && (
+                <span className="ml-1 font-medium text-foreground">
+                  · {currentPhase.name}
+                </span>
+              )}
+            </span>
+          )}
+          {estCompletion && timeline.status !== 'COMPLETED' && (
+            <span>· Est. completion {estCompletion}</span>
+          )}
+          {timeline.status === 'COMPLETED' && timeline.completedAt && (
+            <span className="text-primary">
+              Completed {formatDate(timeline.completedAt)}
+            </span>
+          )}
+        </div>
+      </div>
+      <TimelinePhaseBar phases={sortedPhases} showDates />
+      <div className="flex flex-col gap-3">
+        {sortedPhases.map((phase) => (
+          <PhaseCard
+            key={phase.id}
+            phase={phase}
+            timeline={timeline}
+          />
+        ))}
+      </div>
+    </div>
+  );
+}
+
+function PhaseCard({
+  phase,
+  timeline,
+}: {
+  phase: TimelinePhase;
+  timeline: Timeline;
+}) {
+  const [markingReady, setMarkingReady] = useState(false);
+  const [markedReady, setMarkedReady] = useState(false);
+  const { mutate } = useTimelines();
+
+  const isCompleted = phase.status === 'COMPLETED';
+  const isActive = phase.status === 'IN_PROGRESS';
+
+  const showReadyButton =
+    isActive &&
+    phase.completionType === 'AUTO_TASKS' &&
+    !phase.readyForReview &&
+    !markedReady;
+
+  const handleMarkReady = async () => {
+    setMarkingReady(true);
+    try {
+      await markPhaseReadyForReview({
+        timelineId: timeline.id,
+        phaseId: phase.id,
+      });
+      setMarkedReady(true);
+      await mutate();
+    } catch {
+      // Allow retry on failure
+    } finally {
+      setMarkingReady(false);
+    }
+  };
+
+  const borderClass = isCompleted
+    ? 'border-primary/30 bg-primary/5'
+    : isActive
+      ? 'border-primary/50 bg-primary/10'
+      : 'border-border bg-muted/30 opacity-70';
+
+  return (
+    <div
+      className={`rounded-lg border p-4 ${borderClass}`}
+    >
+      <div className="flex items-start gap-3">
+        <div className="mt-0.5 shrink-0">
+          <StatusIcon status={phase.status} />
+        </div>
+        <div className="flex min-w-0 flex-1 flex-col gap-1">
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium">{phase.name}</span>
+            <StatusBadge status={phase.status} />
+          </div>
+          {phase.description && (
+            <div>
+              <Text size="sm" variant="muted">
+                {phase.description}
+              </Text>
+            </div>
+          )}
+          <PhaseMetadata phase={phase} />
+          {(markedReady || phase.readyForReview) && (
+            <div className="mt-2 flex items-center gap-2 rounded-md bg-primary/10 px-3 py-1.5 text-xs text-primary">
+              <CheckmarkFilled size={14} />
+              <span>Marked ready for review</span>
+            </div>
+          )}
+        </div>
+        {showReadyButton && (
+          <div className="shrink-0">
+            <Button
+              size="sm"
+              variant="secondary"
+              onClick={handleMarkReady}
+              loading={markingReady}
+            >
+              Mark Ready for Review
+            </Button>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
+
+function StatusIcon({ status }: { status: TimelinePhase['status'] }) {
+  if (status === 'COMPLETED') {
+    return <CheckmarkFilled size={20} className="text-primary" />;
+  }
+  if (status === 'IN_PROGRESS') {
+    return (
+      <div className="relative flex h-5 w-5 items-center justify-center">
+        <div className="absolute h-3 w-3 animate-ping rounded-full bg-primary opacity-30" />
+        <CircleFilled size={20} className="text-primary" />
+      </div>
+    );
+  }
+  return <CircleDash size={20} className="text-muted-foreground" />;
+}
+
+function StatusBadge({ status }: { status: TimelinePhase['status'] }) {
+  if (status === 'COMPLETED') {
+    return <Badge variant="default">Completed</Badge>;
+  }
+  if (status === 'IN_PROGRESS') {
+    return <Badge variant="secondary">In Progress</Badge>;
+  }
+  return <Badge variant="secondary">Pending</Badge>;
+}
+
+function PhaseMetadata({ phase }: { phase: TimelinePhase }) {
+  const isCompleted = phase.status === 'COMPLETED';
+  const isActive = phase.status === 'IN_PROGRESS';
+  const isPending = phase.status === 'PENDING';
+
+  return (
+    <div className="flex flex-wrap items-center gap-3 text-xs text-muted-foreground">
+      <span className="inline-flex items-center gap-1">
+        <Time size={12} />
+        {phase.durationWeeks} {phase.durationWeeks === 1 ? 'week' : 'weeks'}
+      </span>
+      {isCompleted && phase.completedAt && (
+        <span>Completed {formatDate(phase.completedAt)}</span>
+      )}
+      {isCompleted && phase.startDate && phase.endDate && (
+        <span>
+          {formatDate(phase.startDate)} &ndash; {formatDate(phase.endDate)}
+        </span>
+      )}
+      {isActive && (
+        <>
+          {phase.startDate && (
+            <span>Started {formatDate(phase.startDate)}</span>
+          )}
+          {phase.endDate && (
+            <span>Due {formatDate(phase.endDate)}</span>
+          )}
+          {getTimeRemaining(phase.endDate) && (
+            <span className="font-medium text-primary">
+              {getTimeRemaining(phase.endDate)}
+            </span>
+          )}
+        </>
+      )}
+      {isPending && phase.startDate && (
+        <span>Est. {formatDate(phase.startDate)}</span>
+      )}
+      {isPending && phase.endDate && (
+        <span>Est. {formatDate(phase.endDate)}</span>
+      )}
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/page.tsx b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/page.tsx
index 3a0e393ff6..27277617f0 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/page.tsx
@@ -4,6 +4,7 @@ import Link from 'next/link';
 import { redirect } from 'next/navigation';
 import { FrameworkOverview } from './components/FrameworkOverview';
 import { FrameworkRequirements } from './components/FrameworkRequirements';
+import { FrameworkTimeline } from './components/FrameworkTimeline';
 
 interface PageProps {
   params: Promise<{
@@ -47,6 +48,7 @@ export default async function FrameworkPage({ params }: PageProps) {
         tasks={framework.tasks || []}
         evidenceSubmissions={framework.evidenceSubmissions || []}
       />
+      <FrameworkTimeline frameworkInstanceId={frameworkInstanceId} />
       <FrameworkRequirements
         requirementDefinitions={framework.requirementDefinitions || []}
         frameworkInstanceWithControls={frameworkInstanceWithControls}
diff --git a/apps/app/src/app/(app)/[orgId]/layout.tsx b/apps/app/src/app/(app)/[orgId]/layout.tsx
index 24fae1573e..7ab3994d90 100644
--- a/apps/app/src/app/(app)/[orgId]/layout.tsx
+++ b/apps/app/src/app/(app)/[orgId]/layout.tsx
@@ -15,6 +15,7 @@ import type { OrganizationFromMe } from '@/types';
 import { auth } from '@/utils/auth';
 import { GetObjectCommand } from '@aws-sdk/client-s3';
 import { getSignedUrl } from '@/lib/s3-presigner';
+import { OrganizationIdentifier } from '@trycompai/analytics';
 import { db, Role } from '@db/server';
 import dynamic from 'next/dynamic';
 import { cookies, headers } from 'next/headers';
@@ -148,7 +149,9 @@ export default async function Layout({
   let isWebAutomationsEnabled = false;
   let isSecurityEnabled = false;
   if (session?.user?.id) {
-    const flags = await getFeatureFlags(session.user.id);
+    const flags = await getFeatureFlags(session.user.id, {
+      groups: { organization: organization.id },
+    });
     isQuestionnaireEnabled = flags['ai-vendor-questionnaire'] === true;
     isTrustNdaEnabled =
       flags['is-trust-nda-enabled'] === true || flags['is-trust-nda-enabled'] === 'true';
@@ -188,6 +191,7 @@ export default async function Layout({
       triggerJobId={onboarding?.triggerJobId || undefined}
       initialToken={publicAccessToken || undefined}
     >
+      <OrganizationIdentifier orgId={organization.id} orgName={organization.name} />
       <AppShellWrapper
         organization={organization}
         organizations={organizations}
diff --git a/apps/app/src/app/(app)/[orgId]/overview/components/OverviewTabs.tsx b/apps/app/src/app/(app)/[orgId]/overview/components/OverviewTabs.tsx
index 8056e4f0c8..43d7b68ded 100644
--- a/apps/app/src/app/(app)/[orgId]/overview/components/OverviewTabs.tsx
+++ b/apps/app/src/app/(app)/[orgId]/overview/components/OverviewTabs.tsx
@@ -1,6 +1,7 @@
 'use client';
 
 import { useOrganizationFindings } from '@/hooks/use-findings-api';
+import { useFeatureFlag } from '@trycompai/analytics';
 import { FindingStatus } from '@db';
 import { TabsList, TabsTrigger, Tabs } from '@trycompai/design-system';
 import Link from 'next/link';
@@ -8,12 +9,19 @@ import { useParams, usePathname } from 'next/navigation';
 
 /**
  * Overview nav tabs. Renders link-based tabs so each sub-route (`/overview`,
- * `/overview/findings`) paints without loading the other's data.
+ * `/overview/findings`, `/overview/timeline`) paints without loading the
+ * other's data.
  */
 export function OverviewTabs() {
   const { orgId } = useParams<{ orgId: string }>();
   const pathname = usePathname();
-  const activeValue = pathname?.endsWith('/findings') ? 'findings' : 'overview';
+  const isTimelineEnabled = useFeatureFlag('is-timeline-enabled');
+
+  const activeValue = pathname?.endsWith('/findings')
+    ? 'findings'
+    : pathname?.endsWith('/timeline')
+      ? 'timeline'
+      : 'overview';
 
   // Lightweight count for the tab badge — filters to status=open on the server.
   const { data: openFindingsData } = useOrganizationFindings({
@@ -25,6 +33,7 @@ export function OverviewTabs() {
 
   const overviewHref = `/${orgId}/overview`;
   const findingsHref = `/${orgId}/overview/findings`;
+  const timelineHref = `/${orgId}/overview/timeline`;
 
   return (
     <Tabs value={activeValue}>
@@ -43,6 +52,15 @@ export function OverviewTabs() {
         >
           Findings{openCount > 0 ? ` (${openCount})` : ''}
         </TabsTrigger>
+        {isTimelineEnabled && (
+          <TabsTrigger
+            value="timeline"
+            nativeButton={false}
+            render={<Link href={timelineHref} prefetch />}
+          >
+            Timeline
+          </TabsTrigger>
+        )}
       </TabsList>
     </Tabs>
   );
diff --git a/apps/app/src/app/(app)/[orgId]/overview/components/TimelineOverview.tsx b/apps/app/src/app/(app)/[orgId]/overview/components/TimelineOverview.tsx
new file mode 100644
index 0000000000..7d4dca0d41
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/overview/components/TimelineOverview.tsx
@@ -0,0 +1,187 @@
+'use client';
+
+import {
+  Badge,
+  Card,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+import { Checkmark } from '@trycompai/design-system/icons';
+import Link from 'next/link';
+import { useParams } from 'next/navigation';
+import { useTimelines, type Timeline } from '@/hooks/use-timelines';
+import { TimelinePhaseBar } from './TimelinePhaseBar';
+
+interface TimelineOverviewProps {
+  initialData?: Timeline[];
+}
+
+const STATUS_VARIANT: Record<
+  Timeline['status'],
+  'default' | 'outline' | 'destructive'
+> = {
+  DRAFT: 'outline',
+  ACTIVE: 'default',
+  PAUSED: 'destructive',
+  COMPLETED: 'default',
+};
+
+const STATUS_LABEL: Record<Timeline['status'], string> = {
+  DRAFT: 'Draft',
+  ACTIVE: 'Active',
+  PAUSED: 'Paused',
+  COMPLETED: 'Completed',
+};
+
+function formatDate(date: string | Date | null): string {
+  if (!date) return '\u2014';
+  return new Date(date).toLocaleDateString('en-US', {
+    month: 'short',
+    day: 'numeric',
+    year: 'numeric',
+  });
+}
+
+function getNextCycleDate(timeline: Timeline): string | null {
+  if (timeline.status !== 'COMPLETED' || !timeline.completedAt) return null;
+  const completedAt = new Date(timeline.completedAt);
+  const frameworkName =
+    timeline.frameworkInstance?.framework.name ?? '';
+  const isSoc2Type2 =
+    /SOC 2/i.test(frameworkName) &&
+    !/v\.1/i.test(frameworkName) &&
+    !/Type 1/i.test(frameworkName);
+  const monthsToAdd = isSoc2Type2 ? 6 : 12;
+  const nextDate = new Date(completedAt);
+  nextDate.setMonth(nextDate.getMonth() + monthsToAdd);
+  return formatDate(nextDate);
+}
+
+interface FrameworkGroup {
+  key: string;
+  name: string;
+  current: Timeline;
+  pastCycles: Timeline[];
+}
+
+function groupByFramework(timelines: Timeline[]): FrameworkGroup[] {
+  const map = new Map<string, Timeline[]>();
+
+  for (const t of timelines) {
+    const key = t.template?.name ?? t.frameworkInstanceId;
+    const list = map.get(key) ?? [];
+    list.push(t);
+    map.set(key, list);
+  }
+
+  const groups: FrameworkGroup[] = [];
+  for (const [key, list] of map) {
+    const sorted = [...list].sort((a, b) => {
+      const order = { ACTIVE: 0, PAUSED: 1, DRAFT: 2, COMPLETED: 3 };
+      const diff = (order[a.status] ?? 9) - (order[b.status] ?? 9);
+      if (diff !== 0) return diff;
+      return b.cycleNumber - a.cycleNumber;
+    });
+
+    const current = sorted[0];
+    const pastCycles = sorted.slice(1);
+    const name = current.template?.name ?? current.frameworkInstance?.framework.name ?? key;
+
+    groups.push({ key, name, current, pastCycles });
+  }
+
+  return groups;
+}
+
+export function TimelineOverview({ initialData }: TimelineOverviewProps) {
+  const { timelines } = useTimelines({ initialData });
+  const { orgId } = useParams<{ orgId: string }>();
+
+  if (timelines.length === 0) return null;
+
+  const groups = groupByFramework(timelines);
+
+  return (
+    <Stack gap="md">
+      {groups.map((group) => (
+        <FrameworkTimelines key={group.key} group={group} orgId={orgId} />
+      ))}
+    </Stack>
+  );
+}
+
+function FrameworkTimelines({
+  group,
+  orgId,
+}: {
+  group: FrameworkGroup;
+  orgId: string;
+}) {
+  // Year = how many cycles exist for this framework type (past + current)
+  const year = group.pastCycles.length + 1;
+
+  return (
+    <TimelineCard
+      timeline={group.current}
+      orgId={orgId}
+      cycleLabel={`Year ${year}`}
+    />
+  );
+}
+
+function TimelineCard({
+  timeline,
+  orgId,
+  cycleLabel,
+}: {
+  timeline: Timeline;
+  orgId: string;
+  cycleLabel?: string;
+}) {
+  const isDraft = timeline.status === 'DRAFT';
+  const isCompleted = timeline.status === 'COMPLETED';
+  const frameworkName =
+    timeline.frameworkInstance?.framework.name ?? 'Unknown Framework';
+  const nextCycle = getNextCycleDate(timeline);
+
+  const titleContent = (
+    <div className="flex items-center gap-2">
+      <Text size="base" weight="semibold">
+        {timeline.template?.name ?? frameworkName}
+      </Text>
+      {cycleLabel && <Badge variant="outline">{cycleLabel}</Badge>}
+    </div>
+  );
+
+  const statusBadge = (
+    <Badge variant={STATUS_VARIANT[timeline.status]}>
+      {isCompleted && <Checkmark size={12} />}
+      {STATUS_LABEL[timeline.status]}
+    </Badge>
+  );
+
+  return (
+    <Link
+      href={`/${orgId}/frameworks/${timeline.frameworkInstanceId}`}
+      className={`block transition-opacity hover:opacity-90 ${isDraft ? 'opacity-60' : ''}`}
+    >
+      <Card
+        title={titleContent}
+        headerAction={statusBadge}
+      >
+        <TimelinePhaseBar phases={timeline.phases} showDates />
+
+        {isDraft && (
+          <div className="mt-3">
+            <Text size="xs" variant="muted">Awaiting start date</Text>
+          </div>
+        )}
+        {isCompleted && nextCycle && (
+          <div className="mt-3">
+            <Text size="xs" variant="muted">Next cycle: {nextCycle}</Text>
+          </div>
+        )}
+      </Card>
+    </Link>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/overview/components/TimelinePhaseBar.tsx b/apps/app/src/app/(app)/[orgId]/overview/components/TimelinePhaseBar.tsx
new file mode 100644
index 0000000000..9e3063b685
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/overview/components/TimelinePhaseBar.tsx
@@ -0,0 +1,368 @@
+'use client';
+
+
+interface Phase {
+  id: string;
+  name: string;
+  groupLabel?: string | null;
+  status: 'PENDING' | 'IN_PROGRESS' | 'COMPLETED';
+  durationWeeks: number;
+  orderIndex: number;
+  startDate?: string | null;
+  endDate?: string | null;
+  completionPercent?: number;
+}
+
+interface TimelinePhaseBarProps {
+  phases: Phase[];
+  height?: number;
+  showDates?: boolean;
+}
+
+function getProgressPercent(phase: Phase): number {
+  if (!phase.startDate || !phase.endDate) return 50;
+  const start = new Date(phase.startDate).getTime();
+  const end = new Date(phase.endDate).getTime();
+  const now = Date.now();
+  if (now <= start) return 0;
+  if (now >= end) return 100;
+  return Math.round(((now - start) / (end - start)) * 100);
+}
+
+function formatShortDate(date: string | null | undefined): string {
+  if (!date) return '';
+  return new Date(date).toLocaleDateString('en-US', { month: 'short', day: 'numeric' });
+}
+
+interface PhaseGroup {
+  label: string | null;
+  phases: Phase[];
+  totalWeeks: number;
+}
+
+function buildPhaseGroups(sorted: Phase[]): PhaseGroup[] {
+  const groups: PhaseGroup[] = [];
+  let i = 0;
+
+  while (i < sorted.length) {
+    const label = sorted[i].groupLabel ?? null;
+
+    if (label) {
+      // Named group — collect consecutive phases with same label
+      const phases: Phase[] = [];
+      while (i < sorted.length && (sorted[i].groupLabel ?? null) === label) {
+        phases.push(sorted[i]);
+        i++;
+      }
+      groups.push({
+        label,
+        phases,
+        totalWeeks: phases.reduce((sum, p) => sum + p.durationWeeks, 0),
+      });
+    } else {
+      // No group — each phase is its own group
+      const phase = sorted[i];
+      groups.push({
+        label: null,
+        phases: [phase],
+        totalWeeks: phase.durationWeeks,
+      });
+      i++;
+    }
+  }
+
+  return groups;
+}
+
+export function TimelinePhaseBar({
+  phases,
+  height = 36,
+  showDates = false,
+}: TimelinePhaseBarProps) {
+  const sorted = [...phases].sort((a, b) => a.orderIndex - b.orderIndex);
+
+  if (sorted.length === 0) return null;
+
+  const hasDates = showDates && sorted.some((p) => p.startDate || p.endDate);
+  const groups = buildPhaseGroups(sorted);
+  const hasGroups = groups.some((g) => g.label);
+
+  return (
+    <div>
+      {/* Group label row with bracket lines — hidden on mobile */}
+      {hasGroups && (
+        <div className="hidden lg:flex w-full gap-px mb-0.5">
+          {groups.map((group, idx) => (
+            <div
+              key={`group-${idx}`}
+              className="flex flex-col items-center"
+              style={{ flex: group.totalWeeks }}
+            >
+              {group.label ? (
+                <>
+                  <span className="truncate text-[10px] text-muted-foreground px-1">
+                    {group.label}{(() => {
+                      const pcts = group.phases.map((p) => p.completionPercent).filter((p): p is number => p !== undefined);
+                      if (pcts.length === 0) return '';
+                      const avg = Math.round(pcts.reduce((a, b) => a + b, 0) / pcts.length);
+                      return ` (${avg}%)`;
+                    })()}
+                  </span>
+                  <div className="flex w-full items-center mt-0.5">
+                    <div className="h-[6px] w-px bg-muted-foreground/40" />
+                    <div className="flex-1 h-px bg-muted-foreground/40" />
+                    <div className="h-[6px] w-px bg-muted-foreground/40" />
+                  </div>
+                </>
+              ) : (
+                <div className="h-[18px]" />
+              )}
+            </div>
+          ))}
+        </div>
+      )}
+
+      {/* Phase bar — Desktop: horizontal. Mobile: vertical stack */}
+
+      {/* Desktop version */}
+      <div className="hidden lg:flex w-full gap-px" style={{ height }}>
+        {groups.map((group, gIdx) => {
+          const isFirstGroup = gIdx === 0;
+          const isLastGroup = gIdx === groups.length - 1;
+
+          if (group.phases.length === 1) {
+            const phase = group.phases[0];
+            const rounded = `${isFirstGroup ? 'rounded-l-md' : ''} ${isLastGroup ? 'rounded-r-md' : ''}`;
+            return <PhaseSegment key={phase.id} phase={phase} className={rounded} />;
+          }
+
+          // Compute group-level average completion
+          const pcts = group.phases.map((p) => p.completionPercent).filter((p): p is number => p !== undefined);
+          const groupPct = pcts.length > 0 ? Math.round(pcts.reduce((a, b) => a + b, 0) / pcts.length) : null;
+          const allComplete = group.phases.every((p) => p.status === 'COMPLETED' && (p.completionPercent === undefined || p.completionPercent >= 100));
+
+          const groupRounded = `${isFirstGroup ? 'rounded-l-md' : ''} ${isLastGroup ? 'rounded-r-md' : ''}`;
+
+          if (allComplete) {
+            return (
+              <div
+                key={`group-bar-${gIdx}`}
+                className={`flex overflow-hidden bg-primary ${groupRounded}`}
+                style={{ flex: group.totalWeeks, height }}
+              >
+                {group.phases.map((phase, pIdx) => (
+                  <div
+                    key={phase.id}
+                    className={`flex items-center justify-center ${pIdx < group.phases.length - 1 ? 'border-r border-primary-foreground/20' : ''}`}
+                    style={{ flex: phase.durationWeeks }}
+                  >
+                    <span className="truncate px-1 text-[11px] text-primary-foreground">{phase.name}</span>
+                  </div>
+                ))}
+              </div>
+            );
+          }
+
+          const hasActivePhase = group.phases.some((p) => p.status === 'IN_PROGRESS');
+          const groupStripeBg = hasActivePhase
+            ? `repeating-linear-gradient(-45deg, var(--muted), var(--muted) 4px, color-mix(in oklch, var(--primary) 10%, transparent) 4px, color-mix(in oklch, var(--primary) 10%, transparent) 8px)`
+            : undefined;
+
+          return (
+            <div
+              key={`group-bar-${gIdx}`}
+              className={`relative flex overflow-hidden ${hasActivePhase ? '' : 'bg-muted'} ${groupRounded}`}
+              style={{
+                flex: group.totalWeeks,
+                height,
+                ...(groupStripeBg ? { background: groupStripeBg } : {}),
+              }}
+            >
+              {/* Single cohesive fill for the whole group */}
+              {groupPct !== null && (
+                <>
+                  <div className="absolute inset-y-0 left-0 bg-primary/50" style={{ width: `${groupPct}%` }} />
+                  {hasActivePhase && (
+                    <div className="absolute inset-y-0 w-[3px] bg-primary animate-pulse" style={{ left: `${groupPct}%` }} />
+                  )}
+                </>
+              )}
+              {/* Sub-phase name dividers */}
+              {group.phases.map((phase, pIdx) => (
+                <div
+                  key={phase.id}
+                  className={`relative z-10 flex items-center justify-center ${pIdx < group.phases.length - 1 ? 'border-r border-background/30' : ''}`}
+                  style={{ flex: phase.durationWeeks }}
+                >
+                  <span className="truncate px-1 text-[11px] font-medium text-foreground">
+                    {phase.name}{phase.completionPercent !== undefined ? ` ${phase.completionPercent}%` : ''}
+                  </span>
+                </div>
+              ))}
+            </div>
+          );
+        })}
+      </div>
+
+      {/* Mobile version — compact bars, one row per group, no per-phase dates */}
+      <div className="flex flex-col gap-px lg:hidden">
+        {groups.map((group, gIdx) => {
+          if (group.phases.length === 1) {
+            return (
+              <PhaseSegment
+                key={`m-${group.phases[0].id}`}
+                phase={group.phases[0]}
+                className="rounded-md"
+                style={{ height: 28 }}
+              />
+            );
+          }
+
+          const mPcts = group.phases.map((p) => p.completionPercent).filter((p): p is number => p !== undefined);
+          const mGroupPct = mPcts.length > 0 ? Math.round(mPcts.reduce((a, b) => a + b, 0) / mPcts.length) : null;
+          const mAllComplete = group.phases.every((p) => p.status === 'COMPLETED' && (p.completionPercent === undefined || p.completionPercent >= 100));
+
+          return (
+            <div
+              key={`m-group-${gIdx}`}
+              className={`relative flex overflow-hidden rounded-md ${mAllComplete ? 'bg-primary' : ''}`}
+              style={mAllComplete ? { height: 28 } : {
+                height: 28,
+                background: `repeating-linear-gradient(-45deg, var(--muted), var(--muted) 4px, color-mix(in oklch, var(--primary) 10%, transparent) 4px, color-mix(in oklch, var(--primary) 10%, transparent) 8px)`,
+              }}
+            >
+              {!mAllComplete && mGroupPct !== null && (
+                <div className="absolute inset-y-0 left-0 bg-primary/50" style={{ width: `${mGroupPct}%` }} />
+              )}
+              {group.phases.map((phase, pIdx) => (
+                <div
+                  key={`m-${phase.id}`}
+                  className={`relative z-10 flex items-center justify-center ${pIdx < group.phases.length - 1 ? 'border-r border-background/30' : ''}`}
+                  style={{ flex: phase.durationWeeks }}
+                >
+                  <span className={`truncate px-1 text-[11px] ${mAllComplete ? 'text-primary-foreground' : 'font-medium text-foreground'}`}>
+                    {phase.name}{phase.completionPercent !== undefined ? ` ${phase.completionPercent}%` : ''}
+                  </span>
+                </div>
+              ))}
+            </div>
+          );
+        })}
+      </div>
+
+      {/* Date markers — hidden on mobile */}
+      {hasDates && (
+        <div className="hidden lg:flex w-full gap-px mt-1">
+          {groups.map((group, gIdx) => {
+            const first = group.phases[0];
+            const last = group.phases[group.phases.length - 1];
+            const isLastGroup = gIdx === groups.length - 1;
+            return (
+              <div
+                key={`date-group-${gIdx}`}
+                className="flex justify-between text-[10px] text-muted-foreground"
+                style={{ flex: group.totalWeeks }}
+              >
+                <span>{formatShortDate(first.startDate)}</span>
+                {isLastGroup && <span>{formatShortDate(last.endDate)}</span>}
+              </div>
+            );
+          })}
+        </div>
+      )}
+    </div>
+  );
+}
+
+function PhaseSegment({
+  phase,
+  className = '',
+  inGroup = false,
+  style,
+}: {
+  phase: Phase;
+  className?: string;
+  inGroup?: boolean;
+  style?: React.CSSProperties;
+}) {
+  const flexStyle = style ?? { flex: phase.durationWeeks };
+  const hasLivePct = phase.completionPercent !== undefined;
+  const pct = phase.completionPercent ?? 0;
+  const isFullyComplete = phase.status === 'COMPLETED' && (!hasLivePct || pct >= 100);
+
+  // Fully complete (solid primary)
+  if (isFullyComplete) {
+    return (
+      <div
+        className={`relative flex items-center justify-center overflow-hidden bg-primary ${className}`}
+        style={flexStyle}
+      >
+        <span className="truncate px-2 text-[11px] text-primary-foreground">
+          {phase.name}
+        </span>
+      </div>
+    );
+  }
+
+  // Has live percentage — show fill + percentage (for any AUTO_* phase in a group)
+  if (hasLivePct) {
+    const isActive = phase.status === 'IN_PROGRESS';
+    const stripeBg = isActive
+      ? `repeating-linear-gradient(-45deg, var(--muted), var(--muted) 4px, color-mix(in oklch, var(--primary) 10%, transparent) 4px, color-mix(in oklch, var(--primary) 10%, transparent) 8px)`
+      : undefined;
+    return (
+      <div
+        className={`relative flex items-center justify-center overflow-hidden ${isActive ? '' : 'bg-muted'} ${className}`}
+        style={{ ...flexStyle, ...(stripeBg ? { background: stripeBg } : {}) }}
+      >
+        <div className="absolute inset-y-0 left-0 bg-primary/50" style={{ width: `${pct}%` }} />
+        {isActive && (
+          <div className="absolute inset-y-0 w-[3px] bg-primary animate-pulse" style={{ left: `${pct}%` }} />
+        )}
+        <span className="relative z-10 truncate px-2 text-[11px] font-semibold text-foreground">
+          {phase.name} ({pct}%)
+        </span>
+      </div>
+    );
+  }
+
+  // IN_PROGRESS without live pct (MANUAL phases) — time-based progress
+  if (phase.status === 'IN_PROGRESS') {
+    const progress = getProgressPercent(phase);
+    return (
+      <div
+        className={`relative flex items-center justify-center overflow-hidden ${className}`}
+        style={{
+          ...flexStyle,
+          background: `repeating-linear-gradient(
+            -45deg,
+            var(--muted),
+            var(--muted) 4px,
+            color-mix(in oklch, var(--primary) 10%, transparent) 4px,
+            color-mix(in oklch, var(--primary) 10%, transparent) 8px
+          )`,
+        }}
+      >
+        <div className="absolute inset-y-0 left-0 bg-primary/50" style={{ width: `${progress}%` }} />
+        <div className="absolute inset-y-0 w-[3px] bg-primary animate-pulse" style={{ left: `${progress}%` }} />
+        <span className="relative z-10 truncate px-2 text-[11px] font-semibold text-foreground">
+          {phase.name}
+        </span>
+      </div>
+    );
+  }
+
+  // PENDING (no data)
+  return (
+    <div
+      className={`relative flex items-center justify-center overflow-hidden bg-muted ${className}`}
+      style={flexStyle}
+    >
+      <span className="truncate px-2 text-[11px] text-muted-foreground">
+        {phase.name}
+      </span>
+    </div>
+  );
+}
+
+export type { Phase, TimelinePhaseBarProps };
diff --git a/apps/app/src/app/(app)/[orgId]/overview/timeline/page.tsx b/apps/app/src/app/(app)/[orgId]/overview/timeline/page.tsx
new file mode 100644
index 0000000000..686aa554c7
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/overview/timeline/page.tsx
@@ -0,0 +1,22 @@
+import { serverApi } from '@/lib/api-server';
+import { PageHeader, PageLayout } from '@trycompai/design-system';
+import { OverviewTabs } from '../components/OverviewTabs';
+import { TimelineOverview } from '../components/TimelineOverview';
+import type { Timeline } from '@/hooks/use-timelines';
+
+export function generateMetadata() {
+  return { title: 'Timeline' };
+}
+
+export default async function TimelinePage() {
+  const timelinesRes = await serverApi.get<{ data: Timeline[]; count: number }>(
+    '/v1/timelines',
+  );
+  const timelines = timelinesRes.data?.data ?? [];
+
+  return (
+    <PageLayout header={<PageHeader title="Overview" tabs={<OverviewTabs />} />}>
+      <TimelineOverview initialData={timelines} />
+    </PageLayout>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx
index 2161176330..c011bb9f05 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx
@@ -11,6 +11,10 @@ import { db } from '@db/server';
 import type { Metadata } from 'next';
 import { headers } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
+import {
+  daysSinceCheckIn,
+  getDeviceComplianceStatus,
+} from '@trycompai/utils/devices';
 import type { CheckDetails, DeviceWithChecks } from '../devices/types';
 import { Employee } from './components/Employee';
 
@@ -287,6 +291,11 @@ const getMemberDevice = async (
     return null;
   }
 
+  const complianceStatus = getDeviceComplianceStatus({
+    isCompliant: device.isCompliant,
+    lastCheckIn: device.lastCheckIn,
+  });
+
   return {
     id: device.id,
     name: device.name,
@@ -309,5 +318,7 @@ const getMemberDevice = async (
       email: device.member.user.email,
     },
     source: 'device_agent' as const,
+    complianceStatus,
+    daysSinceLastCheckIn: daysSinceCheckIn(device.lastCheckIn),
   };
 };
diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceAgentDevicesList.test.tsx b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceAgentDevicesList.test.tsx
new file mode 100644
index 0000000000..dd948905c5
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceAgentDevicesList.test.tsx
@@ -0,0 +1,126 @@
+import { render, screen, fireEvent } from '@testing-library/react';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import type { DeviceWithChecks } from '../types';
+
+vi.mock('next/navigation', () => ({
+  useParams: () => ({ orgId: 'org_1' }),
+}));
+
+vi.mock('../lib/devices-csv', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('../lib/devices-csv')>();
+  return {
+    ...mod,
+    downloadDevicesCsv: vi.fn(),
+  };
+});
+
+import { DeviceAgentDevicesList } from './DeviceAgentDevicesList';
+import { downloadDevicesCsv } from '../lib/devices-csv';
+
+const mockDownload = vi.mocked(downloadDevicesCsv);
+
+function makeDevice(overrides: Partial<DeviceWithChecks> = {}): DeviceWithChecks {
+  return {
+    id: 'dev_1',
+    name: 'Mac',
+    hostname: 'mac',
+    platform: 'macos',
+    osVersion: '14.0',
+    serialNumber: 'SN1',
+    hardwareModel: 'MBP',
+    isCompliant: true,
+    diskEncryptionEnabled: true,
+    antivirusEnabled: true,
+    passwordPolicySet: true,
+    screenLockEnabled: true,
+    checkDetails: null,
+    lastCheckIn: new Date().toISOString(),
+    agentVersion: '1.0.0',
+    installedAt: new Date().toISOString(),
+    memberId: 'mem_1',
+    user: { name: 'Jane', email: 'jane@example.com' },
+    source: 'device_agent',
+    complianceStatus: 'compliant',
+    daysSinceLastCheckIn: 0,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('DeviceAgentDevicesList', () => {
+  it('renders "Yes" for a compliant device', () => {
+    render(<DeviceAgentDevicesList devices={[makeDevice()]} />);
+    expect(screen.getByText('Yes')).toBeInTheDocument();
+  });
+
+  it('renders "No" for a non-compliant fresh device', () => {
+    render(
+      <DeviceAgentDevicesList
+        devices={[makeDevice({ isCompliant: false, complianceStatus: 'non_compliant' })]}
+      />,
+    );
+    expect(screen.getByText('No')).toBeInTheDocument();
+  });
+
+  it('renders "Stale (Nd)" for a stale device and shows em-dash check badges', () => {
+    render(
+      <DeviceAgentDevicesList
+        devices={[
+          makeDevice({
+            complianceStatus: 'stale',
+            daysSinceLastCheckIn: 34,
+            diskEncryptionEnabled: true,
+            antivirusEnabled: true,
+            passwordPolicySet: true,
+            screenLockEnabled: true,
+          }),
+        ]}
+      />,
+    );
+    expect(screen.getByText('Stale (34d)')).toBeInTheDocument();
+    // All four check badges should show em-dash when stale.
+    const dashBadges = screen.getAllByText('—');
+    expect(dashBadges.length).toBe(4);
+  });
+
+  it('renders "Stale" with no day count when lastCheckIn is null', () => {
+    render(
+      <DeviceAgentDevicesList
+        devices={[
+          makeDevice({
+            lastCheckIn: null,
+            complianceStatus: 'stale',
+            daysSinceLastCheckIn: null,
+          }),
+        ]}
+      />,
+    );
+    expect(screen.getByText('Stale')).toBeInTheDocument();
+  });
+
+  it('shows the Export CSV button when devices are present', () => {
+    render(<DeviceAgentDevicesList devices={[makeDevice()]} />);
+    expect(screen.getByRole('button', { name: /export csv/i })).toBeInTheDocument();
+  });
+
+  it('calls the CSV download with the built rows when clicked', () => {
+    render(
+      <DeviceAgentDevicesList
+        devices={[
+          makeDevice({ name: 'Alpha', id: 'a' }),
+          makeDevice({ name: 'Beta', id: 'b', complianceStatus: 'stale', daysSinceLastCheckIn: 10 }),
+        ]}
+      />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: /export csv/i }));
+    expect(mockDownload).toHaveBeenCalledTimes(1);
+    const [filename, contents] = mockDownload.mock.calls[0];
+    expect(filename).toMatch(/^devices-org_1-\d{4}-\d{2}-\d{2}\.csv$/);
+    expect(contents).toContain('Alpha');
+    expect(contents).toContain('Beta');
+    expect(contents).toContain('stale');
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceAgentDevicesList.tsx b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceAgentDevicesList.tsx
index d78d9f8419..0b9c9861b0 100644
--- a/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceAgentDevicesList.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceAgentDevicesList.tsx
@@ -2,6 +2,7 @@
 
 import {
   Badge,
+  Button,
   Empty,
   EmptyDescription,
   EmptyHeader,
@@ -18,11 +19,16 @@ import {
   TableRow,
   Text,
 } from '@trycompai/design-system';
-import { Search } from '@trycompai/design-system/icons';
+import { Download, Search } from '@trycompai/design-system/icons';
 import Link from 'next/link';
 import { useParams } from 'next/navigation';
 import { useMemo, useState } from 'react';
 import type { DeviceWithChecks } from '../types';
+import {
+  buildDevicesCsv,
+  devicesCsvFilename,
+  downloadDevicesCsv,
+} from '../lib/devices-csv';
 import { DeviceDetails } from './DeviceDetails';
 
 export interface DeviceAgentDevicesListProps {
@@ -62,9 +68,11 @@ function isDeviceOnline(lastCheckIn: string | null): boolean {
   return diffMs < 2 * 60 * 60 * 1000;
 }
 
-function UserNameCell({ device }: { device: DeviceWithChecks }) {
-  const params = useParams();
-  const orgId = params?.orgId as string;
+function staleLabel(daysSinceLastCheckIn: number | null): string {
+  return daysSinceLastCheckIn === null ? 'Stale' : `Stale (${daysSinceLastCheckIn}d)`;
+}
+
+function UserNameCell({ device, orgId }: { device: DeviceWithChecks; orgId: string }) {
   const memberId = device.memberId;
 
   if (!memberId) {
@@ -90,7 +98,52 @@ function UserNameCell({ device }: { device: DeviceWithChecks }) {
   );
 }
 
+function CompliantBadge({ device }: { device: DeviceWithChecks }) {
+  if (device.complianceStatus === 'stale') {
+    return (
+      <Badge
+        variant="secondary"
+        title={
+          device.daysSinceLastCheckIn === null
+            ? 'No check-ins recorded'
+            : `No check-in in ${device.daysSinceLastCheckIn} days`
+        }
+      >
+        {staleLabel(device.daysSinceLastCheckIn)}
+      </Badge>
+    );
+  }
+  if (device.complianceStatus === 'compliant') {
+    return <Badge variant="default">Yes</Badge>;
+  }
+  return <Badge variant="destructive">No</Badge>;
+}
+
+function CheckBadges({ device }: { device: DeviceWithChecks }) {
+  if (device.complianceStatus === 'stale') {
+    return (
+      <div className="flex flex-wrap gap-1">
+        {CHECK_FIELDS.map(({ key, label }) => (
+          <Badge key={key} variant="secondary" title={`${label} — unknown (device is stale)`}>
+            —
+          </Badge>
+        ))}
+      </div>
+    );
+  }
+  return (
+    <div className="flex flex-wrap gap-1">
+      {CHECK_FIELDS.map(({ key, label }) => (
+        <Badge key={key} variant={device[key] ? 'default' : 'destructive'}>
+          {label}
+        </Badge>
+      ))}
+    </div>
+  );
+}
+
 export const DeviceAgentDevicesList = ({ devices }: DeviceAgentDevicesListProps) => {
+  const { orgId } = useParams<{ orgId: string }>();
   const [selectedDevice, setSelectedDevice] = useState<DeviceWithChecks | null>(null);
   const [searchQuery, setSearchQuery] = useState('');
   const [page, setPage] = useState(1);
@@ -114,6 +167,12 @@ export const DeviceAgentDevicesList = ({ devices }: DeviceAgentDevicesListProps)
     return filteredDevices.slice(start, start + perPage);
   }, [filteredDevices, page, perPage]);
 
+  function handleExport() {
+    const contents = buildDevicesCsv(devices);
+    const filename = devicesCsvFilename({ orgId });
+    downloadDevicesCsv(filename, contents);
+  }
+
   if (selectedDevice) {
     return <DeviceDetails device={selectedDevice} onClose={() => setSelectedDevice(null)} />;
   }
@@ -124,20 +183,25 @@ export const DeviceAgentDevicesList = ({ devices }: DeviceAgentDevicesListProps)
 
   return (
     <Stack gap="4">
-      <div className="w-full md:max-w-[300px]">
-        <InputGroup>
-          <InputGroupAddon>
-            <Search size={16} />
-          </InputGroupAddon>
-          <InputGroupInput
-            placeholder="Search devices..."
-            value={searchQuery}
-            onChange={(e) => {
-              setSearchQuery(e.target.value);
-              setPage(1);
-            }}
-          />
-        </InputGroup>
+      <div className="flex w-full flex-col gap-2 md:flex-row md:items-center md:justify-between">
+        <div className="w-full md:max-w-[300px]">
+          <InputGroup>
+            <InputGroupAddon>
+              <Search size={16} />
+            </InputGroupAddon>
+            <InputGroupInput
+              placeholder="Search devices..."
+              value={searchQuery}
+              onChange={(e) => {
+                setSearchQuery(e.target.value);
+                setPage(1);
+              }}
+            />
+          </InputGroup>
+        </div>
+        <Button variant="outline" iconLeft={<Download />} onClick={handleExport}>
+          Export CSV
+        </Button>
       </div>
 
       {filteredDevices.length === 0 ? (
@@ -195,7 +259,7 @@ export const DeviceAgentDevicesList = ({ devices }: DeviceAgentDevicesListProps)
                   </div>
                 </TableCell>
                 <TableCell>
-                  <UserNameCell device={device} />
+                  <UserNameCell device={device} orgId={orgId} />
                 </TableCell>
                 <TableCell>
                   <div className="flex flex-col">
@@ -209,21 +273,10 @@ export const DeviceAgentDevicesList = ({ devices }: DeviceAgentDevicesListProps)
                   <Text size="sm">{formatTimeAgo(device.lastCheckIn)}</Text>
                 </TableCell>
                 <TableCell>
-                  <div className="flex flex-wrap gap-1">
-                    {CHECK_FIELDS.map(({ key, label }) => (
-                      <Badge
-                        key={key}
-                        variant={device[key] ? 'default' : 'destructive'}
-                      >
-                        {label}
-                      </Badge>
-                    ))}
-                  </div>
+                  <CheckBadges device={device} />
                 </TableCell>
                 <TableCell>
-                  <Badge variant={device.isCompliant ? 'default' : 'destructive'}>
-                    {device.isCompliant ? 'Yes' : 'No'}
-                  </Badge>
+                  <CompliantBadge device={device} />
                 </TableCell>
               </TableRow>
             ))}
diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.test.tsx b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.test.tsx
index 9d7ab0851d..dd8dd07924 100644
--- a/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.test.tsx
@@ -48,6 +48,8 @@ function makeAgentDevice(overrides: Partial<DeviceWithChecks> = {}): DeviceWithC
     installedAt: new Date().toISOString(),
     user: { name: 'Test User', email: 'test@example.com' },
     source: 'device_agent',
+    complianceStatus: 'compliant',
+    daysSinceLastCheckIn: 0,
     ...overrides,
   };
 }
@@ -140,7 +142,7 @@ describe('DeviceComplianceChart', () => {
   it('counts agent devices correctly — mixed compliance', () => {
     const devices = [
       makeAgentDevice({ isCompliant: true }),
-      makeAgentDevice({ isCompliant: false }),
+      makeAgentDevice({ isCompliant: false, complianceStatus: 'non_compliant' }),
     ];
 
     render(<DeviceComplianceChart fleetDevices={[]} agentDevices={devices} />);
@@ -148,6 +150,20 @@ describe('DeviceComplianceChart', () => {
     expect(screen.getByText('Non-Compliant (1)')).toBeInTheDocument();
   });
 
+  it('counts stale agent devices as Non-Compliant (chart stays binary)', () => {
+    const devices = [
+      makeAgentDevice({
+        isCompliant: true,
+        complianceStatus: 'stale',
+        daysSinceLastCheckIn: 30,
+      }),
+    ];
+
+    render(<DeviceComplianceChart fleetDevices={[]} agentDevices={devices} />);
+    expect(screen.getByText('Compliant (0)')).toBeInTheDocument();
+    expect(screen.getByText('Non-Compliant (1)')).toBeInTheDocument();
+  });
+
   it('counts fleet devices correctly — all policies pass', () => {
     const devices = [
       makeFleetDevice({
@@ -181,7 +197,7 @@ describe('DeviceComplianceChart', () => {
   it('combines agent and fleet devices in total count', () => {
     const agentDevices = [
       makeAgentDevice({ isCompliant: true }),
-      makeAgentDevice({ isCompliant: false }),
+      makeAgentDevice({ isCompliant: false, complianceStatus: 'non_compliant' }),
     ];
     const fleetDevices = [
       makeFleetDevice({
diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.tsx b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.tsx
index c9eeb4d0d5..e02a3b0d8a 100644
--- a/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/components/DeviceComplianceChart.tsx
@@ -31,9 +31,10 @@ export function DeviceComplianceChart({ fleetDevices, agentDevices }: DeviceComp
     let compliantCount = 0;
     let nonCompliantCount = 0;
 
-    // Count device-agent devices
+    // Count device-agent devices. Stale devices (no check-in for >= 7 days)
+    // count as non-compliant to match the table's three-state rendering.
     for (const device of agentDevices ?? []) {
-      if (device.isCompliant) {
+      if (device.complianceStatus === 'compliant') {
         compliantCount++;
       } else {
         nonCompliantCount++;
diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/lib/devices-csv.test.ts b/apps/app/src/app/(app)/[orgId]/people/devices/lib/devices-csv.test.ts
new file mode 100644
index 0000000000..9e3946fb96
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/lib/devices-csv.test.ts
@@ -0,0 +1,284 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { DeviceWithChecks } from '../types';
+import {
+  buildDevicesCsv,
+  DEVICES_CSV_HEADER,
+  devicesCsvFilename,
+  downloadDevicesCsv,
+} from './devices-csv';
+
+function makeDevice(overrides: Partial<DeviceWithChecks> = {}): DeviceWithChecks {
+  return {
+    id: 'dev_1',
+    name: 'MacBook',
+    hostname: 'macbook',
+    platform: 'macos',
+    osVersion: '14.0',
+    serialNumber: 'SN1',
+    hardwareModel: 'MBP',
+    isCompliant: true,
+    diskEncryptionEnabled: true,
+    antivirusEnabled: true,
+    passwordPolicySet: true,
+    screenLockEnabled: true,
+    checkDetails: null,
+    lastCheckIn: '2026-04-17T12:00:00.000Z',
+    agentVersion: '1.2.0',
+    installedAt: '2026-01-01T00:00:00.000Z',
+    memberId: 'mem_1',
+    user: { name: 'Jane Doe', email: 'jane@example.com' },
+    source: 'device_agent',
+    complianceStatus: 'compliant',
+    daysSinceLastCheckIn: 0,
+    ...overrides,
+  };
+}
+
+function stripBom(csv: string): string {
+  return csv.replace(/^\uFEFF/, '');
+}
+
+describe('buildDevicesCsv', () => {
+  it('prepends a UTF-8 BOM so Excel renders non-ASCII correctly', () => {
+    const csv = buildDevicesCsv([]);
+    expect(csv.charCodeAt(0)).toBe(0xfeff);
+  });
+
+  it('emits the fixed header row with CRLF terminator', () => {
+    const csv = buildDevicesCsv([]);
+    expect(stripBom(csv)).toBe(DEVICES_CSV_HEADER + '\r\n');
+  });
+
+  it('renders a compliant device in column order using CRLF line endings', () => {
+    const csv = buildDevicesCsv([makeDevice()]);
+    const body = stripBom(csv);
+    // Trim only the trailing terminator to keep any embedded CRLFs intact.
+    expect(body.endsWith('\r\n')).toBe(true);
+    const [header, row] = body.slice(0, -2).split('\r\n');
+    expect(header).toBe(DEVICES_CSV_HEADER);
+    expect(row).toBe(
+      [
+        'MacBook',
+        'Jane Doe',
+        'jane@example.com',
+        'macos',
+        '14.0',
+        '1.2.0',
+        '2026-04-17T12:00:00.000Z',
+        '0',
+        'compliant',
+        'yes',
+        'yes',
+        'yes',
+        'yes',
+      ].join(','),
+    );
+  });
+
+  it('uses "no" for failing checks and stale status when applicable', () => {
+    const csv = buildDevicesCsv([
+      makeDevice({
+        complianceStatus: 'stale',
+        daysSinceLastCheckIn: 51,
+        diskEncryptionEnabled: false,
+        antivirusEnabled: false,
+      }),
+    ]);
+    const body = stripBom(csv);
+    const row = body.slice(0, -2).split('\r\n')[1];
+    const cells = row.split(',');
+    expect(cells).toContain('stale');
+    expect(cells[7]).toBe('51'); // days since sync
+    expect(cells.slice(-4)).toEqual(['no', 'no', 'yes', 'yes']);
+  });
+
+  it('represents never-synced devices with empty last-check-in and empty days', () => {
+    const csv = buildDevicesCsv([
+      makeDevice({
+        lastCheckIn: null,
+        daysSinceLastCheckIn: null,
+        complianceStatus: 'stale',
+      }),
+    ]);
+    const body = stripBom(csv);
+    const cells = body.slice(0, -2).split('\r\n')[1].split(',');
+    expect(cells[6]).toBe(''); // last check-in
+    expect(cells[7]).toBe(''); // days since sync
+    expect(cells[8]).toBe('stale');
+  });
+
+  it('escapes commas, quotes, and newlines per RFC 4180', () => {
+    const csv = buildDevicesCsv([
+      makeDevice({
+        name: 'Device, "quoted"',
+        user: { name: 'Line1\nLine2', email: 'x@y.com' },
+      }),
+    ]);
+    const body = stripBom(csv);
+    // The embedded newline is inside a quoted cell, so split on CRLF (record sep)
+    // and take everything after the header row.
+    const rowsPart = body.slice(0, -2).split('\r\n').slice(1).join('\r\n');
+    expect(rowsPart.startsWith('"Device, ""quoted"""')).toBe(true);
+    expect(rowsPart).toContain('"Line1\nLine2"');
+  });
+
+  it('handles multiple rows separated by CRLF', () => {
+    const csv = buildDevicesCsv([
+      makeDevice({ id: 'a', name: 'Alpha' }),
+      makeDevice({ id: 'b', name: 'Beta', complianceStatus: 'non_compliant' }),
+    ]);
+    const body = stripBom(csv);
+    const lines = body.slice(0, -2).split('\r\n');
+    expect(lines).toHaveLength(3);
+    expect(lines[1].startsWith('Alpha,')).toBe(true);
+    expect(lines[2].startsWith('Beta,')).toBe(true);
+  });
+
+  describe('formula injection neutralization', () => {
+    function firstCell(csv: string): string {
+      const body = stripBom(csv);
+      const row = body.slice(0, -2).split('\r\n')[1];
+      return row.split(',')[0];
+    }
+
+    it('prefixes cells starting with "=" with an apostrophe', () => {
+      const csv = buildDevicesCsv([makeDevice({ name: '=CMD(A1)' })]);
+      expect(firstCell(csv)).toBe("'=CMD(A1)");
+    });
+
+    it('prefixes cells starting with "+" with an apostrophe', () => {
+      const csv = buildDevicesCsv([makeDevice({ name: '+1234' })]);
+      expect(firstCell(csv)).toBe("'+1234");
+    });
+
+    it('prefixes cells starting with "-" with an apostrophe', () => {
+      const csv = buildDevicesCsv([makeDevice({ name: '-5' })]);
+      expect(firstCell(csv)).toBe("'-5");
+    });
+
+    it('prefixes cells starting with "@" with an apostrophe', () => {
+      const csv = buildDevicesCsv([makeDevice({ name: '@somewhere' })]);
+      expect(firstCell(csv)).toBe("'@somewhere");
+    });
+
+    it('prefixes and double-quotes cells with a leading trigger AND an embedded comma', () => {
+      const csv = buildDevicesCsv([makeDevice({ name: '=EVIL,' })]);
+      const body = stripBom(csv);
+      const rowsPart = body.slice(0, -2).split('\r\n').slice(1).join('\r\n');
+      expect(rowsPart.startsWith('"\'=EVIL,"')).toBe(true);
+    });
+  });
+});
+
+describe('devicesCsvFilename', () => {
+  const now = new Date('2026-04-20T10:00:00Z');
+
+  it('uses orgSlug when present', () => {
+    expect(devicesCsvFilename({ orgSlug: 'acme', orgId: 'org_123', now })).toBe(
+      'devices-acme-2026-04-20.csv',
+    );
+  });
+
+  it('falls back to orgId when slug is empty', () => {
+    expect(devicesCsvFilename({ orgSlug: '', orgId: 'org_123', now })).toBe(
+      'devices-org_123-2026-04-20.csv',
+    );
+  });
+
+  it('sanitizes special characters from slug', () => {
+    expect(devicesCsvFilename({ orgSlug: 'acme/test', orgId: 'org_123', now })).toBe(
+      'devices-acme-test-2026-04-20.csv',
+    );
+  });
+
+  it('sanitizes orgId with unsafe characters', () => {
+    expect(devicesCsvFilename({ orgSlug: '', orgId: 'org/123 evil\\name', now })).toBe(
+      'devices-org-123-evil-name-2026-04-20.csv',
+    );
+  });
+});
+
+describe('downloadDevicesCsv', () => {
+  const createdUrl = 'blob:mock-url';
+  const createObjectURL = vi.fn<(blob: Blob) => string>();
+  const revokeObjectURL = vi.fn<(url: string) => void>();
+  const clickSpy = vi.fn<() => void>();
+  let appendedNodes: Node[] = [];
+  let removedNodes: Node[] = [];
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    createObjectURL.mockReset().mockReturnValue(createdUrl);
+    revokeObjectURL.mockReset();
+    clickSpy.mockReset();
+    appendedNodes = [];
+    removedNodes = [];
+
+    vi.stubGlobal('URL', {
+      ...URL,
+      createObjectURL,
+      revokeObjectURL,
+    });
+
+    vi.spyOn(document.body, 'appendChild').mockImplementation(<T extends Node>(node: T): T => {
+      appendedNodes.push(node);
+      return node;
+    });
+    vi.spyOn(document.body, 'removeChild').mockImplementation(<T extends Node>(node: T): T => {
+      removedNodes.push(node);
+      return node;
+    });
+
+    // Intercept anchor elements so we can assert on props and mock click().
+    const originalCreateElement = document.createElement.bind(document);
+    vi.spyOn(document, 'createElement').mockImplementation(((
+      tag: string,
+      options?: ElementCreationOptions,
+    ) => {
+      const el = originalCreateElement(tag, options);
+      if (tag === 'a') {
+        (el as HTMLAnchorElement).click = clickSpy;
+      }
+      return el;
+    }) as typeof document.createElement);
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it('creates an anchor with filename and blob URL, then clicks and cleans up', () => {
+    downloadDevicesCsv('devices-acme-2026-04-20.csv', 'header\r\nrow\r\n');
+
+    expect(createObjectURL).toHaveBeenCalledTimes(1);
+    expect(appendedNodes).toHaveLength(1);
+    const appendedNode = appendedNodes[0] as HTMLAnchorElement;
+    expect(appendedNode.tagName).toBe('A');
+    expect(appendedNode.download).toBe('devices-acme-2026-04-20.csv');
+    expect(appendedNode.href).toContain(createdUrl);
+
+    expect(clickSpy).toHaveBeenCalledTimes(1);
+    expect(removedNodes).toHaveLength(1);
+    expect(removedNodes[0]).toBe(appendedNode);
+
+    // revoke should be deferred via setTimeout
+    expect(revokeObjectURL).not.toHaveBeenCalled();
+    vi.runAllTimers();
+    expect(revokeObjectURL).toHaveBeenCalledWith(createdUrl);
+  });
+
+  it('no-ops when document is undefined (SSR)', () => {
+    // Simulate SSR by temporarily removing the document global.
+    const globalWithDoc = globalThis as { document?: Document };
+    const originalDocument = globalWithDoc.document;
+    delete globalWithDoc.document;
+    try {
+      expect(() => downloadDevicesCsv('x.csv', 'data')).not.toThrow();
+      expect(createObjectURL).not.toHaveBeenCalled();
+    } finally {
+      globalWithDoc.document = originalDocument;
+    }
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/lib/devices-csv.ts b/apps/app/src/app/(app)/[orgId]/people/devices/lib/devices-csv.ts
new file mode 100644
index 0000000000..3aa656bf6d
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/lib/devices-csv.ts
@@ -0,0 +1,91 @@
+import type { DeviceWithChecks } from '../types';
+
+export const DEVICES_CSV_HEADER = [
+  'Device Name',
+  'User Name',
+  'Email',
+  'Platform',
+  'OS Version',
+  'Agent Version',
+  'Last Check-in (ISO)',
+  'Days Since Sync',
+  'Status',
+  'Disk Encryption',
+  'Antivirus',
+  'Password Policy',
+  'Screen Lock',
+].join(',');
+
+const FORMULA_TRIGGER = /^[=+\-@\t\r]/;
+
+function escapeCell(value: string | number | null | undefined): string {
+  if (value === null || value === undefined) return '';
+  let str = String(value);
+  if (FORMULA_TRIGGER.test(str)) {
+    str = `'${str}`;
+  }
+  if (/[",\r\n]/.test(str)) {
+    return `"${str.replace(/"/g, '""')}"`;
+  }
+  return str;
+}
+
+function yesNo(value: boolean): 'yes' | 'no' {
+  return value ? 'yes' : 'no';
+}
+
+export function buildDevicesCsv(devices: DeviceWithChecks[]): string {
+  const rows = devices.map((d) =>
+    [
+      escapeCell(d.name),
+      escapeCell(d.user.name),
+      escapeCell(d.user.email),
+      escapeCell(d.platform),
+      escapeCell(d.osVersion),
+      escapeCell(d.agentVersion ?? ''),
+      escapeCell(d.lastCheckIn ?? ''),
+      escapeCell(d.daysSinceLastCheckIn ?? ''),
+      escapeCell(d.complianceStatus),
+      escapeCell(yesNo(d.diskEncryptionEnabled)),
+      escapeCell(yesNo(d.antivirusEnabled)),
+      escapeCell(yesNo(d.passwordPolicySet)),
+      escapeCell(yesNo(d.screenLockEnabled)),
+    ].join(','),
+  );
+  // RFC 4180: records separated by CRLF; trailing CRLF after the final record.
+  // Prepend a UTF-8 BOM so Excel correctly detects UTF-8 encoding for non-ASCII data.
+  return '\uFEFF' + [DEVICES_CSV_HEADER, ...rows].join('\r\n') + '\r\n';
+}
+
+export function downloadDevicesCsv(filename: string, contents: string): void {
+  if (typeof document === 'undefined') return;
+  const blob = new Blob([contents], { type: 'text/csv;charset=utf-8;' });
+  const url = URL.createObjectURL(blob);
+  const link = document.createElement('a');
+  link.href = url;
+  link.download = filename;
+  document.body.appendChild(link);
+  link.click();
+  document.body.removeChild(link);
+  // Defer revoke so the browser can finish dispatching the download first.
+  setTimeout(() => URL.revokeObjectURL(url), 0);
+}
+
+function sanitizeFilenamePart(value: string): string {
+  return value.replace(/[^a-zA-Z0-9_-]+/g, '-');
+}
+
+export function devicesCsvFilename({
+  orgSlug,
+  orgId,
+  now = new Date(),
+}: {
+  orgSlug?: string;
+  orgId: string;
+  now?: Date;
+}): string {
+  const date = now.toISOString().slice(0, 10);
+  const raw = orgSlug && orgSlug.length > 0 ? orgSlug : orgId;
+  const safe = sanitizeFilenamePart(raw);
+  return `devices-${safe}-${date}.csv`;
+}
diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/types/index.ts b/apps/app/src/app/(app)/[orgId]/people/devices/types/index.ts
index 82ab009768..919b408540 100644
--- a/apps/app/src/app/(app)/[orgId]/people/devices/types/index.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/types/index.ts
@@ -1,3 +1,5 @@
+import type { DeviceComplianceStatus } from '@trycompai/utils/devices';
+
 export type CheckDetailEntry = {
   method?: string;
   raw?: string;
@@ -33,6 +35,10 @@ export interface DeviceWithChecks {
   };
   /** Indicates which system reported this device */
   source: 'device_agent' | 'fleet';
+  /** Derived on the server; 'stale' = no check-in for >= 7 days. */
+  complianceStatus: DeviceComplianceStatus;
+  /** Whole days since last check-in, or null when never synced. */
+  daysSinceLastCheckIn: number | null;
 }
 
 export interface FleetPolicy {
diff --git a/apps/app/src/app/api/people/agent-devices/route.test.ts b/apps/app/src/app/api/people/agent-devices/route.test.ts
new file mode 100644
index 0000000000..adc808f799
--- /dev/null
+++ b/apps/app/src/app/api/people/agent-devices/route.test.ts
@@ -0,0 +1,119 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@/utils/auth', () => ({
+  auth: {
+    api: {
+      getSession: vi.fn(),
+    },
+  },
+}));
+
+vi.mock('next/headers', () => ({
+  headers: vi.fn(async () => new Headers()),
+}));
+
+vi.mock('@db/server', () => ({
+  db: {
+    device: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+
+import { auth } from '@/utils/auth';
+import { db } from '@db/server';
+import { GET } from './route';
+
+const mockedGetSession = vi.mocked(auth.api.getSession);
+const mockedFindMany = vi.mocked(
+  (db as unknown as { device: { findMany: ReturnType<typeof vi.fn> } }).device.findMany,
+);
+
+// Freeze "now" so day math is deterministic.
+const FIXED_NOW = new Date('2026-04-17T12:00:00.000Z');
+
+beforeAll(() => {
+  vi.useFakeTimers();
+  vi.setSystemTime(FIXED_NOW);
+});
+
+afterAll(() => {
+  vi.useRealTimers();
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mockedGetSession.mockResolvedValue({
+    session: { activeOrganizationId: 'org_1' },
+  } as unknown as Awaited<ReturnType<typeof auth.api.getSession>>);
+});
+
+function deviceRow(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    id: 'dev_1',
+    name: 'Mac',
+    hostname: 'mac',
+    platform: 'macos',
+    osVersion: '14.0',
+    serialNumber: 'SN1',
+    hardwareModel: 'MBP',
+    isCompliant: true,
+    diskEncryptionEnabled: true,
+    antivirusEnabled: true,
+    passwordPolicySet: true,
+    screenLockEnabled: true,
+    checkDetails: null,
+    lastCheckIn: new Date(FIXED_NOW),
+    agentVersion: '1.0.0',
+    installedAt: new Date('2026-01-01T00:00:00.000Z'),
+    memberId: 'mem_1',
+    member: { user: { name: 'A', email: 'a@example.com' } },
+    ...overrides,
+  };
+}
+
+describe('GET /api/people/agent-devices', () => {
+  it('returns 401 when no organization is active', async () => {
+    mockedGetSession.mockResolvedValue({ session: {} } as never);
+    const res = await GET();
+    expect(res.status).toBe(401);
+  });
+
+  it('marks a fresh + isCompliant device as compliant', async () => {
+    mockedFindMany.mockResolvedValue([deviceRow({ lastCheckIn: new Date(FIXED_NOW) })]);
+    const res = await GET();
+    const body = await res.json();
+    expect(body.data[0].complianceStatus).toBe('compliant');
+    expect(body.data[0].daysSinceLastCheckIn).toBe(0);
+  });
+
+  it('marks a fresh + !isCompliant device as non_compliant', async () => {
+    mockedFindMany.mockResolvedValue([
+      deviceRow({
+        isCompliant: false,
+        diskEncryptionEnabled: false,
+        lastCheckIn: new Date(FIXED_NOW),
+      }),
+    ]);
+    const res = await GET();
+    const body = await res.json();
+    expect(body.data[0].complianceStatus).toBe('non_compliant');
+  });
+
+  it('marks a device with lastCheckIn >= 7 days ago as stale', async () => {
+    const eightDaysAgo = new Date(FIXED_NOW.getTime() - 8 * 24 * 60 * 60 * 1000);
+    mockedFindMany.mockResolvedValue([deviceRow({ lastCheckIn: eightDaysAgo })]);
+    const res = await GET();
+    const body = await res.json();
+    expect(body.data[0].complianceStatus).toBe('stale');
+    expect(body.data[0].daysSinceLastCheckIn).toBe(8);
+  });
+
+  it('marks a device with null lastCheckIn as stale', async () => {
+    mockedFindMany.mockResolvedValue([deviceRow({ lastCheckIn: null })]);
+    const res = await GET();
+    const body = await res.json();
+    expect(body.data[0].complianceStatus).toBe('stale');
+    expect(body.data[0].daysSinceLastCheckIn).toBeNull();
+  });
+});
diff --git a/apps/app/src/app/api/people/agent-devices/route.ts b/apps/app/src/app/api/people/agent-devices/route.ts
index afb7341576..682840fd61 100644
--- a/apps/app/src/app/api/people/agent-devices/route.ts
+++ b/apps/app/src/app/api/people/agent-devices/route.ts
@@ -2,6 +2,10 @@ import { auth } from '@/utils/auth';
 import { db } from '@db/server';
 import { headers } from 'next/headers';
 import { NextResponse } from 'next/server';
+import {
+  daysSinceCheckIn,
+  getDeviceComplianceStatus,
+} from '@trycompai/utils/devices';
 import type { CheckDetails, DeviceWithChecks } from '@/app/(app)/[orgId]/people/devices/types';
 
 export async function GET() {
@@ -30,30 +34,38 @@ export async function GET() {
     orderBy: { installedAt: 'desc' },
   });
 
-  const data: DeviceWithChecks[] = devices.map((device) => ({
-    id: device.id,
-    name: device.name,
-    hostname: device.hostname,
-    platform: device.platform as 'macos' | 'windows' | 'linux',
-    osVersion: device.osVersion,
-    serialNumber: device.serialNumber,
-    hardwareModel: device.hardwareModel,
-    isCompliant: device.isCompliant,
-    diskEncryptionEnabled: device.diskEncryptionEnabled,
-    antivirusEnabled: device.antivirusEnabled,
-    passwordPolicySet: device.passwordPolicySet,
-    screenLockEnabled: device.screenLockEnabled,
-    checkDetails: (device.checkDetails as CheckDetails) ?? null,
-    lastCheckIn: device.lastCheckIn?.toISOString() ?? null,
-    agentVersion: device.agentVersion,
-    installedAt: device.installedAt.toISOString(),
-    memberId: device.memberId,
-    user: {
-      name: device.member.user.name,
-      email: device.member.user.email,
-    },
-    source: 'device_agent' as const,
-  }));
+  const data: DeviceWithChecks[] = devices.map((device) => {
+    const complianceStatus = getDeviceComplianceStatus({
+      isCompliant: device.isCompliant,
+      lastCheckIn: device.lastCheckIn,
+    });
+    return {
+      id: device.id,
+      name: device.name,
+      hostname: device.hostname,
+      platform: device.platform as 'macos' | 'windows' | 'linux',
+      osVersion: device.osVersion,
+      serialNumber: device.serialNumber,
+      hardwareModel: device.hardwareModel,
+      isCompliant: device.isCompliant,
+      diskEncryptionEnabled: device.diskEncryptionEnabled,
+      antivirusEnabled: device.antivirusEnabled,
+      passwordPolicySet: device.passwordPolicySet,
+      screenLockEnabled: device.screenLockEnabled,
+      checkDetails: (device.checkDetails as CheckDetails) ?? null,
+      lastCheckIn: device.lastCheckIn?.toISOString() ?? null,
+      agentVersion: device.agentVersion,
+      installedAt: device.installedAt.toISOString(),
+      memberId: device.memberId,
+      user: {
+        name: device.member.user.name,
+        email: device.member.user.email,
+      },
+      source: 'device_agent' as const,
+      complianceStatus,
+      daysSinceLastCheckIn: daysSinceCheckIn(device.lastCheckIn),
+    };
+  });
 
   return NextResponse.json({ data });
 }
diff --git a/apps/app/src/app/posthog.ts b/apps/app/src/app/posthog.ts
index d66bac14ce..1378f7fbcb 100644
--- a/apps/app/src/app/posthog.ts
+++ b/apps/app/src/app/posthog.ts
@@ -46,10 +46,15 @@ export async function identify(distinctId: string, properties?: Properties) {
   });
 }
 
-export async function getFeatureFlags(distinctId: string) {
+export async function getFeatureFlags(
+  distinctId: string,
+  options?: { groups?: Record<string, string> },
+) {
   const client = await getPostHogClient();
   if (!client) return {};
 
-  const flags = await client.getAllFlags(distinctId);
+  const flags = await client.getAllFlags(distinctId, {
+    groups: options?.groups,
+  });
   return flags;
 }
diff --git a/apps/app/src/hooks/use-admin-feature-flags.ts b/apps/app/src/hooks/use-admin-feature-flags.ts
new file mode 100644
index 0000000000..402a3cbc32
--- /dev/null
+++ b/apps/app/src/hooks/use-admin-feature-flags.ts
@@ -0,0 +1,60 @@
+'use client';
+
+import useSWR from 'swr';
+import { apiClient } from '@/lib/api-client';
+
+export interface AdminOrgFeatureFlag {
+  key: string;
+  name: string;
+  description: string;
+  active: boolean;
+  enabled: boolean;
+  createdAt: string | null;
+}
+
+interface ListResponse {
+  data: AdminOrgFeatureFlag[];
+}
+
+export const adminOrgFeatureFlagsKey = (orgId: string) =>
+  ['/v1/admin/organizations', orgId, 'feature-flags'] as const;
+
+export function useAdminOrgFeatureFlags(orgId: string | null) {
+  const { data, error, isLoading, mutate } = useSWR(
+    orgId ? adminOrgFeatureFlagsKey(orgId) : null,
+    async () => {
+      const response = await apiClient.get<ListResponse>(
+        `/v1/admin/organizations/${orgId}/feature-flags`,
+      );
+      if (response.error) throw new Error(response.error);
+      return response.data?.data ?? [];
+    },
+    { revalidateOnFocus: false },
+  );
+
+  const flags = Array.isArray(data) ? data : [];
+
+  return {
+    flags,
+    isLoading: isLoading && !data,
+    error,
+    mutate,
+  };
+}
+
+export async function setAdminOrgFeatureFlag({
+  orgId,
+  flagKey,
+  enabled,
+}: {
+  orgId: string;
+  flagKey: string;
+  enabled: boolean;
+}): Promise<AdminOrgFeatureFlag | null> {
+  const response = await apiClient.patch<{ data: AdminOrgFeatureFlag }>(
+    `/v1/admin/organizations/${orgId}/feature-flags`,
+    { flagKey, enabled },
+  );
+  if (response.error) throw new Error(response.error);
+  return response.data?.data ?? null;
+}
diff --git a/apps/app/src/hooks/use-admin-timelines.ts b/apps/app/src/hooks/use-admin-timelines.ts
new file mode 100644
index 0000000000..170ceb5f01
--- /dev/null
+++ b/apps/app/src/hooks/use-admin-timelines.ts
@@ -0,0 +1,191 @@
+'use client';
+
+import { apiClient } from '@/lib/api-client';
+import useSWR from 'swr';
+
+interface AdminTimelinePhaseTemplate {
+  id: string;
+  name: string;
+  description: string | null;
+  groupLabel?: string | null;
+  defaultDurationWeeks: number;
+  orderIndex: number;
+  completionType:
+    | 'AUTO_TASKS'
+    | 'AUTO_POLICIES'
+    | 'AUTO_PEOPLE'
+    | 'AUTO_FINDINGS'
+    | 'AUTO_UPLOAD'
+    | 'MANUAL';
+  locksTimelineOnComplete: boolean;
+}
+
+interface AdminTimelineTemplate {
+  id: string;
+  frameworkId: string;
+  trackKey?: string;
+  name: string;
+  description: string | null;
+  isDefault: boolean;
+  cycleNumber: number;
+  createdAt: string;
+  updatedAt: string;
+  phases: AdminTimelinePhaseTemplate[];
+  framework?: {
+    id: string;
+    name: string;
+    visible?: boolean;
+  };
+}
+
+interface AdminTimelineTemplatesApiResponse {
+  data: AdminTimelineTemplate[];
+  count: number;
+}
+
+interface AdminOrgTimeline {
+  id: string;
+  organizationId: string;
+  frameworkInstanceId: string;
+  status: 'DRAFT' | 'ACTIVE' | 'PAUSED' | 'COMPLETED';
+  startDate: string;
+  estimatedEndDate: string;
+  lockedAt: string | null;
+  lockedById: string | null;
+  unlockedAt: string | null;
+  unlockedById: string | null;
+  unlockReason: string | null;
+  completedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+  phases: {
+    id: string;
+    name: string;
+    description: string | null;
+    groupLabel?: string | null;
+    completionType:
+      | 'AUTO_TASKS'
+      | 'AUTO_POLICIES'
+      | 'AUTO_PEOPLE'
+      | 'AUTO_FINDINGS'
+      | 'AUTO_UPLOAD'
+      | 'MANUAL';
+    status: 'PENDING' | 'IN_PROGRESS' | 'COMPLETED';
+    durationWeeks: number;
+    orderIndex: number;
+    startDate: string | null;
+    endDate: string | null;
+    completedAt: string | null;
+    locksTimelineOnComplete: boolean;
+    regressedAt?: string | null;
+  }[];
+  frameworkInstance?: {
+    id: string;
+    framework: {
+      id: string;
+      name: string;
+    };
+  };
+  template?: {
+    id: string;
+    name: string;
+  };
+}
+
+interface AdminOrgTimelinesApiResponse {
+  data: AdminOrgTimeline[];
+  count: number;
+}
+
+export const adminTimelineTemplatesKey = () =>
+  ['/v1/admin/timeline-templates'] as const;
+
+export const adminTimelineTemplateKey = (id: string) =>
+  ['/v1/admin/timeline-templates', id] as const;
+
+export const adminOrgTimelinesKey = (orgId: string) =>
+  ['/v1/admin/organizations', orgId, 'timelines'] as const;
+
+export function useAdminTimelineTemplates() {
+  const { data, error, isLoading, mutate } = useSWR(
+    adminTimelineTemplatesKey(),
+    async () => {
+      const response =
+        await apiClient.get<AdminTimelineTemplatesApiResponse>(
+          '/v1/admin/timeline-templates',
+        );
+      if (response.error) throw new Error(response.error);
+      if (!response.data?.data) return [];
+      return response.data.data;
+    },
+    {
+      revalidateOnFocus: false,
+    },
+  );
+
+  const templates = Array.isArray(data) ? data : [];
+
+  return {
+    templates,
+    isLoading: isLoading && !data,
+    error,
+    mutate,
+  };
+}
+
+export function useAdminTimelineTemplate(templateId: string | null) {
+  const { data, error, isLoading, mutate } = useSWR(
+    templateId ? adminTimelineTemplateKey(templateId) : null,
+    async () => {
+      const response = await apiClient.get<AdminTimelineTemplate>(
+        `/v1/admin/timeline-templates/${templateId}`,
+      );
+      if (response.error) throw new Error(response.error);
+      if (!response.data) return null;
+      return response.data;
+    },
+    {
+      revalidateOnFocus: false,
+    },
+  );
+
+  return {
+    template: data ?? null,
+    isLoading: isLoading && !data,
+    error,
+    mutate,
+  };
+}
+
+export function useAdminOrgTimelines(orgId: string | null) {
+  const { data, error, isLoading, mutate } = useSWR(
+    orgId ? adminOrgTimelinesKey(orgId) : null,
+    async () => {
+      const response =
+        await apiClient.get<AdminOrgTimelinesApiResponse>(
+          `/v1/admin/organizations/${orgId}/timelines`,
+        );
+      if (response.error) throw new Error(response.error);
+      if (!response.data?.data) return [];
+      return response.data.data;
+    },
+    {
+      revalidateOnFocus: false,
+    },
+  );
+
+  const timelines = Array.isArray(data) ? data : [];
+
+  return {
+    timelines,
+    isLoading: isLoading && !data,
+    error,
+    mutate,
+  };
+}
+
+export type {
+  AdminTimelineTemplate,
+  AdminTimelinePhaseTemplate,
+  AdminOrgTimeline,
+};
diff --git a/apps/app/src/hooks/use-timelines.ts b/apps/app/src/hooks/use-timelines.ts
new file mode 100644
index 0000000000..b6ff2b97cd
--- /dev/null
+++ b/apps/app/src/hooks/use-timelines.ts
@@ -0,0 +1,134 @@
+'use client';
+
+import { apiClient } from '@/lib/api-client';
+import useSWR from 'swr';
+
+interface TimelinePhase {
+  id: string;
+  name: string;
+  description: string | null;
+  groupLabel?: string | null;
+  status: 'PENDING' | 'IN_PROGRESS' | 'COMPLETED';
+  durationWeeks: number;
+  orderIndex: number;
+  startDate: string | null;
+  endDate: string | null;
+  completedAt: string | null;
+  completionType:
+    | 'AUTO_TASKS'
+    | 'AUTO_POLICIES'
+    | 'AUTO_PEOPLE'
+    | 'AUTO_FINDINGS'
+    | 'AUTO_UPLOAD'
+    | 'MANUAL';
+  completionPercent?: number;
+  readyForReview: boolean;
+  readyForReviewAt: string | null;
+}
+
+interface Timeline {
+  id: string;
+  organizationId: string;
+  frameworkInstanceId: string;
+  templateId: string;
+  cycleNumber: number;
+  status: 'DRAFT' | 'ACTIVE' | 'PAUSED' | 'COMPLETED';
+  startDate: string | null;
+  pausedAt: string | null;
+  completedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+  phases: TimelinePhase[];
+  frameworkInstance?: {
+    id: string;
+    framework: {
+      id: string;
+      name: string;
+    };
+  };
+  template?: {
+    id: string;
+    name: string;
+    cycleNumber: number;
+  };
+}
+
+interface TimelinesApiResponse {
+  data: Timeline[];
+  count: number;
+}
+
+export const timelinesKey = () => ['/v1/timelines'] as const;
+export const timelineKey = (id: string) => ['/v1/timelines', id] as const;
+
+interface UseTimelinesOptions {
+  initialData?: Timeline[];
+}
+
+export function useTimelines(options?: UseTimelinesOptions) {
+  const { initialData } = options ?? {};
+
+  const { data, error, isLoading, mutate } = useSWR(
+    timelinesKey(),
+    async () => {
+      const response =
+        await apiClient.get<TimelinesApiResponse>('/v1/timelines');
+      if (response.error) throw new Error(response.error);
+      if (!response.data?.data) return [];
+      return response.data.data;
+    },
+    {
+      fallbackData: initialData,
+      revalidateOnMount: !initialData,
+      revalidateOnFocus: false,
+    },
+  );
+
+  const timelines = Array.isArray(data) ? data : [];
+
+  return {
+    timelines,
+    isLoading: isLoading && !data,
+    error,
+    mutate,
+  };
+}
+
+export function useTimeline(id: string | null) {
+  const { data, error, isLoading, mutate } = useSWR(
+    id ? timelineKey(id) : null,
+    async () => {
+      const response = await apiClient.get<Timeline>(
+        `/v1/timelines/${id}`,
+      );
+      if (response.error) throw new Error(response.error);
+      return response.data ?? null;
+    },
+    {
+      revalidateOnFocus: false,
+    },
+  );
+
+  return {
+    timeline: data ?? null,
+    isLoading: isLoading && !data,
+    error,
+    mutate,
+  };
+}
+
+export async function markPhaseReadyForReview({
+  timelineId,
+  phaseId,
+}: {
+  timelineId: string;
+  phaseId: string;
+}) {
+  const response = await apiClient.post(
+    `/v1/timelines/${timelineId}/phases/${phaseId}/ready`,
+  );
+  if (response.error) throw new Error(response.error);
+  return response.data;
+}
+
+export type { Timeline, TimelinePhase };
diff --git a/apps/app/src/trigger/tasks/device/flag-stale-devices.test.ts b/apps/app/src/trigger/tasks/device/flag-stale-devices.test.ts
new file mode 100644
index 0000000000..da68c3f66f
--- /dev/null
+++ b/apps/app/src/trigger/tasks/device/flag-stale-devices.test.ts
@@ -0,0 +1,101 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@db/server', () => ({
+  db: {
+    device: {
+      updateMany: vi.fn(),
+    },
+  },
+}));
+
+vi.mock('@trigger.dev/sdk', () => ({
+  logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+  schedules: {
+    task: (config: { run: (payload: unknown) => Promise<unknown> }) => config,
+  },
+}));
+
+import { db } from '@db/server';
+import { flagStaleDevices } from './flag-stale-devices';
+
+const FIXED_NOW = new Date('2026-04-17T12:00:00.000Z');
+
+const task = flagStaleDevices as unknown as {
+  run: (payload: unknown) => Promise<{
+    success: boolean;
+    flaggedCount: number;
+    threshold: Date;
+    error?: string;
+  }>;
+};
+
+const mockUpdateMany = vi.mocked(
+  (db as unknown as { device: { updateMany: ReturnType<typeof vi.fn> } }).device.updateMany,
+);
+
+beforeAll(() => {
+  vi.useFakeTimers();
+  vi.setSystemTime(FIXED_NOW);
+});
+
+afterAll(() => {
+  vi.useRealTimers();
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('flagStaleDevices', () => {
+  it('flips compliant devices older than 7 days to isCompliant = false', async () => {
+    mockUpdateMany.mockResolvedValue({ count: 3 });
+
+    const result = await task.run({});
+
+    expect(mockUpdateMany).toHaveBeenCalledTimes(1);
+    const call = mockUpdateMany.mock.calls[0][0] as {
+      where: {
+        isCompliant: boolean;
+        OR: Array<{ lastCheckIn: null | { lt: Date } }>;
+      };
+      data: { isCompliant: boolean };
+    };
+
+    expect(call.where.isCompliant).toBe(true);
+    expect(call.data).toEqual({ isCompliant: false });
+
+    // Threshold is 7 days before FIXED_NOW.
+    const expectedThreshold = new Date(FIXED_NOW.getTime() - 7 * 24 * 60 * 60 * 1000);
+    const ltClause = call.where.OR.find((c) => c.lastCheckIn && 'lt' in c.lastCheckIn);
+    expect(ltClause).toBeDefined();
+    expect((ltClause!.lastCheckIn as { lt: Date }).lt.toISOString()).toBe(
+      expectedThreshold.toISOString(),
+    );
+
+    // Null-lastCheckIn clause is also present.
+    const nullClause = call.where.OR.find((c) => c.lastCheckIn === null);
+    expect(nullClause).toBeDefined();
+
+    expect(result.success).toBe(true);
+    expect(result.flaggedCount).toBe(3);
+  });
+
+  it('reports zero when nothing matches', async () => {
+    mockUpdateMany.mockResolvedValue({ count: 0 });
+
+    const result = await task.run({});
+
+    expect(result.success).toBe(true);
+    expect(result.flaggedCount).toBe(0);
+  });
+
+  it('returns success: false when the update throws', async () => {
+    mockUpdateMany.mockRejectedValue(new Error('db down'));
+
+    const result = await task.run({});
+
+    expect(result.success).toBe(false);
+    expect(result.flaggedCount).toBe(0);
+    expect(result.error).toBe('db down');
+  });
+});
diff --git a/apps/app/src/trigger/tasks/device/flag-stale-devices.ts b/apps/app/src/trigger/tasks/device/flag-stale-devices.ts
new file mode 100644
index 0000000000..a37b062b38
--- /dev/null
+++ b/apps/app/src/trigger/tasks/device/flag-stale-devices.ts
@@ -0,0 +1,51 @@
+import { db } from '@db/server';
+import { logger, schedules } from '@trigger.dev/sdk';
+import { STALE_DEVICE_THRESHOLD_DAYS } from '@trycompai/utils/devices';
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+export const flagStaleDevices = schedules.task({
+  id: 'flag-stale-devices',
+  cron: '0 6 * * *', // Daily at 06:00 UTC (~01:00 US/Eastern)
+  maxDuration: 60 * 5, // 5 minutes (trigger.dev expects seconds)
+  run: async (): Promise<{
+    success: boolean;
+    flaggedCount: number;
+    threshold: Date;
+    error?: string;
+  }> => {
+    const threshold = new Date(
+      Date.now() - STALE_DEVICE_THRESHOLD_DAYS * MS_PER_DAY,
+    );
+
+    try {
+      const result = await db.device.updateMany({
+        where: {
+          isCompliant: true,
+          OR: [{ lastCheckIn: null }, { lastCheckIn: { lt: threshold } }],
+        },
+        data: { isCompliant: false },
+      });
+
+      logger.info(
+        `Flagged ${result.count} stale device(s) as non-compliant (threshold ${threshold.toISOString()})`,
+      );
+
+      return {
+        success: true,
+        flaggedCount: result.count,
+        threshold,
+      };
+    } catch (error) {
+      logger.error('flag-stale-devices failed', {
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return {
+        success: false,
+        flaggedCount: 0,
+        threshold,
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  },
+});
diff --git a/bun.lock b/bun.lock
index f70f726eab..d3c4f52d4d 100644
--- a/bun.lock
+++ b/bun.lock
@@ -148,6 +148,7 @@
         "@trycompai/db": "workspace:*",
         "@trycompai/email": "workspace:*",
         "@trycompai/integration-platform": "workspace:*",
+        "@trycompai/utils": "workspace:*",
         "@upstash/ratelimit": "^2.0.8",
         "@upstash/redis": "^1.34.2",
         "@upstash/vector": "^1.2.2",
@@ -169,6 +170,7 @@
         "nanoid": "^5.1.6",
         "pdf-lib": "^1.17.1",
         "playwright-core": "^1.57.0",
+        "posthog-node": "^5.29.2",
         "prisma": "7.6.0",
         "react": "^19.1.1",
         "react-dom": "^19.1.0",
@@ -7624,6 +7626,8 @@
 
     "@trycompai/api/better-auth": ["better-auth@1.5.5", "", { "dependencies": { "@better-auth/core": "1.5.5", "@better-auth/drizzle-adapter": "1.5.5", "@better-auth/kysely-adapter": "1.5.5", "@better-auth/memory-adapter": "1.5.5", "@better-auth/mongo-adapter": "1.5.5", "@better-auth/prisma-adapter": "1.5.5", "@better-auth/telemetry": "1.5.5", "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.2", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.11", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": ">=0.41.0", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-GpVPaV1eqr3mOovKfghJXXk6QvlcVeFbS3z+n+FPDid5rK/2PchnDtiaVCzWyXA9jH2KkirOfl+JhAUvnja0Eg=="],
 
+    "@trycompai/api/posthog-node": ["posthog-node@5.29.2", "", { "dependencies": { "@posthog/core": "1.25.2" }, "peerDependencies": { "rxjs": "^7.0.0" }, "optionalPeers": ["rxjs"] }, "sha512-rI7kkF0XqDc0G1qjx+Hb4iuY9NAlL+XQNoGOpnEpRNTUcXvjY6WlsRGZ9m2whgc39emrrYdszi/YT8wZkr2xsg=="],
+
     "@trycompai/app/@ai-sdk/anthropic": ["@ai-sdk/anthropic@3.0.58", "", { "dependencies": { "@ai-sdk/provider": "3.0.8", "@ai-sdk/provider-utils": "4.0.19" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-/53SACgmVukO4bkms4dpxpRlYhW8Ct6QZRe6sj1Pi5H00hYhxIrqfiLbZBGxkdRvjsBQeP/4TVGsXgH5rQeb8Q=="],
 
     "@trycompai/app/@ai-sdk/groq": ["@ai-sdk/groq@3.0.29", "", { "dependencies": { "@ai-sdk/provider": "3.0.8", "@ai-sdk/provider-utils": "4.0.19" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-I/tUoHuOvGXbIr1dJ0CLRLA7W0UPDMtrYT5mgeb3O+P+6I5BAm/7riPwr22Xw5YTzpwQxcoDQlIczOU9XDXBpA=="],
@@ -7636,6 +7640,8 @@
 
     "@trycompai/app/better-auth": ["better-auth@1.5.5", "", { "dependencies": { "@better-auth/core": "1.5.5", "@better-auth/drizzle-adapter": "1.5.5", "@better-auth/kysely-adapter": "1.5.5", "@better-auth/memory-adapter": "1.5.5", "@better-auth/mongo-adapter": "1.5.5", "@better-auth/prisma-adapter": "1.5.5", "@better-auth/telemetry": "1.5.5", "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.2", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.11", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": ">=0.41.0", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-GpVPaV1eqr3mOovKfghJXXk6QvlcVeFbS3z+n+FPDid5rK/2PchnDtiaVCzWyXA9jH2KkirOfl+JhAUvnja0Eg=="],
 
+    "@trycompai/app/posthog-node": ["posthog-node@5.29.2", "", { "dependencies": { "@posthog/core": "1.25.2" }, "peerDependencies": { "rxjs": "^7.0.0" }, "optionalPeers": ["rxjs"] }, "sha512-rI7kkF0XqDc0G1qjx+Hb4iuY9NAlL+XQNoGOpnEpRNTUcXvjY6WlsRGZ9m2whgc39emrrYdszi/YT8wZkr2xsg=="],
+
     "@trycompai/app/resend": ["resend@4.8.0", "", { "dependencies": { "@react-email/render": "1.1.2" } }, "sha512-R8eBOFQDO6dzRTDmaMEdpqrkmgSjPpVXt4nGfWsZdYOet0kqra0xgbvTES6HmCriZEXbmGk3e0DiGIaLFTFSHA=="],
 
     "@trycompai/auth/better-auth": ["better-auth@1.5.5", "", { "dependencies": { "@better-auth/core": "1.5.5", "@better-auth/drizzle-adapter": "1.5.5", "@better-auth/kysely-adapter": "1.5.5", "@better-auth/memory-adapter": "1.5.5", "@better-auth/mongo-adapter": "1.5.5", "@better-auth/prisma-adapter": "1.5.5", "@better-auth/telemetry": "1.5.5", "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.2", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.11", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": ">=0.41.0", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-GpVPaV1eqr3mOovKfghJXXk6QvlcVeFbS3z+n+FPDid5rK/2PchnDtiaVCzWyXA9jH2KkirOfl+JhAUvnja0Eg=="],
@@ -9934,6 +9940,8 @@
 
     "@trycompai/api/better-auth/better-call": ["better-call@1.3.2", "", { "dependencies": { "@better-auth/utils": "^0.3.1", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw=="],
 
+    "@trycompai/api/posthog-node/@posthog/core": ["@posthog/core@1.25.2", "", {}, "sha512-h2FO7ut/BbfwpAXWpwdDHTzQgUo9ibDFEs6ZO+3cI3KPWQt5XwczK1OLAuPprcjm8T/jl0SH8jSFo5XdU4RbTg=="],
+
     "@trycompai/app/@ai-sdk/anthropic/@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@4.0.19", "", { "dependencies": { "@ai-sdk/provider": "3.0.8", "@standard-schema/spec": "^1.1.0", "eventsource-parser": "^3.0.6" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-3eG55CrSWCu2SXlqq2QCsFjo3+E7+Gmg7i/oRVoSZzIodTuDSfLb3MRje67xE9RFea73Zao7Lm4mADIfUETKGg=="],
 
     "@trycompai/app/@ai-sdk/groq/@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@4.0.19", "", { "dependencies": { "@ai-sdk/provider": "3.0.8", "@standard-schema/spec": "^1.1.0", "eventsource-parser": "^3.0.6" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-3eG55CrSWCu2SXlqq2QCsFjo3+E7+Gmg7i/oRVoSZzIodTuDSfLb3MRje67xE9RFea73Zao7Lm4mADIfUETKGg=="],
@@ -9960,6 +9968,8 @@
 
     "@trycompai/app/better-auth/better-call": ["better-call@1.3.2", "", { "dependencies": { "@better-auth/utils": "^0.3.1", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw=="],
 
+    "@trycompai/app/posthog-node/@posthog/core": ["@posthog/core@1.25.2", "", {}, "sha512-h2FO7ut/BbfwpAXWpwdDHTzQgUo9ibDFEs6ZO+3cI3KPWQt5XwczK1OLAuPprcjm8T/jl0SH8jSFo5XdU4RbTg=="],
+
     "@trycompai/app/resend/@react-email/render": ["@react-email/render@1.1.2", "", { "dependencies": { "html-to-text": "^9.0.5", "prettier": "^3.5.3", "react-promise-suspense": "^0.3.4" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-RnRehYN3v9gVlNMehHPHhyp2RQo7+pSkHDtXPvg3s0GbzM9SQMW4Qrf8GRNvtpLC4gsI+Wt0VatNRUFqjvevbw=="],
 
     "@trycompai/auth/better-auth/@better-auth/core": ["@better-auth/core@1.5.5", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "better-call": "1.3.2", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types"] }, "sha512-1oR/2jAp821Dcf67kQYHUoyNcdc1TcShfw4QMK0YTVntuRES5mUOyvEJql5T6eIuLfaqaN4LOF78l0FtF66HXA=="],
diff --git a/integrations-catalog/README.md b/integrations-catalog/README.md
new file mode 100644
index 0000000000..de84c3afac
--- /dev/null
+++ b/integrations-catalog/README.md
@@ -0,0 +1,640 @@
+# CompAI Integrations Catalog
+
+Public catalog of all compliance integrations available in the [CompAI](https://trycomp.ai) platform.
+
+**540 integrations** across 9 categories.
+
+> Last updated: 2026-04-20
+
+## What's in this catalog
+
+Each `integrations/<slug>.json` file contains the public-facing metadata for one integration:
+
+- **Vendor info:** name, slug, category, description, docs URL, base URL
+- **Authentication:** auth type + customer-facing setup instructions + credential field labels
+- **Checks:** names + descriptions + default severity of every compliance check we run
+- **Capabilities:** employee sync support, multi-connection support
+
+## What's NOT in this catalog
+
+Implementation details are intentionally excluded:
+
+- Check DSL (endpoint paths, request bodies, response parsing, aggregation logic)
+- Sync definition (how we extract employees)
+- Internal database IDs
+- Credential field format hints or placeholders
+- Vendor logos
+
+## How to read a definition
+
+```bash
+curl https://raw.githubusercontent.com/trycompai/comp/main/integrations-catalog/integrations/axonius.json | jq
+```
+
+## Summary by category
+
+- **Security** — 120 integrations
+- **Productivity** — 111 integrations
+- **HR & People** — 61 integrations
+- **Cloud** — 53 integrations
+- **Development** — 52 integrations
+- **Monitoring** — 48 integrations
+- **Communication** — 46 integrations
+- **Infrastructure** — 29 integrations
+- **Identity & Access** — 20 integrations
+
+## Full catalog
+
+### Cloud (53)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [Airbyte](integrations/airbyte.json) | `airbyte` | api_key | 2 |  |
+| [Aiven](integrations/aiven.json) | `aiven` | api_key | 2 |  |
+| [Anthropic](integrations/anthropic.json) | `anthropic` | api_key | 2 |  |
+| [Box](integrations/box.json) | `box` | oauth2 | 2 |  |
+| [Brex](integrations/brex.json) | `brex` | api_key | 1 |  |
+| [Civo](integrations/civo.json) | `civo` | api_key | 2 |  |
+| [ClickHouse Cloud](integrations/clickhouse.json) | `clickhouse` | api_key | 2 |  |
+| [Cloudinary](integrations/cloudinary.json) | `cloudinary` | custom | 2 |  |
+| [CockroachDB](integrations/cockroachdb.json) | `cockroachdb` | api_key | 2 |  |
+| [Cohere](integrations/cohere.json) | `cohere` | api_key | 2 |  |
+| [Convex](integrations/convex.json) | `convex` | custom | 3 |  |
+| [Databricks](integrations/databricks.json) | `databricks` | api_key | 2 |  |
+| [Datadog](integrations/datadog.json) | `datadog` | custom | 3 |  |
+| [dbt Cloud](integrations/dbt-cloud.json) | `dbt-cloud` | api_key | 2 |  |
+| [Deepgram](integrations/deepgram.json) | `deepgram` | api_key | 2 |  |
+| [DigitalOcean](integrations/digitalocean.json) | `digitalocean` | api_key | 2 |  |
+| [Doppler](integrations/doppler.json) | `doppler` | api_key | 2 |  |
+| [Egnyte](integrations/egnyte.json) | `egnyte` | custom | 3 | ✓ |
+| [Elastic Cloud](integrations/elastic-cloud.json) | `elastic-cloud` | custom | 2 |  |
+| [Firebase](integrations/firebase.json) | `firebase` | oauth2 | 3 |  |
+| [Fireworks AI](integrations/fireworks-ai.json) | `fireworks-ai` | api_key | 2 |  |
+| [Fivetran](integrations/fivetran.json) | `fivetran` | custom | 2 |  |
+| [Fly.io](integrations/fly.json) | `fly` | api_key | 2 |  |
+| [Google Cloud](integrations/google-cloud.json) | `google-cloud` | oauth2 | 2 |  |
+| [Groq](integrations/groq.json) | `groq` | api_key | 2 |  |
+| [Heroku](integrations/heroku.json) | `heroku` | custom | 2 |  |
+| [Hetzner Cloud](integrations/hetzner.json) | `hetzner` | api_key | 2 |  |
+| [Hugging Face](integrations/huggingface.json) | `huggingface` | api_key | 2 |  |
+| [IONOS Cloud](integrations/ionos.json) | `ionos` | custom | 2 |  |
+| [Linode](integrations/linode.json) | `linode` | api_key | 2 |  |
+| [Mistral AI](integrations/mistral.json) | `mistral` | api_key | 2 |  |
+| [MongoDB Atlas](integrations/mongodb-atlas.json) | `mongodb-atlas` | custom | 5 |  |
+| [MotherDuck](integrations/motherduck.json) | `motherduck` | api_key | 2 |  |
+| [Neon](integrations/neon.json) | `neon` | api_key | 2 |  |
+| [Netlify](integrations/netlify.json) | `netlify` | api_key | 2 |  |
+| [Oracle Cloud Infrastructure](integrations/oracle-cloud.json) | `oracle-cloud` | custom | 3 |  |
+| [Quave Cloud](integrations/quave-cloud.json) | `quave-cloud` | custom | 4 |  |
+| [Redis Cloud](integrations/redis-cloud.json) | `redis-cloud` | custom | 2 |  |
+| [Render](integrations/render.json) | `render` | api_key | 2 |  |
+| [Roboflow](integrations/roboflow.json) | `roboflow` | api_key | 2 |  |
+| [Scaleway](integrations/scaleway.json) | `scaleway` | api_key | 2 |  |
+| [Segment](integrations/segment.json) | `segment` | api_key | 2 |  |
+| [Snowflake](integrations/snowflake.json) | `snowflake` | custom | 2 |  |
+| [Supabase](integrations/supabase.json) | `supabase` | api_key | 10 |  |
+| [Together AI](integrations/together-ai.json) | `together-ai` | api_key | 2 |  |
+| [Turso](integrations/turso.json) | `turso` | api_key | 2 |  |
+| [UpCloud](integrations/upcloud.json) | `upcloud` | basic | 2 |  |
+| [Upstash](integrations/upstash.json) | `upstash` | custom | 2 |  |
+| [Vercel](integrations/vercel.json) | `vercel` | api_key | 2 |  |
+| [Vultr](integrations/vultr.json) | `vultr` | api_key | 2 |  |
+| [Webflow](integrations/webflow.json) | `webflow` | api_key | 2 |  |
+| [Weights & Biases](integrations/wandb.json) | `wandb` | api_key | 2 |  |
+| [Xata](integrations/xata.json) | `xata` | api_key | 2 |  |
+
+### Communication (46)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [ActiveCampaign](integrations/activecampaign.json) | `activecampaign` | custom | 2 |  |
+| [Aircall](integrations/aircall.json) | `aircall` | basic | 3 | ✓ |
+| [Barracuda Email Gateway Defense](integrations/barracuda-email-gateway-defense.json) | `barracuda-email-gateway-defense` | oauth2 | 3 |  |
+| [beehiiv](integrations/beehiiv.json) | `beehiiv` | api_key | 2 |  |
+| [Bird](integrations/bird.json) | `bird` | custom | 2 |  |
+| [Braze](integrations/braze.json) | `braze` | custom | 2 |  |
+| [Brevo](integrations/brevo.json) | `brevo` | api_key | 2 |  |
+| [Courier](integrations/courier.json) | `courier` | api_key | 2 |  |
+| [Customer.io](integrations/customer-io.json) | `customer-io` | api_key | 2 |  |
+| [Daily](integrations/daily-co.json) | `daily-co` | custom | 2 |  |
+| [Dialpad](integrations/dialpad.json) | `dialpad` | api_key | 3 | ✓ |
+| [Discord](integrations/discord.json) | `discord` | custom | 2 |  |
+| [Dixa](integrations/dixa.json) | `dixa` | custom | 2 |  |
+| [Drift](integrations/drift.json) | `drift` | custom | 1 |  |
+| [Drip](integrations/drip.json) | `drip` | custom | 2 |  |
+| [Front](integrations/front.json) | `front` | api_key | 2 |  |
+| [Gorgias](integrations/gorgias.json) | `gorgias` | custom | 2 |  |
+| [Help Scout](integrations/helpscout.json) | `helpscout` | api_key | 2 |  |
+| [Hunter](integrations/hunter.json) | `hunter` | custom | 2 |  |
+| [Intercom](integrations/intercom.json) | `intercom` | custom | 2 |  |
+| [Iterable](integrations/iterable.json) | `iterable` | custom | 2 |  |
+| [Kit (ConvertKit)](integrations/convertkit.json) | `convertkit` | api_key | 2 |  |
+| [Knock](integrations/knock.json) | `knock` | api_key | 2 |  |
+| [Kustomer](integrations/kustomer.json) | `kustomer` | custom | 1 |  |
+| [Loops](integrations/loops.json) | `loops` | api_key | 2 |  |
+| [Mattermost](integrations/mattermost.json) | `mattermost` | api_key | 2 |  |
+| [MessageBird](integrations/messagebird.json) | `messagebird` | custom | 2 |  |
+| [Microsoft Teams](integrations/microsoft-teams.json) | `microsoft-teams` | custom | 2 |  |
+| [Mimecast](integrations/mimecast.json) | `mimecast` | custom | 4 |  |
+| [Novu](integrations/novu.json) | `novu` | api_key | 2 |  |
+| [Omnisend](integrations/omnisend.json) | `omnisend` | custom | 2 |  |
+| [OpenPhone](integrations/openphone.json) | `openphone` | api_key | 2 |  |
+| [Plain](integrations/plain.json) | `plain` | api_key | 2 |  |
+| [Postmark](integrations/postmark.json) | `postmark` | api_key | 2 |  |
+| [Pylon](integrations/pylon.json) | `pylon` | api_key | 2 |  |
+| [Resend](integrations/resend.json) | `resend` | api_key | 2 |  |
+| [RingCentral](integrations/ringcentral.json) | `ringcentral` | oauth2 | 2 | ✓ |
+| [SendGrid](integrations/sendgrid.json) | `sendgrid` | api_key | 2 |  |
+| [Slack](integrations/slack.json) | `slack` | oauth2 | 2 |  |
+| [TeamSupport](integrations/teamsupport.json) | `teamsupport` | custom | 2 |  |
+| [Telnyx](integrations/telnyx.json) | `telnyx` | custom | 2 |  |
+| [Twilio](integrations/twilio.json) | `twilio` | custom | 2 |  |
+| [Vonage](integrations/vonage.json) | `vonage` | custom | 2 |  |
+| [Webex](integrations/webex.json) | `webex` | api_key | 2 |  |
+| [Wistia](integrations/wistia.json) | `wistia` | custom | 2 |  |
+| [Zoom](integrations/zoom.json) | `zoom` | oauth2 | 2 |  |
+
+### Development (52)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [Algolia](integrations/algolia.json) | `algolia` | custom | 2 |  |
+| [Azure DevOps](integrations/azure-devops.json) | `azure-devops` | custom | 3 |  |
+| [Baseten](integrations/baseten.json) | `baseten` | custom | 2 |  |
+| [Bitbucket](integrations/bitbucket.json) | `bitbucket` | custom | 2 |  |
+| [BrowserStack](integrations/browserstack.json) | `browserstack` | custom | 2 |  |
+| [Buddy](integrations/buddy.json) | `buddy` | api_key | 2 |  |
+| [Buildkite](integrations/buildkite.json) | `buildkite` | api_key | 2 |  |
+| [Census](integrations/census.json) | `census` | api_key | 2 |  |
+| [CircleCI](integrations/circleci.json) | `circleci` | custom | 2 |  |
+| [Cloudsmith](integrations/cloudsmith.json) | `cloudsmith` | api_key | 2 |  |
+| [Codacy](integrations/codacy.json) | `codacy` | custom | 2 |  |
+| [Codecov](integrations/codecov.json) | `codecov` | api_key | 2 |  |
+| [Codefresh](integrations/codefresh.json) | `codefresh` | api_key | 2 |  |
+| [Docker Hub](integrations/docker-hub.json) | `docker-hub` | custom | 3 |  |
+| [Flagsmith](integrations/flagsmith.json) | `flagsmith` | custom | 2 |  |
+| [GitBook](integrations/gitbook.json) | `gitbook` | api_key | 2 |  |
+| [GitHub](integrations/github.json) | `github` | api_key | 2 |  |
+| [GitHub Copilot](integrations/github-copilot.json) | `github-copilot` | oauth2 | 3 |  |
+| [GitLab](integrations/gitlab.json) | `gitlab` | custom | 3 |  |
+| [Harness](integrations/harness.json) | `harness` | api_key | 2 |  |
+| [Hightouch](integrations/hightouch.json) | `hightouch` | api_key | 3 |  |
+| [Inngest](integrations/inngest.json) | `inngest` | api_key | 2 |  |
+| [Jenkins](integrations/jenkins.json) | `jenkins` | basic | 2 |  |
+| [JFrog Artifactory](integrations/jfrog.json) | `jfrog` | custom | 2 |  |
+| [Jira](integrations/jira.json) | `jira` | custom | 2 |  |
+| [LambdaTest](integrations/lambdatest.json) | `lambdatest` | custom | 2 |  |
+| [LaunchDarkly](integrations/launchdarkly.json) | `launchdarkly` | api_key | 2 |  |
+| [Linear](integrations/linear.json) | `linear` | custom | 2 |  |
+| [Liveblocks](integrations/liveblocks.json) | `liveblocks` | api_key | 2 |  |
+| [Mabl](integrations/mabl.json) | `mabl` | custom | 2 |  |
+| [Mintlify](integrations/mintlify.json) | `mintlify` | custom | 2 |  |
+| [OpenAI](integrations/openai.json) | `openai` | custom | 2 |  |
+| [Optimizely](integrations/optimizely.json) | `optimizely` | api_key | 2 |  |
+| [Pipedream](integrations/pipedream.json) | `pipedream` | api_key | 2 |  |
+| [Port](integrations/port-io.json) | `port-io` | api_key | 2 |  |
+| [Postman](integrations/postman.json) | `postman` | api_key | 2 |  |
+| [Prefect](integrations/prefect.json) | `prefect` | api_key | 2 |  |
+| [Qase](integrations/qase.json) | `qase` | api_key | 2 |  |
+| [ReadMe](integrations/readme.json) | `readme` | custom | 2 |  |
+| [Replicate](integrations/replicate.json) | `replicate` | custom | 2 |  |
+| [Shortcut](integrations/shortcut.json) | `shortcut` | api_key | 2 |  |
+| [SonarCloud](integrations/sonarqube-cloud.json) | `sonarqube-cloud` | api_key | 2 |  |
+| [SonarQube Server](integrations/sonarqube-server.json) | `sonarqube-server` | custom | 3 |  |
+| [Sonatype Nexus Repository](integrations/sonatype-nexus.json) | `sonatype-nexus` | custom | 4 |  |
+| [Speakeasy](integrations/speakeasy.json) | `speakeasy` | api_key | 2 |  |
+| [Split](integrations/split.json) | `split` | api_key | 2 |  |
+| [Stitch](integrations/stitch.json) | `stitch` | api_key | 2 |  |
+| [Stoplight](integrations/stoplight.json) | `stoplight` | custom | 2 |  |
+| [TeamCity](integrations/teamcity.json) | `teamcity` | custom | 3 |  |
+| [TestRail](integrations/testrail.json) | `testrail` | custom | 2 |  |
+| [Travis CI](integrations/travis-ci.json) | `travis-ci` | custom | 2 |  |
+| [Trigger.dev](integrations/trigger-dev.json) | `trigger-dev` | custom | 2 |  |
+
+### HR & People (61)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [15Five](integrations/15five.json) | `15five` | api_key | 2 |  |
+| [ADP](integrations/adp.json) | `adp` | custom | 3 | ✓ |
+| [AlexisHR](integrations/alexishr.json) | `alexishr` | api_key | 2 | ✓ |
+| [Ashby](integrations/ashby.json) | `ashby` | custom | 1 |  |
+| [BambooHR](integrations/bamboohr.json) | `bamboohr` | custom | 2 |  |
+| [Bonusly](integrations/bonusly.json) | `bonusly` | custom | 1 |  |
+| [Breathe HR](integrations/breathe-hr.json) | `breathe-hr` | custom | 2 | ✓ |
+| [Ceridian Dayforce](integrations/ceridian-dayforce.json) | `ceridian-dayforce` | custom | 2 | ✓ |
+| [ChartHop](integrations/charthop.json) | `charthop` | custom | 3 | ✓ |
+| [Checkr](integrations/checkr.json) | `checkr` | api_key | 2 |  |
+| [Darwinbox](integrations/darwinbox.json) | `darwinbox` | custom | 3 | ✓ |
+| [Deel](integrations/deel.json) | `deel` | api_key | 2 |  |
+| [Deputy](integrations/deputy.json) | `deputy` | custom | 2 | ✓ |
+| [Employment Hero](integrations/employment-hero.json) | `employment-hero` | custom | 3 | ✓ |
+| [Factorial](integrations/factorial.json) | `factorial` | custom | 2 |  |
+| [Freshteam](integrations/freshteam.json) | `freshteam` | custom | 3 | ✓ |
+| [Greenhouse](integrations/greenhouse.json) | `greenhouse` | api_key | 2 |  |
+| [Gusto](integrations/gusto.json) | `gusto` | oauth2 | 2 |  |
+| [HiBob](integrations/bob.json) | `bob` | basic | 2 | ✓ |
+| [HiBob](integrations/hibob.json) | `hibob` | custom | 2 |  |
+| [HireRight](integrations/hireright.json) | `hireright` | custom | 1 |  |
+| [Humaans](integrations/humaans.json) | `humaans` | custom | 1 |  |
+| [Justworks](integrations/justworks.json) | `justworks` | oauth2 | 2 | ✓ |
+| [Keka](integrations/keka.json) | `keka` | custom | 4 | ✓ |
+| [Kenjo](integrations/kenjo.json) | `kenjo` | api_key | 2 | ✓ |
+| [Kombo](integrations/kombo.json) | `kombo` | custom | 2 |  |
+| [Lattice](integrations/lattice.json) | `lattice` | api_key | 2 |  |
+| [Lever](integrations/lever.json) | `lever` | custom | 1 |  |
+| [Merge](integrations/merge-dev.json) | `merge-dev` | custom | 2 |  |
+| [Namely](integrations/namely.json) | `namely` | custom | 1 |  |
+| [Navan](integrations/navan.json) | `navan` | custom | 1 |  |
+| [Nectar](integrations/nectar-hr.json) | `nectar-hr` | custom | 1 |  |
+| [Oyster HR](integrations/oyster-hr.json) | `oyster-hr` | custom | 1 |  |
+| [Pave](integrations/pave.json) | `pave` | custom | 1 |  |
+| [Paychex](integrations/paychex.json) | `paychex` | custom | 2 |  |
+| [Paycom](integrations/paycom.json) | `paycom` | custom | 2 | ✓ |
+| [Paycor](integrations/paycor.json) | `paycor` | oauth2 | 2 | ✓ |
+| [PayFit](integrations/payfit.json) | `payfit` | custom | 1 |  |
+| [Payhawk](integrations/payhawk.json) | `payhawk` | custom | 1 |  |
+| [Paylocity](integrations/paylocity.json) | `paylocity` | custom | 2 | ✓ |
+| [Personio](integrations/personio.json) | `personio` | api_key | 2 |  |
+| [Pingboard](integrations/pingboard.json) | `pingboard` | custom | 1 |  |
+| [Qonto](integrations/qonto.json) | `qonto` | custom | 1 |  |
+| [Qualtrics](integrations/qualtrics.json) | `qualtrics` | custom | 1 |  |
+| [Remote](integrations/remote.json) | `remote` | api_key | 2 |  |
+| [Rippling](integrations/rippling.json) | `rippling` | api_key | 2 |  |
+| [Sage HR](integrations/sage-hr.json) | `sage-hr` | custom | 2 | ✓ |
+| [SAP SuccessFactors](integrations/sap-successfactors.json) | `sap-successfactors` | custom | 2 | ✓ |
+| [Sterling](integrations/sterling.json) | `sterling` | custom | 1 |  |
+| [SurveyMonkey](integrations/surveymonkey.json) | `surveymonkey` | custom | 2 |  |
+| [SurveySparrow](integrations/surveysparrow.json) | `surveysparrow` | custom | 2 |  |
+| [TalentLMS](integrations/talent-lms.json) | `talent-lms` | custom | 1 |  |
+| [TriNet](integrations/trinet.json) | `trinet` | api_key | 1 |  |
+| [UKG Ready](integrations/ukg-ready.json) | `ukg-ready` | custom | 2 |  |
+| [When I Work](integrations/when-i-work.json) | `when-i-work` | custom | 2 | ✓ |
+| [Workable](integrations/workable.json) | `workable` | custom | 2 | ✓ |
+| [Workday](integrations/workday.json) | `workday` | custom | 2 |  |
+| [WorkRamp](integrations/workramp.json) | `workramp` | custom | 1 |  |
+| [Zelt](integrations/zelt.json) | `zelt` | custom | 1 |  |
+| [Zenefits](integrations/zenefits.json) | `zenefits` | api_key | 1 |  |
+| [Zoho People](integrations/zoho-people.json) | `zoho-people` | custom | 2 | ✓ |
+
+### Identity & Access (20)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [Auth0](integrations/auth0.json) | `auth0` | custom | 3 |  |
+| [Clerk](integrations/clerk.json) | `clerk` | api_key | 2 |  |
+| [ConductorOne](integrations/conductorone.json) | `conductorone` | custom | 5 | ✓ |
+| [CyberArk](integrations/cyberark.json) | `cyberark` | custom | 3 |  |
+| [Descope](integrations/descope.json) | `descope` | custom | 2 |  |
+| [Duo Security](integrations/duo-security.json) | `duo-security` | custom | 2 |  |
+| [Duo Security](integrations/duo.json) | `duo` | custom | 2 |  |
+| [Frontegg](integrations/frontegg.json) | `frontegg` | api_key | 2 |  |
+| [FusionAuth](integrations/fusionauth.json) | `fusionauth` | custom | 4 | ✓ |
+| [JumpCloud](integrations/jumpcloud.json) | `jumpcloud` | custom | 3 |  |
+| [Microsoft Entra ID](integrations/entra-id.json) | `entra-id` | custom | 4 | ✓ |
+| [Okta](integrations/okta.json) | `okta` | custom | 3 |  |
+| [OneLogin](integrations/onelogin.json) | `onelogin` | custom | 2 |  |
+| [Permit.io](integrations/permit-io.json) | `permit-io` | custom | 2 |  |
+| [Persona](integrations/persona.json) | `persona` | api_key | 2 |  |
+| [Ping Identity](integrations/ping-identity.json) | `ping-identity` | custom | 3 |  |
+| [SailPoint IdentityNow](integrations/sailpoint.json) | `sailpoint` | custom | 2 | ✓ |
+| [Saviynt](integrations/saviynt.json) | `saviynt` | custom | 3 | ✓ |
+| [Stytch](integrations/stytch.json) | `stytch` | custom | 2 |  |
+| [WorkOS](integrations/workos.json) | `workos` | api_key | 2 |  |
+
+### Infrastructure (29)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [Acronis Cyber Protect Cloud](integrations/acronis-cyber-protect-cloud.json) | `acronis-cyber-protect-cloud` | custom | 4 |  |
+| [Akamai](integrations/akamai.json) | `akamai` | custom | 3 |  |
+| [Backblaze B2](integrations/backblaze.json) | `backblaze` | custom | 2 |  |
+| [Bunny.net](integrations/bunny-net.json) | `bunny-net` | custom | 2 |  |
+| [Cisco Meraki](integrations/cisco-meraki.json) | `cisco-meraki` | custom | 2 |  |
+| [Cloudflare](integrations/cloudflare.json) | `cloudflare` | custom | 4 |  |
+| [Confluent Cloud](integrations/confluent-cloud.json) | `confluent-cloud` | basic | 4 |  |
+| [Coolify](integrations/coolify.json) | `coolify` | api_key | 2 |  |
+| [Datto](integrations/datto.json) | `datto` | api_key | 2 |  |
+| [Druva](integrations/druva.json) | `druva` | custom | 5 |  |
+| [env0](integrations/env0.json) | `env0` | api_key | 2 |  |
+| [Fastly](integrations/fastly.json) | `fastly` | api_key | 2 |  |
+| [KeyCDN](integrations/keycdn.json) | `keycdn` | custom | 2 |  |
+| [Kong Konnect](integrations/kong.json) | `kong` | api_key | 2 |  |
+| [Koyeb](integrations/koyeb.json) | `koyeb` | api_key | 2 |  |
+| [ngrok](integrations/ngrok.json) | `ngrok` | api_key | 2 |  |
+| [Northflank](integrations/northflank.json) | `northflank` | api_key | 2 |  |
+| [NS1](integrations/ns1.json) | `ns1` | custom | 2 |  |
+| [PlanetScale](integrations/planetscale.json) | `planetscale` | custom | 3 |  |
+| [Pulumi](integrations/pulumi.json) | `pulumi` | api_key | 2 |  |
+| [Pulumi Cloud](integrations/pulumi-cloud.json) | `pulumi-cloud` | api_key | 2 |  |
+| [Qovery](integrations/qovery.json) | `qovery` | api_key | 2 |  |
+| [Railway](integrations/railway.json) | `railway` | custom | 2 |  |
+| [Snipe-IT](integrations/snipeit.json) | `snipeit` | custom | 3 |  |
+| [Tailscale](integrations/tailscale.json) | `tailscale` | api_key | 2 |  |
+| [Teleport](integrations/teleport.json) | `teleport` | api_key | 2 |  |
+| [Terraform Cloud](integrations/terraform-cloud.json) | `terraform-cloud` | custom | 2 |  |
+| [Veeam Backup & Replication](integrations/veeam.json) | `veeam` | custom | 3 |  |
+| [ZeroTier](integrations/zerotier.json) | `zerotier` | custom | 2 |  |
+
+### Monitoring (48)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [Amplitude](integrations/amplitude.json) | `amplitude` | api_key | 2 |  |
+| [Anodot](integrations/anodot.json) | `anodot` | custom | 2 |  |
+| [Auvik](integrations/auvik.json) | `auvik` | basic | 2 |  |
+| [Axiom](integrations/axiom.json) | `axiom` | custom | 2 |  |
+| [Better Stack](integrations/better-uptime.json) | `better-uptime` | api_key | 2 |  |
+| [BetterStack](integrations/betterstack.json) | `betterstack` | api_key | 2 |  |
+| [Bugsnag](integrations/bugsnag.json) | `bugsnag` | api_key | 2 |  |
+| [Checkly](integrations/checkly.json) | `checkly` | api_key | 2 |  |
+| [Coralogix](integrations/coralogix.json) | `coralogix` | custom | 2 |  |
+| [Cronitor](integrations/cronitor.json) | `cronitor` | api_key | 2 |  |
+| [CrowdStrike LogScale](integrations/logscale.json) | `logscale` | custom | 2 |  |
+| [Dynatrace](integrations/dynatrace.json) | `dynatrace` | api_key | 2 |  |
+| [Elastic Cloud](integrations/elastic.json) | `elastic` | custom | 2 |  |
+| [FireHydrant](integrations/firehydrant.json) | `firehydrant` | api_key | 2 |  |
+| [FullStory](integrations/fullstory.json) | `fullstory` | api_key | 2 |  |
+| [Grafana Cloud](integrations/grafana-cloud.json) | `grafana-cloud` | custom | 4 |  |
+| [Hex](integrations/hex.json) | `hex` | api_key | 2 |  |
+| [Highlight](integrations/highlight-io.json) | `highlight-io` | api_key | 2 |  |
+| [Honeybadger](integrations/honeybadger.json) | `honeybadger` | custom | 2 |  |
+| [Honeycomb](integrations/honeycomb.json) | `honeycomb` | api_key | 2 |  |
+| [Incident.io](integrations/incident-io.json) | `incident-io` | api_key | 2 |  |
+| [Instatus](integrations/instatus.json) | `instatus` | custom | 2 |  |
+| [LogRocket](integrations/logrocket.json) | `logrocket` | api_key | 2 |  |
+| [Logz.io](integrations/logzio.json) | `logzio` | api_key | 2 |  |
+| [Lumigo](integrations/lumigo.json) | `lumigo` | custom | 1 |  |
+| [Mezmo](integrations/mezmo.json) | `mezmo` | custom | 2 |  |
+| [Mezmo (LogDNA)](integrations/logdna.json) | `logdna` | api_key | 2 |  |
+| [Mixpanel](integrations/mixpanel.json) | `mixpanel` | custom | 2 |  |
+| [Monte Carlo](integrations/monte-carlo.json) | `monte-carlo` | custom | 2 |  |
+| [New Relic](integrations/new-relic.json) | `new-relic` | custom | 3 |  |
+| [Opsgenie](integrations/opsgenie.json) | `opsgenie` | api_key | 2 |  |
+| [Papertrail](integrations/papertrail.json) | `papertrail` | custom | 2 |  |
+| [Pendo](integrations/pendo.json) | `pendo` | api_key | 2 |  |
+| [Plausible Analytics](integrations/plausible.json) | `plausible` | api_key | 2 |  |
+| [PostHog](integrations/posthog.json) | `posthog` | api_key | 2 |  |
+| [Rollbar](integrations/rollbar.json) | `rollbar` | api_key | 2 |  |
+| [Rootly](integrations/rootly.json) | `rootly` | api_key | 2 |  |
+| [RudderStack](integrations/rudderstack.json) | `rudderstack` | api_key | 2 |  |
+| [Sentry](integrations/sentry.json) | `sentry` | custom | 2 |  |
+| [SigNoz](integrations/signoz.json) | `signoz` | custom | 2 |  |
+| [Splunk](integrations/splunk.json) | `splunk` | custom | 2 |  |
+| [Splunk On-Call](integrations/victorops.json) | `victorops` | custom | 2 |  |
+| [Statsig](integrations/statsig.json) | `statsig` | custom | 2 |  |
+| [StatusCake](integrations/statuscake.json) | `statuscake` | custom | 4 |  |
+| [Statuspage](integrations/statuspage.json) | `statuspage` | api_key | 2 |  |
+| [Sumo Logic](integrations/sumo-logic.json) | `sumo-logic` | basic | 2 |  |
+| [Sumo Logic](integrations/sumologic.json) | `sumologic` | custom | 2 |  |
+| [Updown.io](integrations/updown.json) | `updown` | custom | 2 |  |
+
+### Productivity (111)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [Absorb LMS](integrations/absorb-lms.json) | `absorb-lms` | custom | 2 | ✓ |
+| [Adyen](integrations/adyen.json) | `adyen` | api_key | 2 |  |
+| [Affinity](integrations/affinity.json) | `affinity` | custom | 2 |  |
+| [Aha!](integrations/aha.json) | `aha` | custom | 2 |  |
+| [Airtable](integrations/airtable.json) | `airtable` | api_key | 2 |  |
+| [Apollo.io](integrations/apollo.json) | `apollo` | custom | 2 |  |
+| [Asana](integrations/asana.json) | `asana` | api_key | 2 |  |
+| [Attio](integrations/attio.json) | `attio` | api_key | 2 |  |
+| [Baremetrics](integrations/baremetrics.json) | `baremetrics` | api_key | 2 |  |
+| [Basecamp](integrations/basecamp.json) | `basecamp` | custom | 2 |  |
+| [Beamer](integrations/beamer.json) | `beamer` | custom | 2 |  |
+| [Cal.com](integrations/cal-com.json) | `cal-com` | api_key | 2 |  |
+| [Calendly](integrations/calendly.json) | `calendly` | api_key | 2 |  |
+| [Canny](integrations/canny.json) | `canny` | custom | 2 |  |
+| [Canva](integrations/canva.json) | `canva` | api_key | 2 |  |
+| [Chameleon](integrations/chameleon.json) | `chameleon` | custom | 2 |  |
+| [Chargebee](integrations/chargebee.json) | `chargebee` | custom | 2 |  |
+| [ChartMogul](integrations/chartmogul.json) | `chartmogul` | api_key | 2 |  |
+| [Clearbit](integrations/clearbit.json) | `clearbit` | api_key | 2 |  |
+| [ClickUp](integrations/clickup.json) | `clickup` | api_key | 2 |  |
+| [Clockify](integrations/clockify.json) | `clockify` | api_key | 2 |  |
+| [Close](integrations/close.json) | `close` | api_key | 2 |  |
+| [Close CRM](integrations/close-crm.json) | `close-crm` | custom | 2 |  |
+| [Coda](integrations/coda.json) | `coda` | api_key | 2 |  |
+| [Confluence](integrations/confluence.json) | `confluence` | custom | 2 |  |
+| [ConnectWise Manage](integrations/connectwise-manage.json) | `connectwise-manage` | custom | 2 |  |
+| [Contentful](integrations/contentful.json) | `contentful` | api_key | 2 |  |
+| [Contentstack](integrations/contentstack.json) | `contentstack` | custom | 2 |  |
+| [Copper CRM](integrations/copper.json) | `copper` | custom | 2 |  |
+| [Cornerstone OnDemand](integrations/cornerstone.json) | `cornerstone` | custom | 2 | ✓ |
+| [Coupa](integrations/coupa.json) | `coupa` | custom | 2 | ✓ |
+| [Docebo](integrations/docebo.json) | `docebo` | custom | 2 | ✓ |
+| [DocuSign](integrations/docusign.json) | `docusign` | oauth2 | 2 |  |
+| [Domo](integrations/domo.json) | `domo` | custom | 2 |  |
+| [Dropbox Business](integrations/dropbox-business.json) | `dropbox-business` | oauth2 | 3 | ✓ |
+| [Dropbox Sign](integrations/dropbox-sign.json) | `dropbox-sign` | custom | 1 |  |
+| [Dropbox Sign](integrations/hellosign.json) | `hellosign` | api_key | 2 |  |
+| [Dub.co](integrations/dub.json) | `dub` | api_key | 2 |  |
+| [Dynamics 365](integrations/dynamics-365.json) | `dynamics-365` | custom | 3 |  |
+| [Expensify](integrations/expensify.json) | `expensify` | custom | 1 |  |
+| [Fibery](integrations/fibery.json) | `fibery` | custom | 2 |  |
+| [Figma](integrations/figma.json) | `figma` | api_key | 2 |  |
+| [Frame.io](integrations/frame-io.json) | `frame-io` | custom | 1 |  |
+| [FreshBooks](integrations/freshbooks.json) | `freshbooks` | api_key | 2 |  |
+| [Freshdesk](integrations/freshdesk.json) | `freshdesk` | custom | 2 |  |
+| [Freshsales](integrations/freshsales.json) | `freshsales` | custom | 2 | ✓ |
+| [Freshservice](integrations/freshservice.json) | `freshservice` | custom | 2 |  |
+| [Google Workspace](integrations/google-workspace-admin.json) | `google-workspace-admin` | oauth2 | 2 |  |
+| [Guru](integrations/guru.json) | `guru` | custom | 1 |  |
+| [Harvest](integrations/harvest.json) | `harvest` | custom | 2 |  |
+| [Hive](integrations/hive.json) | `hive` | custom | 2 | ✓ |
+| [HubSpot](integrations/hubspot.json) | `hubspot` | custom | 2 |  |
+| [Ironclad](integrations/ironclad.json) | `ironclad` | api_key | 2 |  |
+| [IT Glue](integrations/it-glue.json) | `it-glue` | custom | 2 |  |
+| [JotForm](integrations/jotform.json) | `jotform` | custom | 2 |  |
+| [Juro](integrations/juro.json) | `juro` | custom | 1 |  |
+| [Klaviyo](integrations/klaviyo.json) | `klaviyo` | api_key | 2 |  |
+| [Lago](integrations/lago.json) | `lago` | api_key | 2 |  |
+| [Litmos](integrations/litmos.json) | `litmos` | custom | 2 | ✓ |
+| [Lob](integrations/lob.json) | `lob` | custom | 2 |  |
+| [Lucid](integrations/lucid.json) | `lucid` | api_key | 2 |  |
+| [Lucidchart](integrations/lucidchart.json) | `lucidchart` | custom | 2 |  |
+| [Mailchimp](integrations/mailchimp.json) | `mailchimp` | custom | 2 |  |
+| [Make](integrations/make.json) | `make` | custom | 2 |  |
+| [Mercury](integrations/mercury.json) | `mercury` | api_key | 1 |  |
+| [Metronome](integrations/metronome.json) | `metronome` | api_key | 2 |  |
+| [Microsoft 365](integrations/microsoft-365.json) | `microsoft-365` | oauth2 | 3 |  |
+| [Miro](integrations/miro.json) | `miro` | api_key | 2 |  |
+| [Monday.com](integrations/monday.json) | `monday` | custom | 2 |  |
+| [MURAL](integrations/mural.json) | `mural` | custom | 2 |  |
+| [NetSuite](integrations/netsuite.json) | `netsuite` | custom | 2 | ✓ |
+| [Notion](integrations/notion.json) | `notion` | api_key | 3 |  |
+| [Outreach](integrations/outreach.json) | `outreach` | api_key | 2 |  |
+| [Paddle](integrations/paddle.json) | `paddle` | api_key | 2 |  |
+| [PandaDoc](integrations/pandadoc.json) | `pandadoc` | custom | 2 |  |
+| [Pipedrive](integrations/pipedrive.json) | `pipedrive` | api_key | 2 |  |
+| [Planhat](integrations/planhat.json) | `planhat` | api_key | 2 |  |
+| [Pleo](integrations/pleo.json) | `pleo` | api_key | 2 |  |
+| [Productboard](integrations/productboard.json) | `productboard` | api_key | 2 |  |
+| [QuickBooks Online](integrations/quickbooks-online.json) | `quickbooks-online` | oauth2 | 1 |  |
+| [Ramp](integrations/ramp.json) | `ramp` | oauth2 | 1 |  |
+| [Recurly](integrations/recurly.json) | `recurly` | custom | 2 |  |
+| [Retool](integrations/retool.json) | `retool` | api_key | 2 |  |
+| [Sage Accounting](integrations/sage-accounting.json) | `sage-accounting` | custom | 2 |  |
+| [Salesforce](integrations/salesforce.json) | `salesforce` | oauth2 | 2 |  |
+| [Salesloft](integrations/salesloft.json) | `salesloft` | api_key | 2 |  |
+| [Sanity](integrations/sanity.json) | `sanity` | api_key | 2 |  |
+| [SAP Concur](integrations/sap-concur.json) | `sap-concur` | custom | 1 | ✓ |
+| [ServiceNow](integrations/servicenow.json) | `servicenow` | custom | 2 |  |
+| [Shopify](integrations/shopify.json) | `shopify` | custom | 2 |  |
+| [Sigma Computing](integrations/sigma-computing.json) | `sigma-computing` | api_key | 2 |  |
+| [SignNow](integrations/signnow.json) | `signnow` | custom | 1 |  |
+| [Smartsheet](integrations/smartsheet.json) | `smartsheet` | api_key | 2 |  |
+| [Sprig](integrations/sprig.json) | `sprig` | custom | 2 |  |
+| [Square](integrations/square.json) | `square` | api_key | 2 |  |
+| [Storyblok](integrations/storyblok.json) | `storyblok` | custom | 2 |  |
+| [Stripe](integrations/stripe.json) | `stripe` | custom | 1 |  |
+| [Teamwork](integrations/teamwork.json) | `teamwork` | api_key | 2 |  |
+| [Toggl Track](integrations/toggl.json) | `toggl` | basic | 2 |  |
+| [Totango](integrations/totango.json) | `totango` | custom | 2 |  |
+| [Trello](integrations/trello.json) | `trello` | custom | 2 |  |
+| [Typeform](integrations/typeform.json) | `typeform` | api_key | 2 |  |
+| [Userflow](integrations/userflow.json) | `userflow` | custom | 2 |  |
+| [Vitally](integrations/vitally.json) | `vitally` | api_key | 2 |  |
+| [Workato](integrations/workato.json) | `workato` | custom | 2 |  |
+| [Wrike](integrations/wrike.json) | `wrike` | api_key | 2 |  |
+| [Xero](integrations/xero.json) | `xero` | oauth2 | 2 |  |
+| [Zapier](integrations/zapier.json) | `zapier` | api_key | 2 |  |
+| [Zendesk](integrations/zendesk.json) | `zendesk` | custom | 2 |  |
+| [Zoho CRM](integrations/zoho-crm.json) | `zoho-crm` | custom | 3 | ✓ |
+| [Zuora](integrations/zuora.json) | `zuora` | custom | 2 |  |
+
+### Security (120)
+
+| Integration | Slug | Auth | Checks | Sync |
+|-------------|------|------|--------|------|
+| [1Password](integrations/1password.json) | `1password` | custom | 2 |  |
+| [360Learning](integrations/360learning.json) | `360learning` | custom | 2 | ✓ |
+| [Abnormal Security](integrations/abnormal-security.json) | `abnormal-security` | custom | 2 |  |
+| [Absolute](integrations/absolute.json) | `absolute` | custom | 2 |  |
+| [Action1](integrations/action1.json) | `action1` | custom | 5 |  |
+| [Addigy](integrations/addigy.json) | `addigy` | custom | 2 |  |
+| [Aikido Security](integrations/aikido.json) | `aikido` | api_key | 2 |  |
+| [Apiiro](integrations/apiiro.json) | `apiiro` | custom | 2 |  |
+| [Apple Business Manager](integrations/apple-business-manager.json) | `apple-business-manager` | custom | 3 |  |
+| [Aqua Security](integrations/aqua-security.json) | `aqua-security` | custom | 2 |  |
+| [Atera](integrations/atera.json) | `atera` | custom | 3 |  |
+| [Automox](integrations/automox.json) | `automox` | api_key | 2 |  |
+| [Axonius](integrations/axonius.json) | `axonius` | custom | 5 | ✓ |
+| [BeyondTrust](integrations/beyond-trust.json) | `beyond-trust` | custom | 3 |  |
+| [BigID](integrations/bigid.json) | `bigid` | custom | 3 |  |
+| [Bitdefender GravityZone](integrations/bitdefender-gravityzone.json) | `bitdefender-gravityzone` | custom | 5 |  |
+| [Bitsight](integrations/bitsight.json) | `bitsight` | custom | 5 |  |
+| [Bitwarden](integrations/bitwarden.json) | `bitwarden` | custom | 3 |  |
+| [Carbon Black](integrations/carbon-black.json) | `carbon-black` | api_key | 2 |  |
+| [Cato Networks](integrations/cato-networks.json) | `cato-networks` | custom | 2 |  |
+| [Certn](integrations/certn.json) | `certn` | custom | 2 |  |
+| [Chainguard](integrations/chainguard.json) | `chainguard` | custom | 2 |  |
+| [Checkmarx](integrations/checkmarx.json) | `checkmarx` | custom | 2 |  |
+| [Cisco Secure Endpoint](integrations/cisco-secure-endpoint.json) | `cisco-secure-endpoint` | custom | 3 |  |
+| [Cisco Umbrella](integrations/cisco-umbrella.json) | `cisco-umbrella` | custom | 2 |  |
+| [Cobalt](integrations/cobalt.json) | `cobalt` | api_key | 2 |  |
+| [Code42 Incydr](integrations/code42-incydr.json) | `code42-incydr` | custom | 5 |  |
+| [Cohesity](integrations/cohesity.json) | `cohesity` | custom | 3 |  |
+| [Commvault](integrations/commvault.json) | `commvault` | custom | 3 |  |
+| [Contrast Security](integrations/contrast-security.json) | `contrast-security` | custom | 2 |  |
+| [Cortex XDR](integrations/cortex-xdr.json) | `cortex-xdr` | custom | 3 |  |
+| [Coursera for Business](integrations/coursera-business.json) | `coursera-business` | custom | 2 | ✓ |
+| [CrowdStrike Falcon](integrations/crowdstrike.json) | `crowdstrike` | custom | 2 |  |
+| [CyberArk Identity](integrations/cyberark-identity.json) | `cyberark-identity` | custom | 3 | ✓ |
+| [Cycode](integrations/cycode.json) | `cycode` | custom | 2 |  |
+| [Darktrace](integrations/darktrace.json) | `darktrace` | custom | 3 |  |
+| [Datto RMM](integrations/datto-rmm.json) | `datto-rmm` | custom | 3 |  |
+| [Delinea Secret Server](integrations/delinea.json) | `delinea` | custom | 3 |  |
+| [Detectify](integrations/detectify.json) | `detectify` | custom | 2 |  |
+| [Endor Labs](integrations/endor-labs.json) | `endor-labs` | custom | 1 |  |
+| [Envoy](integrations/envoy.json) | `envoy` | api_key | 3 | ✓ |
+| [ESET Protect](integrations/eset-protect.json) | `eset-protect` | custom | 3 |  |
+| [FleetDM](integrations/fleetdm.json) | `fleetdm` | custom | 3 |  |
+| [Forescout](integrations/forescout.json) | `forescout` | custom | 3 |  |
+| [Fortinet FortiGate](integrations/fortinet-fortigate.json) | `fortinet-fortigate` | custom | 4 |  |
+| [GitGuardian](integrations/gitguardian.json) | `gitguardian` | api_key | 2 |  |
+| [Go1](integrations/go1.json) | `go1` | oauth2 | 2 | ✓ |
+| [Gong](integrations/gong.json) | `gong` | custom | 2 |  |
+| [GoodHire](integrations/goodhire.json) | `goodhire` | api_key | 2 |  |
+| [HackerOne](integrations/hackerone.json) | `hackerone` | custom | 2 |  |
+| [HashiCorp Vault](integrations/hashicorp-vault.json) | `hashicorp-vault` | api_key | 2 |  |
+| [Hexnode](integrations/hexnode.json) | `hexnode` | custom | 5 | ✓ |
+| [Hoxhunt](integrations/hoxhunt.json) | `hoxhunt` | custom | 4 |  |
+| [Huntress](integrations/huntress.json) | `huntress` | basic | 3 |  |
+| [Hyperproof](integrations/hyperproof.json) | `hyperproof` | api_key | 2 |  |
+| [Infisical](integrations/infisical.json) | `infisical` | api_key | 2 |  |
+| [Ivanti Neurons](integrations/ivanti.json) | `ivanti` | custom | 3 |  |
+| [Jamf Pro](integrations/jamf.json) | `jamf` | custom | 3 |  |
+| [Kandji](integrations/kandji.json) | `kandji` | api_key | 2 |  |
+| [Kaseya VSA](integrations/kaseya-vsa.json) | `kaseya-vsa` | custom | 3 |  |
+| [Keeper Security](integrations/keeper-security.json) | `keeper-security` | custom | 4 |  |
+| [KnowBe4](integrations/knowbe4.json) | `knowbe4` | custom | 2 |  |
+| [Kolide](integrations/kolide.json) | `kolide` | custom | 2 |  |
+| [Lacework](integrations/lacework.json) | `lacework` | custom | 2 |  |
+| [LastPass Business](integrations/lastpass.json) | `lastpass` | custom | 3 |  |
+| [Malwarebytes](integrations/malwarebytes.json) | `malwarebytes` | custom | 3 |  |
+| [ManageEngine Endpoint Central](integrations/manageengine-endpoint-central.json) | `manageengine-endpoint-central` | oauth2 | 4 |  |
+| [ManageEngine Log360 Cloud](integrations/manageengine-log360-cloud.json) | `manageengine-log360-cloud` | oauth2 | 3 |  |
+| [Mend.io](integrations/mend-io.json) | `mend-io` | custom | 4 |  |
+| [Microsoft Defender for Endpoint](integrations/microsoft-defender.json) | `microsoft-defender` | custom | 3 |  |
+| [Microsoft Intune](integrations/intune.json) | `intune` | oauth2 | 3 |  |
+| [Mosyle](integrations/mosyle.json) | `mosyle` | custom | 2 |  |
+| [N-able N-sight RMM](integrations/n-able-n-sight.json) | `n-able-n-sight` | custom | 3 |  |
+| [Nessus / Tenable Vulnerability Management](integrations/nessus.json) | `nessus` | custom | 3 |  |
+| [Netskope](integrations/netskope.json) | `netskope` | custom | 4 |  |
+| [Nightfall AI](integrations/nightfall-ai.json) | `nightfall-ai` | api_key | 4 |  |
+| [NinjaOne (NinjaRMM)](integrations/ninjaone.json) | `ninjaone` | custom | 3 |  |
+| [NordPass](integrations/nordpass.json) | `nordpass` | custom | 3 |  |
+| [OneTrust](integrations/onetrust.json) | `onetrust` | custom | 3 |  |
+| [Orca Security](integrations/orca-security.json) | `orca-security` | custom | 2 |  |
+| [PagerDuty](integrations/pagerduty.json) | `pagerduty` | custom | 2 |  |
+| [Palo Alto Networks SASE](integrations/palo-alto.json) | `palo-alto` | api_key | 2 |  |
+| [Prisma Cloud](integrations/prisma-cloud.json) | `prisma-cloud` | custom | 2 |  |
+| [Probely](integrations/probely.json) | `probely` | api_key | 2 |  |
+| [Proofpoint](integrations/proofpoint.json) | `proofpoint` | custom | 2 |  |
+| [Proofpoint TAP](integrations/proofpoint-tap.json) | `proofpoint-tap` | basic | 3 |  |
+| [Qualys VMDR](integrations/qualys.json) | `qualys` | custom | 4 |  |
+| [Rapid7](integrations/rapid7.json) | `rapid7` | custom | 2 |  |
+| [Rubrik](integrations/rubrik.json) | `rubrik` | custom | 3 |  |
+| [Scalefusion](integrations/scalefusion.json) | `scalefusion` | api_key | 2 |  |
+| [Secureframe](integrations/secureframe.json) | `secureframe` | api_key | 2 |  |
+| [SecurityScorecard](integrations/securityscorecard.json) | `securityscorecard` | custom | 5 |  |
+| [Semgrep](integrations/semgrep.json) | `semgrep` | api_key | 2 |  |
+| [SentinelOne](integrations/sentinelone.json) | `sentinelone` | api_key | 2 |  |
+| [Snyk](integrations/snyk.json) | `snyk` | custom | 2 |  |
+| [Socket](integrations/socket-dev.json) | `socket-dev` | api_key | 2 |  |
+| [Socket Security](integrations/socket.json) | `socket` | custom | 2 |  |
+| [SonarCloud](integrations/sonarcloud.json) | `sonarcloud` | custom | 2 |  |
+| [SonicWall](integrations/sonicwall.json) | `sonicwall` | custom | 2 |  |
+| [Sophos Central](integrations/sophos-central.json) | `sophos-central` | custom | 5 |  |
+| [StackHawk](integrations/stackhawk.json) | `stackhawk` | custom | 1 |  |
+| [StrongDM](integrations/strongdm.json) | `strongdm` | api_key | 2 |  |
+| [Sysdig](integrations/sysdig.json) | `sysdig` | custom | 2 |  |
+| [Tanium](integrations/tanium.json) | `tanium` | custom | 4 |  |
+| [Tenable Cloud](integrations/tenable-cloud.json) | `tenable-cloud` | custom | 2 |  |
+| [Tenable.io](integrations/tenable.json) | `tenable` | custom | 2 |  |
+| [ThreatDown (Malwarebytes)](integrations/threatdown.json) | `threatdown` | custom | 5 |  |
+| [Tines](integrations/tines.json) | `tines` | custom | 2 |  |
+| [Torq](integrations/torq.json) | `torq` | custom | 2 |  |
+| [Transcend](integrations/transcend.json) | `transcend` | api_key | 2 |  |
+| [Trellix](integrations/trellix.json) | `trellix` | custom | 3 |  |
+| [Trend Micro Vision One](integrations/trend-micro-vision-one.json) | `trend-micro-vision-one` | custom | 4 |  |
+| [Twingate](integrations/twingate.json) | `twingate` | custom | 4 | ✓ |
+| [Veracode](integrations/veracode.json) | `veracode` | custom | 2 |  |
+| [VMware Workspace ONE](integrations/vmware-workspace-one.json) | `vmware-workspace-one` | custom | 3 |  |
+| [VulnCheck](integrations/vulncheck.json) | `vulncheck` | custom | 2 |  |
+| [WatchGuard](integrations/watchguard.json) | `watchguard` | custom | 3 |  |
+| [Wiz](integrations/wiz.json) | `wiz` | custom | 2 |  |
+| [Zscaler Internet Access](integrations/zscaler-zia.json) | `zscaler-zia` | custom | 4 |  |
+| [Zscaler Private Access](integrations/zscaler-zpa.json) | `zscaler-zpa` | api_key | 2 |  |
+
+
+## How this is maintained
+
+This catalog is synced manually on demand from the CompAI production API using the tooling in [`tools/integrations-catalog-sync/`](../tools/integrations-catalog-sync). To request a refreshed snapshot or a new integration, open an issue.
+
+## License
+
+MIT — see repo root LICENSE file.
diff --git a/integrations-catalog/index.json b/integrations-catalog/index.json
new file mode 100644
index 0000000000..52fdb6e8a7
--- /dev/null
+++ b/integrations-catalog/index.json
@@ -0,0 +1,4879 @@
+{
+  "generatedAt": "2026-04-20T21:22:12.175Z",
+  "total": 540,
+  "sourceCount": 540,
+  "uniqueSlugs": 540,
+  "byCategory": {
+    "HR & People": 61,
+    "Security": 120,
+    "Productivity": 111,
+    "Infrastructure": 29,
+    "Communication": 46,
+    "Cloud": 53,
+    "Development": 52,
+    "Monitoring": 48,
+    "Identity & Access": 20
+  },
+  "integrations": [
+    {
+      "slug": "15five",
+      "name": "15Five",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/15five.json"
+    },
+    {
+      "slug": "1password",
+      "name": "1Password",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/1password.json"
+    },
+    {
+      "slug": "360learning",
+      "name": "360Learning",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/360learning.json"
+    },
+    {
+      "slug": "abnormal-security",
+      "name": "Abnormal Security",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/abnormal-security.json"
+    },
+    {
+      "slug": "absolute",
+      "name": "Absolute",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/absolute.json"
+    },
+    {
+      "slug": "absorb-lms",
+      "name": "Absorb LMS",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/absorb-lms.json"
+    },
+    {
+      "slug": "acronis-cyber-protect-cloud",
+      "name": "Acronis Cyber Protect Cloud",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/acronis-cyber-protect-cloud.json"
+    },
+    {
+      "slug": "action1",
+      "name": "Action1",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/action1.json"
+    },
+    {
+      "slug": "activecampaign",
+      "name": "ActiveCampaign",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/activecampaign.json"
+    },
+    {
+      "slug": "addigy",
+      "name": "Addigy",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/addigy.json"
+    },
+    {
+      "slug": "adp",
+      "name": "ADP",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/adp.json"
+    },
+    {
+      "slug": "adyen",
+      "name": "Adyen",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/adyen.json"
+    },
+    {
+      "slug": "affinity",
+      "name": "Affinity",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/affinity.json"
+    },
+    {
+      "slug": "aha",
+      "name": "Aha!",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/aha.json"
+    },
+    {
+      "slug": "aikido",
+      "name": "Aikido Security",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/aikido.json"
+    },
+    {
+      "slug": "airbyte",
+      "name": "Airbyte",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/airbyte.json"
+    },
+    {
+      "slug": "aircall",
+      "name": "Aircall",
+      "category": "Communication",
+      "authType": "basic",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/aircall.json"
+    },
+    {
+      "slug": "airtable",
+      "name": "Airtable",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/airtable.json"
+    },
+    {
+      "slug": "aiven",
+      "name": "Aiven",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/aiven.json"
+    },
+    {
+      "slug": "akamai",
+      "name": "Akamai",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/akamai.json"
+    },
+    {
+      "slug": "alexishr",
+      "name": "AlexisHR",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/alexishr.json"
+    },
+    {
+      "slug": "algolia",
+      "name": "Algolia",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/algolia.json"
+    },
+    {
+      "slug": "amplitude",
+      "name": "Amplitude",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/amplitude.json"
+    },
+    {
+      "slug": "anodot",
+      "name": "Anodot",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/anodot.json"
+    },
+    {
+      "slug": "anthropic",
+      "name": "Anthropic",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/anthropic.json"
+    },
+    {
+      "slug": "apiiro",
+      "name": "Apiiro",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/apiiro.json"
+    },
+    {
+      "slug": "apollo",
+      "name": "Apollo.io",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/apollo.json"
+    },
+    {
+      "slug": "apple-business-manager",
+      "name": "Apple Business Manager",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/apple-business-manager.json"
+    },
+    {
+      "slug": "aqua-security",
+      "name": "Aqua Security",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/aqua-security.json"
+    },
+    {
+      "slug": "asana",
+      "name": "Asana",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/asana.json"
+    },
+    {
+      "slug": "ashby",
+      "name": "Ashby",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/ashby.json"
+    },
+    {
+      "slug": "atera",
+      "name": "Atera",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/atera.json"
+    },
+    {
+      "slug": "attio",
+      "name": "Attio",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/attio.json"
+    },
+    {
+      "slug": "auth0",
+      "name": "Auth0",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/auth0.json"
+    },
+    {
+      "slug": "automox",
+      "name": "Automox",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/automox.json"
+    },
+    {
+      "slug": "auvik",
+      "name": "Auvik",
+      "category": "Monitoring",
+      "authType": "basic",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/auvik.json"
+    },
+    {
+      "slug": "axiom",
+      "name": "Axiom",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/axiom.json"
+    },
+    {
+      "slug": "axonius",
+      "name": "Axonius",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": true,
+      "file": "integrations/axonius.json"
+    },
+    {
+      "slug": "azure-devops",
+      "name": "Azure DevOps",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/azure-devops.json"
+    },
+    {
+      "slug": "backblaze",
+      "name": "Backblaze B2",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/backblaze.json"
+    },
+    {
+      "slug": "bamboohr",
+      "name": "BambooHR",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/bamboohr.json"
+    },
+    {
+      "slug": "baremetrics",
+      "name": "Baremetrics",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/baremetrics.json"
+    },
+    {
+      "slug": "barracuda-email-gateway-defense",
+      "name": "Barracuda Email Gateway Defense",
+      "category": "Communication",
+      "authType": "oauth2",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/barracuda-email-gateway-defense.json"
+    },
+    {
+      "slug": "basecamp",
+      "name": "Basecamp",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/basecamp.json"
+    },
+    {
+      "slug": "baseten",
+      "name": "Baseten",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/baseten.json"
+    },
+    {
+      "slug": "beamer",
+      "name": "Beamer",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/beamer.json"
+    },
+    {
+      "slug": "beehiiv",
+      "name": "beehiiv",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/beehiiv.json"
+    },
+    {
+      "slug": "better-uptime",
+      "name": "Better Stack",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/better-uptime.json"
+    },
+    {
+      "slug": "betterstack",
+      "name": "BetterStack",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/betterstack.json"
+    },
+    {
+      "slug": "beyond-trust",
+      "name": "BeyondTrust",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/beyond-trust.json"
+    },
+    {
+      "slug": "bigid",
+      "name": "BigID",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/bigid.json"
+    },
+    {
+      "slug": "bird",
+      "name": "Bird",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/bird.json"
+    },
+    {
+      "slug": "bitbucket",
+      "name": "Bitbucket",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/bitbucket.json"
+    },
+    {
+      "slug": "bitdefender-gravityzone",
+      "name": "Bitdefender GravityZone",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/bitdefender-gravityzone.json"
+    },
+    {
+      "slug": "bitsight",
+      "name": "Bitsight",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/bitsight.json"
+    },
+    {
+      "slug": "bitwarden",
+      "name": "Bitwarden",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/bitwarden.json"
+    },
+    {
+      "slug": "bonusly",
+      "name": "Bonusly",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/bonusly.json"
+    },
+    {
+      "slug": "box",
+      "name": "Box",
+      "category": "Cloud",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/box.json"
+    },
+    {
+      "slug": "braze",
+      "name": "Braze",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/braze.json"
+    },
+    {
+      "slug": "breathe-hr",
+      "name": "Breathe HR",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/breathe-hr.json"
+    },
+    {
+      "slug": "brevo",
+      "name": "Brevo",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/brevo.json"
+    },
+    {
+      "slug": "brex",
+      "name": "Brex",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/brex.json"
+    },
+    {
+      "slug": "browserstack",
+      "name": "BrowserStack",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/browserstack.json"
+    },
+    {
+      "slug": "buddy",
+      "name": "Buddy",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/buddy.json"
+    },
+    {
+      "slug": "bugsnag",
+      "name": "Bugsnag",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/bugsnag.json"
+    },
+    {
+      "slug": "buildkite",
+      "name": "Buildkite",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/buildkite.json"
+    },
+    {
+      "slug": "bunny-net",
+      "name": "Bunny.net",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/bunny-net.json"
+    },
+    {
+      "slug": "cal-com",
+      "name": "Cal.com",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cal-com.json"
+    },
+    {
+      "slug": "calendly",
+      "name": "Calendly",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/calendly.json"
+    },
+    {
+      "slug": "canny",
+      "name": "Canny",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/canny.json"
+    },
+    {
+      "slug": "canva",
+      "name": "Canva",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/canva.json"
+    },
+    {
+      "slug": "carbon-black",
+      "name": "Carbon Black",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/carbon-black.json"
+    },
+    {
+      "slug": "cato-networks",
+      "name": "Cato Networks",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cato-networks.json"
+    },
+    {
+      "slug": "census",
+      "name": "Census",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/census.json"
+    },
+    {
+      "slug": "ceridian-dayforce",
+      "name": "Ceridian Dayforce",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/ceridian-dayforce.json"
+    },
+    {
+      "slug": "certn",
+      "name": "Certn",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/certn.json"
+    },
+    {
+      "slug": "chainguard",
+      "name": "Chainguard",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/chainguard.json"
+    },
+    {
+      "slug": "chameleon",
+      "name": "Chameleon",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/chameleon.json"
+    },
+    {
+      "slug": "chargebee",
+      "name": "Chargebee",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/chargebee.json"
+    },
+    {
+      "slug": "charthop",
+      "name": "ChartHop",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/charthop.json"
+    },
+    {
+      "slug": "chartmogul",
+      "name": "ChartMogul",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/chartmogul.json"
+    },
+    {
+      "slug": "checkly",
+      "name": "Checkly",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/checkly.json"
+    },
+    {
+      "slug": "checkmarx",
+      "name": "Checkmarx",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/checkmarx.json"
+    },
+    {
+      "slug": "checkr",
+      "name": "Checkr",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/checkr.json"
+    },
+    {
+      "slug": "circleci",
+      "name": "CircleCI",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/circleci.json"
+    },
+    {
+      "slug": "cisco-meraki",
+      "name": "Cisco Meraki",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cisco-meraki.json"
+    },
+    {
+      "slug": "cisco-secure-endpoint",
+      "name": "Cisco Secure Endpoint",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/cisco-secure-endpoint.json"
+    },
+    {
+      "slug": "cisco-umbrella",
+      "name": "Cisco Umbrella",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cisco-umbrella.json"
+    },
+    {
+      "slug": "civo",
+      "name": "Civo",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/civo.json"
+    },
+    {
+      "slug": "clearbit",
+      "name": "Clearbit",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/clearbit.json"
+    },
+    {
+      "slug": "clerk",
+      "name": "Clerk",
+      "category": "Identity & Access",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/clerk.json"
+    },
+    {
+      "slug": "clickhouse",
+      "name": "ClickHouse Cloud",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/clickhouse.json"
+    },
+    {
+      "slug": "clickup",
+      "name": "ClickUp",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/clickup.json"
+    },
+    {
+      "slug": "clockify",
+      "name": "Clockify",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/clockify.json"
+    },
+    {
+      "slug": "close",
+      "name": "Close",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/close.json"
+    },
+    {
+      "slug": "close-crm",
+      "name": "Close CRM",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/close-crm.json"
+    },
+    {
+      "slug": "cloudflare",
+      "name": "Cloudflare",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/cloudflare.json"
+    },
+    {
+      "slug": "cloudinary",
+      "name": "Cloudinary",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cloudinary.json"
+    },
+    {
+      "slug": "cloudsmith",
+      "name": "Cloudsmith",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cloudsmith.json"
+    },
+    {
+      "slug": "cobalt",
+      "name": "Cobalt",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cobalt.json"
+    },
+    {
+      "slug": "cockroachdb",
+      "name": "CockroachDB",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cockroachdb.json"
+    },
+    {
+      "slug": "coda",
+      "name": "Coda",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/coda.json"
+    },
+    {
+      "slug": "codacy",
+      "name": "Codacy",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/codacy.json"
+    },
+    {
+      "slug": "code42-incydr",
+      "name": "Code42 Incydr",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/code42-incydr.json"
+    },
+    {
+      "slug": "codecov",
+      "name": "Codecov",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/codecov.json"
+    },
+    {
+      "slug": "codefresh",
+      "name": "Codefresh",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/codefresh.json"
+    },
+    {
+      "slug": "cohere",
+      "name": "Cohere",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cohere.json"
+    },
+    {
+      "slug": "cohesity",
+      "name": "Cohesity",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/cohesity.json"
+    },
+    {
+      "slug": "commvault",
+      "name": "Commvault",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/commvault.json"
+    },
+    {
+      "slug": "conductorone",
+      "name": "ConductorOne",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": true,
+      "file": "integrations/conductorone.json"
+    },
+    {
+      "slug": "confluence",
+      "name": "Confluence",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/confluence.json"
+    },
+    {
+      "slug": "confluent-cloud",
+      "name": "Confluent Cloud",
+      "category": "Infrastructure",
+      "authType": "basic",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/confluent-cloud.json"
+    },
+    {
+      "slug": "connectwise-manage",
+      "name": "ConnectWise Manage",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/connectwise-manage.json"
+    },
+    {
+      "slug": "contentful",
+      "name": "Contentful",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/contentful.json"
+    },
+    {
+      "slug": "contentstack",
+      "name": "Contentstack",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/contentstack.json"
+    },
+    {
+      "slug": "contrast-security",
+      "name": "Contrast Security",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/contrast-security.json"
+    },
+    {
+      "slug": "convex",
+      "name": "Convex",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/convex.json"
+    },
+    {
+      "slug": "coolify",
+      "name": "Coolify",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/coolify.json"
+    },
+    {
+      "slug": "copper",
+      "name": "Copper CRM",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/copper.json"
+    },
+    {
+      "slug": "coralogix",
+      "name": "Coralogix",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/coralogix.json"
+    },
+    {
+      "slug": "cornerstone",
+      "name": "Cornerstone OnDemand",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/cornerstone.json"
+    },
+    {
+      "slug": "cortex-xdr",
+      "name": "Cortex XDR",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/cortex-xdr.json"
+    },
+    {
+      "slug": "coupa",
+      "name": "Coupa",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/coupa.json"
+    },
+    {
+      "slug": "courier",
+      "name": "Courier",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/courier.json"
+    },
+    {
+      "slug": "coursera-business",
+      "name": "Coursera for Business",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/coursera-business.json"
+    },
+    {
+      "slug": "cronitor",
+      "name": "Cronitor",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cronitor.json"
+    },
+    {
+      "slug": "crowdstrike",
+      "name": "CrowdStrike Falcon",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/crowdstrike.json"
+    },
+    {
+      "slug": "logscale",
+      "name": "CrowdStrike LogScale",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/logscale.json"
+    },
+    {
+      "slug": "customer-io",
+      "name": "Customer.io",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/customer-io.json"
+    },
+    {
+      "slug": "cyberark",
+      "name": "CyberArk",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/cyberark.json"
+    },
+    {
+      "slug": "cyberark-identity",
+      "name": "CyberArk Identity",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/cyberark-identity.json"
+    },
+    {
+      "slug": "cycode",
+      "name": "Cycode",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/cycode.json"
+    },
+    {
+      "slug": "daily-co",
+      "name": "Daily",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/daily-co.json"
+    },
+    {
+      "slug": "darktrace",
+      "name": "Darktrace",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/darktrace.json"
+    },
+    {
+      "slug": "darwinbox",
+      "name": "Darwinbox",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/darwinbox.json"
+    },
+    {
+      "slug": "databricks",
+      "name": "Databricks",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/databricks.json"
+    },
+    {
+      "slug": "datadog",
+      "name": "Datadog",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/datadog.json"
+    },
+    {
+      "slug": "datto",
+      "name": "Datto",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/datto.json"
+    },
+    {
+      "slug": "datto-rmm",
+      "name": "Datto RMM",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/datto-rmm.json"
+    },
+    {
+      "slug": "dbt-cloud",
+      "name": "dbt Cloud",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/dbt-cloud.json"
+    },
+    {
+      "slug": "deel",
+      "name": "Deel",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/deel.json"
+    },
+    {
+      "slug": "deepgram",
+      "name": "Deepgram",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/deepgram.json"
+    },
+    {
+      "slug": "delinea",
+      "name": "Delinea Secret Server",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/delinea.json"
+    },
+    {
+      "slug": "deputy",
+      "name": "Deputy",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/deputy.json"
+    },
+    {
+      "slug": "descope",
+      "name": "Descope",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/descope.json"
+    },
+    {
+      "slug": "detectify",
+      "name": "Detectify",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/detectify.json"
+    },
+    {
+      "slug": "dialpad",
+      "name": "Dialpad",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/dialpad.json"
+    },
+    {
+      "slug": "digitalocean",
+      "name": "DigitalOcean",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/digitalocean.json"
+    },
+    {
+      "slug": "discord",
+      "name": "Discord",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/discord.json"
+    },
+    {
+      "slug": "dixa",
+      "name": "Dixa",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/dixa.json"
+    },
+    {
+      "slug": "docebo",
+      "name": "Docebo",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/docebo.json"
+    },
+    {
+      "slug": "docker-hub",
+      "name": "Docker Hub",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/docker-hub.json"
+    },
+    {
+      "slug": "docusign",
+      "name": "DocuSign",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/docusign.json"
+    },
+    {
+      "slug": "domo",
+      "name": "Domo",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/domo.json"
+    },
+    {
+      "slug": "doppler",
+      "name": "Doppler",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/doppler.json"
+    },
+    {
+      "slug": "drift",
+      "name": "Drift",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/drift.json"
+    },
+    {
+      "slug": "drip",
+      "name": "Drip",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/drip.json"
+    },
+    {
+      "slug": "dropbox-business",
+      "name": "Dropbox Business",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/dropbox-business.json"
+    },
+    {
+      "slug": "dropbox-sign",
+      "name": "Dropbox Sign",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/dropbox-sign.json"
+    },
+    {
+      "slug": "hellosign",
+      "name": "Dropbox Sign",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hellosign.json"
+    },
+    {
+      "slug": "druva",
+      "name": "Druva",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/druva.json"
+    },
+    {
+      "slug": "dub",
+      "name": "Dub.co",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/dub.json"
+    },
+    {
+      "slug": "duo-security",
+      "name": "Duo Security",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/duo-security.json"
+    },
+    {
+      "slug": "duo",
+      "name": "Duo Security",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/duo.json"
+    },
+    {
+      "slug": "dynamics-365",
+      "name": "Dynamics 365",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/dynamics-365.json"
+    },
+    {
+      "slug": "dynatrace",
+      "name": "Dynatrace",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/dynatrace.json"
+    },
+    {
+      "slug": "egnyte",
+      "name": "Egnyte",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/egnyte.json"
+    },
+    {
+      "slug": "elastic-cloud",
+      "name": "Elastic Cloud",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/elastic-cloud.json"
+    },
+    {
+      "slug": "elastic",
+      "name": "Elastic Cloud",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/elastic.json"
+    },
+    {
+      "slug": "employment-hero",
+      "name": "Employment Hero",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/employment-hero.json"
+    },
+    {
+      "slug": "endor-labs",
+      "name": "Endor Labs",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/endor-labs.json"
+    },
+    {
+      "slug": "env0",
+      "name": "env0",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/env0.json"
+    },
+    {
+      "slug": "envoy",
+      "name": "Envoy",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/envoy.json"
+    },
+    {
+      "slug": "eset-protect",
+      "name": "ESET Protect",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/eset-protect.json"
+    },
+    {
+      "slug": "expensify",
+      "name": "Expensify",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/expensify.json"
+    },
+    {
+      "slug": "factorial",
+      "name": "Factorial",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/factorial.json"
+    },
+    {
+      "slug": "fastly",
+      "name": "Fastly",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/fastly.json"
+    },
+    {
+      "slug": "fibery",
+      "name": "Fibery",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/fibery.json"
+    },
+    {
+      "slug": "figma",
+      "name": "Figma",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/figma.json"
+    },
+    {
+      "slug": "firebase",
+      "name": "Firebase",
+      "category": "Cloud",
+      "authType": "oauth2",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/firebase.json"
+    },
+    {
+      "slug": "firehydrant",
+      "name": "FireHydrant",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/firehydrant.json"
+    },
+    {
+      "slug": "fireworks-ai",
+      "name": "Fireworks AI",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/fireworks-ai.json"
+    },
+    {
+      "slug": "fivetran",
+      "name": "Fivetran",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/fivetran.json"
+    },
+    {
+      "slug": "flagsmith",
+      "name": "Flagsmith",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/flagsmith.json"
+    },
+    {
+      "slug": "fleetdm",
+      "name": "FleetDM",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/fleetdm.json"
+    },
+    {
+      "slug": "fly",
+      "name": "Fly.io",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/fly.json"
+    },
+    {
+      "slug": "forescout",
+      "name": "Forescout",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/forescout.json"
+    },
+    {
+      "slug": "fortinet-fortigate",
+      "name": "Fortinet FortiGate",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/fortinet-fortigate.json"
+    },
+    {
+      "slug": "frame-io",
+      "name": "Frame.io",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/frame-io.json"
+    },
+    {
+      "slug": "freshbooks",
+      "name": "FreshBooks",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/freshbooks.json"
+    },
+    {
+      "slug": "freshdesk",
+      "name": "Freshdesk",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/freshdesk.json"
+    },
+    {
+      "slug": "freshsales",
+      "name": "Freshsales",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/freshsales.json"
+    },
+    {
+      "slug": "freshservice",
+      "name": "Freshservice",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/freshservice.json"
+    },
+    {
+      "slug": "freshteam",
+      "name": "Freshteam",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/freshteam.json"
+    },
+    {
+      "slug": "front",
+      "name": "Front",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/front.json"
+    },
+    {
+      "slug": "frontegg",
+      "name": "Frontegg",
+      "category": "Identity & Access",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/frontegg.json"
+    },
+    {
+      "slug": "fullstory",
+      "name": "FullStory",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/fullstory.json"
+    },
+    {
+      "slug": "fusionauth",
+      "name": "FusionAuth",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": true,
+      "file": "integrations/fusionauth.json"
+    },
+    {
+      "slug": "gitbook",
+      "name": "GitBook",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/gitbook.json"
+    },
+    {
+      "slug": "gitguardian",
+      "name": "GitGuardian",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/gitguardian.json"
+    },
+    {
+      "slug": "github",
+      "name": "GitHub",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/github.json"
+    },
+    {
+      "slug": "github-copilot",
+      "name": "GitHub Copilot",
+      "category": "Development",
+      "authType": "oauth2",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/github-copilot.json"
+    },
+    {
+      "slug": "gitlab",
+      "name": "GitLab",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/gitlab.json"
+    },
+    {
+      "slug": "go1",
+      "name": "Go1",
+      "category": "Security",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/go1.json"
+    },
+    {
+      "slug": "gong",
+      "name": "Gong",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/gong.json"
+    },
+    {
+      "slug": "goodhire",
+      "name": "GoodHire",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/goodhire.json"
+    },
+    {
+      "slug": "google-cloud",
+      "name": "Google Cloud",
+      "category": "Cloud",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/google-cloud.json"
+    },
+    {
+      "slug": "google-workspace-admin",
+      "name": "Google Workspace",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/google-workspace-admin.json"
+    },
+    {
+      "slug": "gorgias",
+      "name": "Gorgias",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/gorgias.json"
+    },
+    {
+      "slug": "grafana-cloud",
+      "name": "Grafana Cloud",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/grafana-cloud.json"
+    },
+    {
+      "slug": "greenhouse",
+      "name": "Greenhouse",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/greenhouse.json"
+    },
+    {
+      "slug": "groq",
+      "name": "Groq",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/groq.json"
+    },
+    {
+      "slug": "guru",
+      "name": "Guru",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/guru.json"
+    },
+    {
+      "slug": "gusto",
+      "name": "Gusto",
+      "category": "HR & People",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/gusto.json"
+    },
+    {
+      "slug": "hackerone",
+      "name": "HackerOne",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hackerone.json"
+    },
+    {
+      "slug": "harness",
+      "name": "Harness",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/harness.json"
+    },
+    {
+      "slug": "harvest",
+      "name": "Harvest",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/harvest.json"
+    },
+    {
+      "slug": "hashicorp-vault",
+      "name": "HashiCorp Vault",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hashicorp-vault.json"
+    },
+    {
+      "slug": "helpscout",
+      "name": "Help Scout",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/helpscout.json"
+    },
+    {
+      "slug": "heroku",
+      "name": "Heroku",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/heroku.json"
+    },
+    {
+      "slug": "hetzner",
+      "name": "Hetzner Cloud",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hetzner.json"
+    },
+    {
+      "slug": "hex",
+      "name": "Hex",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hex.json"
+    },
+    {
+      "slug": "hexnode",
+      "name": "Hexnode",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": true,
+      "file": "integrations/hexnode.json"
+    },
+    {
+      "slug": "bob",
+      "name": "HiBob",
+      "category": "HR & People",
+      "authType": "basic",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/bob.json"
+    },
+    {
+      "slug": "hibob",
+      "name": "HiBob",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hibob.json"
+    },
+    {
+      "slug": "highlight-io",
+      "name": "Highlight",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/highlight-io.json"
+    },
+    {
+      "slug": "hightouch",
+      "name": "Hightouch",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/hightouch.json"
+    },
+    {
+      "slug": "hireright",
+      "name": "HireRight",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/hireright.json"
+    },
+    {
+      "slug": "hive",
+      "name": "Hive",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/hive.json"
+    },
+    {
+      "slug": "honeybadger",
+      "name": "Honeybadger",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/honeybadger.json"
+    },
+    {
+      "slug": "honeycomb",
+      "name": "Honeycomb",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/honeycomb.json"
+    },
+    {
+      "slug": "hoxhunt",
+      "name": "Hoxhunt",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/hoxhunt.json"
+    },
+    {
+      "slug": "hubspot",
+      "name": "HubSpot",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hubspot.json"
+    },
+    {
+      "slug": "huggingface",
+      "name": "Hugging Face",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/huggingface.json"
+    },
+    {
+      "slug": "humaans",
+      "name": "Humaans",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/humaans.json"
+    },
+    {
+      "slug": "hunter",
+      "name": "Hunter",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hunter.json"
+    },
+    {
+      "slug": "huntress",
+      "name": "Huntress",
+      "category": "Security",
+      "authType": "basic",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/huntress.json"
+    },
+    {
+      "slug": "hyperproof",
+      "name": "Hyperproof",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/hyperproof.json"
+    },
+    {
+      "slug": "incident-io",
+      "name": "Incident.io",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/incident-io.json"
+    },
+    {
+      "slug": "infisical",
+      "name": "Infisical",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/infisical.json"
+    },
+    {
+      "slug": "inngest",
+      "name": "Inngest",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/inngest.json"
+    },
+    {
+      "slug": "instatus",
+      "name": "Instatus",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/instatus.json"
+    },
+    {
+      "slug": "intercom",
+      "name": "Intercom",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/intercom.json"
+    },
+    {
+      "slug": "ionos",
+      "name": "IONOS Cloud",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/ionos.json"
+    },
+    {
+      "slug": "ironclad",
+      "name": "Ironclad",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/ironclad.json"
+    },
+    {
+      "slug": "it-glue",
+      "name": "IT Glue",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/it-glue.json"
+    },
+    {
+      "slug": "iterable",
+      "name": "Iterable",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/iterable.json"
+    },
+    {
+      "slug": "ivanti",
+      "name": "Ivanti Neurons",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/ivanti.json"
+    },
+    {
+      "slug": "jamf",
+      "name": "Jamf Pro",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/jamf.json"
+    },
+    {
+      "slug": "jenkins",
+      "name": "Jenkins",
+      "category": "Development",
+      "authType": "basic",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/jenkins.json"
+    },
+    {
+      "slug": "jfrog",
+      "name": "JFrog Artifactory",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/jfrog.json"
+    },
+    {
+      "slug": "jira",
+      "name": "Jira",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/jira.json"
+    },
+    {
+      "slug": "jotform",
+      "name": "JotForm",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/jotform.json"
+    },
+    {
+      "slug": "jumpcloud",
+      "name": "JumpCloud",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/jumpcloud.json"
+    },
+    {
+      "slug": "juro",
+      "name": "Juro",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/juro.json"
+    },
+    {
+      "slug": "justworks",
+      "name": "Justworks",
+      "category": "HR & People",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/justworks.json"
+    },
+    {
+      "slug": "kandji",
+      "name": "Kandji",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/kandji.json"
+    },
+    {
+      "slug": "kaseya-vsa",
+      "name": "Kaseya VSA",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/kaseya-vsa.json"
+    },
+    {
+      "slug": "keeper-security",
+      "name": "Keeper Security",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/keeper-security.json"
+    },
+    {
+      "slug": "keka",
+      "name": "Keka",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": true,
+      "file": "integrations/keka.json"
+    },
+    {
+      "slug": "kenjo",
+      "name": "Kenjo",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/kenjo.json"
+    },
+    {
+      "slug": "keycdn",
+      "name": "KeyCDN",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/keycdn.json"
+    },
+    {
+      "slug": "convertkit",
+      "name": "Kit (ConvertKit)",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/convertkit.json"
+    },
+    {
+      "slug": "klaviyo",
+      "name": "Klaviyo",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/klaviyo.json"
+    },
+    {
+      "slug": "knock",
+      "name": "Knock",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/knock.json"
+    },
+    {
+      "slug": "knowbe4",
+      "name": "KnowBe4",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/knowbe4.json"
+    },
+    {
+      "slug": "kolide",
+      "name": "Kolide",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/kolide.json"
+    },
+    {
+      "slug": "kombo",
+      "name": "Kombo",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/kombo.json"
+    },
+    {
+      "slug": "kong",
+      "name": "Kong Konnect",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/kong.json"
+    },
+    {
+      "slug": "koyeb",
+      "name": "Koyeb",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/koyeb.json"
+    },
+    {
+      "slug": "kustomer",
+      "name": "Kustomer",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/kustomer.json"
+    },
+    {
+      "slug": "lacework",
+      "name": "Lacework",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/lacework.json"
+    },
+    {
+      "slug": "lago",
+      "name": "Lago",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/lago.json"
+    },
+    {
+      "slug": "lambdatest",
+      "name": "LambdaTest",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/lambdatest.json"
+    },
+    {
+      "slug": "lastpass",
+      "name": "LastPass Business",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/lastpass.json"
+    },
+    {
+      "slug": "lattice",
+      "name": "Lattice",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/lattice.json"
+    },
+    {
+      "slug": "launchdarkly",
+      "name": "LaunchDarkly",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/launchdarkly.json"
+    },
+    {
+      "slug": "lever",
+      "name": "Lever",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/lever.json"
+    },
+    {
+      "slug": "linear",
+      "name": "Linear",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/linear.json"
+    },
+    {
+      "slug": "linode",
+      "name": "Linode",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/linode.json"
+    },
+    {
+      "slug": "litmos",
+      "name": "Litmos",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/litmos.json"
+    },
+    {
+      "slug": "liveblocks",
+      "name": "Liveblocks",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/liveblocks.json"
+    },
+    {
+      "slug": "lob",
+      "name": "Lob",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/lob.json"
+    },
+    {
+      "slug": "logrocket",
+      "name": "LogRocket",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/logrocket.json"
+    },
+    {
+      "slug": "logzio",
+      "name": "Logz.io",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/logzio.json"
+    },
+    {
+      "slug": "loops",
+      "name": "Loops",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/loops.json"
+    },
+    {
+      "slug": "lucid",
+      "name": "Lucid",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/lucid.json"
+    },
+    {
+      "slug": "lucidchart",
+      "name": "Lucidchart",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/lucidchart.json"
+    },
+    {
+      "slug": "lumigo",
+      "name": "Lumigo",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/lumigo.json"
+    },
+    {
+      "slug": "mabl",
+      "name": "Mabl",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mabl.json"
+    },
+    {
+      "slug": "mailchimp",
+      "name": "Mailchimp",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mailchimp.json"
+    },
+    {
+      "slug": "make",
+      "name": "Make",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/make.json"
+    },
+    {
+      "slug": "malwarebytes",
+      "name": "Malwarebytes",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/malwarebytes.json"
+    },
+    {
+      "slug": "manageengine-endpoint-central",
+      "name": "ManageEngine Endpoint Central",
+      "category": "Security",
+      "authType": "oauth2",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/manageengine-endpoint-central.json"
+    },
+    {
+      "slug": "manageengine-log360-cloud",
+      "name": "ManageEngine Log360 Cloud",
+      "category": "Security",
+      "authType": "oauth2",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/manageengine-log360-cloud.json"
+    },
+    {
+      "slug": "mattermost",
+      "name": "Mattermost",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mattermost.json"
+    },
+    {
+      "slug": "mend-io",
+      "name": "Mend.io",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/mend-io.json"
+    },
+    {
+      "slug": "mercury",
+      "name": "Mercury",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/mercury.json"
+    },
+    {
+      "slug": "merge-dev",
+      "name": "Merge",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/merge-dev.json"
+    },
+    {
+      "slug": "messagebird",
+      "name": "MessageBird",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/messagebird.json"
+    },
+    {
+      "slug": "metronome",
+      "name": "Metronome",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/metronome.json"
+    },
+    {
+      "slug": "mezmo",
+      "name": "Mezmo",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mezmo.json"
+    },
+    {
+      "slug": "logdna",
+      "name": "Mezmo (LogDNA)",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/logdna.json"
+    },
+    {
+      "slug": "microsoft-365",
+      "name": "Microsoft 365",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/microsoft-365.json"
+    },
+    {
+      "slug": "microsoft-defender",
+      "name": "Microsoft Defender for Endpoint",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/microsoft-defender.json"
+    },
+    {
+      "slug": "entra-id",
+      "name": "Microsoft Entra ID",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": true,
+      "file": "integrations/entra-id.json"
+    },
+    {
+      "slug": "intune",
+      "name": "Microsoft Intune",
+      "category": "Security",
+      "authType": "oauth2",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/intune.json"
+    },
+    {
+      "slug": "microsoft-teams",
+      "name": "Microsoft Teams",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/microsoft-teams.json"
+    },
+    {
+      "slug": "mimecast",
+      "name": "Mimecast",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/mimecast.json"
+    },
+    {
+      "slug": "mintlify",
+      "name": "Mintlify",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mintlify.json"
+    },
+    {
+      "slug": "miro",
+      "name": "Miro",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/miro.json"
+    },
+    {
+      "slug": "mistral",
+      "name": "Mistral AI",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mistral.json"
+    },
+    {
+      "slug": "mixpanel",
+      "name": "Mixpanel",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mixpanel.json"
+    },
+    {
+      "slug": "monday",
+      "name": "Monday.com",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/monday.json"
+    },
+    {
+      "slug": "mongodb-atlas",
+      "name": "MongoDB Atlas",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/mongodb-atlas.json"
+    },
+    {
+      "slug": "monte-carlo",
+      "name": "Monte Carlo",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/monte-carlo.json"
+    },
+    {
+      "slug": "mosyle",
+      "name": "Mosyle",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mosyle.json"
+    },
+    {
+      "slug": "motherduck",
+      "name": "MotherDuck",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/motherduck.json"
+    },
+    {
+      "slug": "mural",
+      "name": "MURAL",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/mural.json"
+    },
+    {
+      "slug": "n-able-n-sight",
+      "name": "N-able N-sight RMM",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/n-able-n-sight.json"
+    },
+    {
+      "slug": "namely",
+      "name": "Namely",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/namely.json"
+    },
+    {
+      "slug": "navan",
+      "name": "Navan",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/navan.json"
+    },
+    {
+      "slug": "nectar-hr",
+      "name": "Nectar",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/nectar-hr.json"
+    },
+    {
+      "slug": "neon",
+      "name": "Neon",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/neon.json"
+    },
+    {
+      "slug": "nessus",
+      "name": "Nessus / Tenable Vulnerability Management",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/nessus.json"
+    },
+    {
+      "slug": "netlify",
+      "name": "Netlify",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/netlify.json"
+    },
+    {
+      "slug": "netskope",
+      "name": "Netskope",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/netskope.json"
+    },
+    {
+      "slug": "netsuite",
+      "name": "NetSuite",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/netsuite.json"
+    },
+    {
+      "slug": "new-relic",
+      "name": "New Relic",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/new-relic.json"
+    },
+    {
+      "slug": "ngrok",
+      "name": "ngrok",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/ngrok.json"
+    },
+    {
+      "slug": "nightfall-ai",
+      "name": "Nightfall AI",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/nightfall-ai.json"
+    },
+    {
+      "slug": "ninjaone",
+      "name": "NinjaOne (NinjaRMM)",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/ninjaone.json"
+    },
+    {
+      "slug": "nordpass",
+      "name": "NordPass",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/nordpass.json"
+    },
+    {
+      "slug": "northflank",
+      "name": "Northflank",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/northflank.json"
+    },
+    {
+      "slug": "notion",
+      "name": "Notion",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/notion.json"
+    },
+    {
+      "slug": "novu",
+      "name": "Novu",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/novu.json"
+    },
+    {
+      "slug": "ns1",
+      "name": "NS1",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/ns1.json"
+    },
+    {
+      "slug": "okta",
+      "name": "Okta",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/okta.json"
+    },
+    {
+      "slug": "omnisend",
+      "name": "Omnisend",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/omnisend.json"
+    },
+    {
+      "slug": "onelogin",
+      "name": "OneLogin",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/onelogin.json"
+    },
+    {
+      "slug": "onetrust",
+      "name": "OneTrust",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/onetrust.json"
+    },
+    {
+      "slug": "openai",
+      "name": "OpenAI",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/openai.json"
+    },
+    {
+      "slug": "openphone",
+      "name": "OpenPhone",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/openphone.json"
+    },
+    {
+      "slug": "opsgenie",
+      "name": "Opsgenie",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/opsgenie.json"
+    },
+    {
+      "slug": "optimizely",
+      "name": "Optimizely",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/optimizely.json"
+    },
+    {
+      "slug": "oracle-cloud",
+      "name": "Oracle Cloud Infrastructure",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/oracle-cloud.json"
+    },
+    {
+      "slug": "orca-security",
+      "name": "Orca Security",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/orca-security.json"
+    },
+    {
+      "slug": "outreach",
+      "name": "Outreach",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/outreach.json"
+    },
+    {
+      "slug": "oyster-hr",
+      "name": "Oyster HR",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/oyster-hr.json"
+    },
+    {
+      "slug": "paddle",
+      "name": "Paddle",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/paddle.json"
+    },
+    {
+      "slug": "pagerduty",
+      "name": "PagerDuty",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pagerduty.json"
+    },
+    {
+      "slug": "palo-alto",
+      "name": "Palo Alto Networks SASE",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/palo-alto.json"
+    },
+    {
+      "slug": "pandadoc",
+      "name": "PandaDoc",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pandadoc.json"
+    },
+    {
+      "slug": "papertrail",
+      "name": "Papertrail",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/papertrail.json"
+    },
+    {
+      "slug": "pave",
+      "name": "Pave",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/pave.json"
+    },
+    {
+      "slug": "paychex",
+      "name": "Paychex",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/paychex.json"
+    },
+    {
+      "slug": "paycom",
+      "name": "Paycom",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/paycom.json"
+    },
+    {
+      "slug": "paycor",
+      "name": "Paycor",
+      "category": "HR & People",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/paycor.json"
+    },
+    {
+      "slug": "payfit",
+      "name": "PayFit",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/payfit.json"
+    },
+    {
+      "slug": "payhawk",
+      "name": "Payhawk",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/payhawk.json"
+    },
+    {
+      "slug": "paylocity",
+      "name": "Paylocity",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/paylocity.json"
+    },
+    {
+      "slug": "pendo",
+      "name": "Pendo",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pendo.json"
+    },
+    {
+      "slug": "permit-io",
+      "name": "Permit.io",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/permit-io.json"
+    },
+    {
+      "slug": "persona",
+      "name": "Persona",
+      "category": "Identity & Access",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/persona.json"
+    },
+    {
+      "slug": "personio",
+      "name": "Personio",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/personio.json"
+    },
+    {
+      "slug": "ping-identity",
+      "name": "Ping Identity",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/ping-identity.json"
+    },
+    {
+      "slug": "pingboard",
+      "name": "Pingboard",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/pingboard.json"
+    },
+    {
+      "slug": "pipedream",
+      "name": "Pipedream",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pipedream.json"
+    },
+    {
+      "slug": "pipedrive",
+      "name": "Pipedrive",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pipedrive.json"
+    },
+    {
+      "slug": "plain",
+      "name": "Plain",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/plain.json"
+    },
+    {
+      "slug": "planetscale",
+      "name": "PlanetScale",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/planetscale.json"
+    },
+    {
+      "slug": "planhat",
+      "name": "Planhat",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/planhat.json"
+    },
+    {
+      "slug": "plausible",
+      "name": "Plausible Analytics",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/plausible.json"
+    },
+    {
+      "slug": "pleo",
+      "name": "Pleo",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pleo.json"
+    },
+    {
+      "slug": "port-io",
+      "name": "Port",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/port-io.json"
+    },
+    {
+      "slug": "posthog",
+      "name": "PostHog",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/posthog.json"
+    },
+    {
+      "slug": "postman",
+      "name": "Postman",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/postman.json"
+    },
+    {
+      "slug": "postmark",
+      "name": "Postmark",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/postmark.json"
+    },
+    {
+      "slug": "prefect",
+      "name": "Prefect",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/prefect.json"
+    },
+    {
+      "slug": "prisma-cloud",
+      "name": "Prisma Cloud",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/prisma-cloud.json"
+    },
+    {
+      "slug": "probely",
+      "name": "Probely",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/probely.json"
+    },
+    {
+      "slug": "productboard",
+      "name": "Productboard",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/productboard.json"
+    },
+    {
+      "slug": "proofpoint",
+      "name": "Proofpoint",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/proofpoint.json"
+    },
+    {
+      "slug": "proofpoint-tap",
+      "name": "Proofpoint TAP",
+      "category": "Security",
+      "authType": "basic",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/proofpoint-tap.json"
+    },
+    {
+      "slug": "pulumi",
+      "name": "Pulumi",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pulumi.json"
+    },
+    {
+      "slug": "pulumi-cloud",
+      "name": "Pulumi Cloud",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pulumi-cloud.json"
+    },
+    {
+      "slug": "pylon",
+      "name": "Pylon",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/pylon.json"
+    },
+    {
+      "slug": "qase",
+      "name": "Qase",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/qase.json"
+    },
+    {
+      "slug": "qonto",
+      "name": "Qonto",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/qonto.json"
+    },
+    {
+      "slug": "qovery",
+      "name": "Qovery",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/qovery.json"
+    },
+    {
+      "slug": "qualtrics",
+      "name": "Qualtrics",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/qualtrics.json"
+    },
+    {
+      "slug": "qualys",
+      "name": "Qualys VMDR",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/qualys.json"
+    },
+    {
+      "slug": "quave-cloud",
+      "name": "Quave Cloud",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/quave-cloud.json"
+    },
+    {
+      "slug": "quickbooks-online",
+      "name": "QuickBooks Online",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/quickbooks-online.json"
+    },
+    {
+      "slug": "railway",
+      "name": "Railway",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/railway.json"
+    },
+    {
+      "slug": "ramp",
+      "name": "Ramp",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/ramp.json"
+    },
+    {
+      "slug": "rapid7",
+      "name": "Rapid7",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/rapid7.json"
+    },
+    {
+      "slug": "readme",
+      "name": "ReadMe",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/readme.json"
+    },
+    {
+      "slug": "recurly",
+      "name": "Recurly",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/recurly.json"
+    },
+    {
+      "slug": "redis-cloud",
+      "name": "Redis Cloud",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/redis-cloud.json"
+    },
+    {
+      "slug": "remote",
+      "name": "Remote",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/remote.json"
+    },
+    {
+      "slug": "render",
+      "name": "Render",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/render.json"
+    },
+    {
+      "slug": "replicate",
+      "name": "Replicate",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/replicate.json"
+    },
+    {
+      "slug": "resend",
+      "name": "Resend",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/resend.json"
+    },
+    {
+      "slug": "retool",
+      "name": "Retool",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/retool.json"
+    },
+    {
+      "slug": "ringcentral",
+      "name": "RingCentral",
+      "category": "Communication",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/ringcentral.json"
+    },
+    {
+      "slug": "rippling",
+      "name": "Rippling",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/rippling.json"
+    },
+    {
+      "slug": "roboflow",
+      "name": "Roboflow",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/roboflow.json"
+    },
+    {
+      "slug": "rollbar",
+      "name": "Rollbar",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/rollbar.json"
+    },
+    {
+      "slug": "rootly",
+      "name": "Rootly",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/rootly.json"
+    },
+    {
+      "slug": "rubrik",
+      "name": "Rubrik",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/rubrik.json"
+    },
+    {
+      "slug": "rudderstack",
+      "name": "RudderStack",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/rudderstack.json"
+    },
+    {
+      "slug": "sage-accounting",
+      "name": "Sage Accounting",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sage-accounting.json"
+    },
+    {
+      "slug": "sage-hr",
+      "name": "Sage HR",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/sage-hr.json"
+    },
+    {
+      "slug": "sailpoint",
+      "name": "SailPoint IdentityNow",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/sailpoint.json"
+    },
+    {
+      "slug": "salesforce",
+      "name": "Salesforce",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/salesforce.json"
+    },
+    {
+      "slug": "salesloft",
+      "name": "Salesloft",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/salesloft.json"
+    },
+    {
+      "slug": "sanity",
+      "name": "Sanity",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sanity.json"
+    },
+    {
+      "slug": "sap-concur",
+      "name": "SAP Concur",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": true,
+      "file": "integrations/sap-concur.json"
+    },
+    {
+      "slug": "sap-successfactors",
+      "name": "SAP SuccessFactors",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/sap-successfactors.json"
+    },
+    {
+      "slug": "saviynt",
+      "name": "Saviynt",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/saviynt.json"
+    },
+    {
+      "slug": "scalefusion",
+      "name": "Scalefusion",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/scalefusion.json"
+    },
+    {
+      "slug": "scaleway",
+      "name": "Scaleway",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/scaleway.json"
+    },
+    {
+      "slug": "secureframe",
+      "name": "Secureframe",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/secureframe.json"
+    },
+    {
+      "slug": "securityscorecard",
+      "name": "SecurityScorecard",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/securityscorecard.json"
+    },
+    {
+      "slug": "segment",
+      "name": "Segment",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/segment.json"
+    },
+    {
+      "slug": "semgrep",
+      "name": "Semgrep",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/semgrep.json"
+    },
+    {
+      "slug": "sendgrid",
+      "name": "SendGrid",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sendgrid.json"
+    },
+    {
+      "slug": "sentinelone",
+      "name": "SentinelOne",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sentinelone.json"
+    },
+    {
+      "slug": "sentry",
+      "name": "Sentry",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sentry.json"
+    },
+    {
+      "slug": "servicenow",
+      "name": "ServiceNow",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/servicenow.json"
+    },
+    {
+      "slug": "shopify",
+      "name": "Shopify",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/shopify.json"
+    },
+    {
+      "slug": "shortcut",
+      "name": "Shortcut",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/shortcut.json"
+    },
+    {
+      "slug": "sigma-computing",
+      "name": "Sigma Computing",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sigma-computing.json"
+    },
+    {
+      "slug": "signnow",
+      "name": "SignNow",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/signnow.json"
+    },
+    {
+      "slug": "signoz",
+      "name": "SigNoz",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/signoz.json"
+    },
+    {
+      "slug": "slack",
+      "name": "Slack",
+      "category": "Communication",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/slack.json"
+    },
+    {
+      "slug": "smartsheet",
+      "name": "Smartsheet",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/smartsheet.json"
+    },
+    {
+      "slug": "snipeit",
+      "name": "Snipe-IT",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/snipeit.json"
+    },
+    {
+      "slug": "snowflake",
+      "name": "Snowflake",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/snowflake.json"
+    },
+    {
+      "slug": "snyk",
+      "name": "Snyk",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/snyk.json"
+    },
+    {
+      "slug": "socket-dev",
+      "name": "Socket",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/socket-dev.json"
+    },
+    {
+      "slug": "socket",
+      "name": "Socket Security",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/socket.json"
+    },
+    {
+      "slug": "sonarqube-cloud",
+      "name": "SonarCloud",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sonarqube-cloud.json"
+    },
+    {
+      "slug": "sonarcloud",
+      "name": "SonarCloud",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sonarcloud.json"
+    },
+    {
+      "slug": "sonarqube-server",
+      "name": "SonarQube Server",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/sonarqube-server.json"
+    },
+    {
+      "slug": "sonatype-nexus",
+      "name": "Sonatype Nexus Repository",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/sonatype-nexus.json"
+    },
+    {
+      "slug": "sonicwall",
+      "name": "SonicWall",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sonicwall.json"
+    },
+    {
+      "slug": "sophos-central",
+      "name": "Sophos Central",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/sophos-central.json"
+    },
+    {
+      "slug": "speakeasy",
+      "name": "Speakeasy",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/speakeasy.json"
+    },
+    {
+      "slug": "split",
+      "name": "Split",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/split.json"
+    },
+    {
+      "slug": "splunk",
+      "name": "Splunk",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/splunk.json"
+    },
+    {
+      "slug": "victorops",
+      "name": "Splunk On-Call",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/victorops.json"
+    },
+    {
+      "slug": "sprig",
+      "name": "Sprig",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sprig.json"
+    },
+    {
+      "slug": "square",
+      "name": "Square",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/square.json"
+    },
+    {
+      "slug": "stackhawk",
+      "name": "StackHawk",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/stackhawk.json"
+    },
+    {
+      "slug": "statsig",
+      "name": "Statsig",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/statsig.json"
+    },
+    {
+      "slug": "statuscake",
+      "name": "StatusCake",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/statuscake.json"
+    },
+    {
+      "slug": "statuspage",
+      "name": "Statuspage",
+      "category": "Monitoring",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/statuspage.json"
+    },
+    {
+      "slug": "sterling",
+      "name": "Sterling",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/sterling.json"
+    },
+    {
+      "slug": "stitch",
+      "name": "Stitch",
+      "category": "Development",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/stitch.json"
+    },
+    {
+      "slug": "stoplight",
+      "name": "Stoplight",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/stoplight.json"
+    },
+    {
+      "slug": "storyblok",
+      "name": "Storyblok",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/storyblok.json"
+    },
+    {
+      "slug": "stripe",
+      "name": "Stripe",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/stripe.json"
+    },
+    {
+      "slug": "strongdm",
+      "name": "StrongDM",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/strongdm.json"
+    },
+    {
+      "slug": "stytch",
+      "name": "Stytch",
+      "category": "Identity & Access",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/stytch.json"
+    },
+    {
+      "slug": "sumo-logic",
+      "name": "Sumo Logic",
+      "category": "Monitoring",
+      "authType": "basic",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sumo-logic.json"
+    },
+    {
+      "slug": "sumologic",
+      "name": "Sumo Logic",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sumologic.json"
+    },
+    {
+      "slug": "supabase",
+      "name": "Supabase",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 10,
+      "syncSupported": false,
+      "file": "integrations/supabase.json"
+    },
+    {
+      "slug": "surveymonkey",
+      "name": "SurveyMonkey",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/surveymonkey.json"
+    },
+    {
+      "slug": "surveysparrow",
+      "name": "SurveySparrow",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/surveysparrow.json"
+    },
+    {
+      "slug": "sysdig",
+      "name": "Sysdig",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/sysdig.json"
+    },
+    {
+      "slug": "tailscale",
+      "name": "Tailscale",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/tailscale.json"
+    },
+    {
+      "slug": "talent-lms",
+      "name": "TalentLMS",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/talent-lms.json"
+    },
+    {
+      "slug": "tanium",
+      "name": "Tanium",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/tanium.json"
+    },
+    {
+      "slug": "teamcity",
+      "name": "TeamCity",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/teamcity.json"
+    },
+    {
+      "slug": "teamsupport",
+      "name": "TeamSupport",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/teamsupport.json"
+    },
+    {
+      "slug": "teamwork",
+      "name": "Teamwork",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/teamwork.json"
+    },
+    {
+      "slug": "teleport",
+      "name": "Teleport",
+      "category": "Infrastructure",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/teleport.json"
+    },
+    {
+      "slug": "telnyx",
+      "name": "Telnyx",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/telnyx.json"
+    },
+    {
+      "slug": "tenable-cloud",
+      "name": "Tenable Cloud",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/tenable-cloud.json"
+    },
+    {
+      "slug": "tenable",
+      "name": "Tenable.io",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/tenable.json"
+    },
+    {
+      "slug": "terraform-cloud",
+      "name": "Terraform Cloud",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/terraform-cloud.json"
+    },
+    {
+      "slug": "testrail",
+      "name": "TestRail",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/testrail.json"
+    },
+    {
+      "slug": "threatdown",
+      "name": "ThreatDown (Malwarebytes)",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 5,
+      "syncSupported": false,
+      "file": "integrations/threatdown.json"
+    },
+    {
+      "slug": "tines",
+      "name": "Tines",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/tines.json"
+    },
+    {
+      "slug": "together-ai",
+      "name": "Together AI",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/together-ai.json"
+    },
+    {
+      "slug": "toggl",
+      "name": "Toggl Track",
+      "category": "Productivity",
+      "authType": "basic",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/toggl.json"
+    },
+    {
+      "slug": "torq",
+      "name": "Torq",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/torq.json"
+    },
+    {
+      "slug": "totango",
+      "name": "Totango",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/totango.json"
+    },
+    {
+      "slug": "transcend",
+      "name": "Transcend",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/transcend.json"
+    },
+    {
+      "slug": "travis-ci",
+      "name": "Travis CI",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/travis-ci.json"
+    },
+    {
+      "slug": "trellix",
+      "name": "Trellix",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/trellix.json"
+    },
+    {
+      "slug": "trello",
+      "name": "Trello",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/trello.json"
+    },
+    {
+      "slug": "trend-micro-vision-one",
+      "name": "Trend Micro Vision One",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/trend-micro-vision-one.json"
+    },
+    {
+      "slug": "trigger-dev",
+      "name": "Trigger.dev",
+      "category": "Development",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/trigger-dev.json"
+    },
+    {
+      "slug": "trinet",
+      "name": "TriNet",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/trinet.json"
+    },
+    {
+      "slug": "turso",
+      "name": "Turso",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/turso.json"
+    },
+    {
+      "slug": "twilio",
+      "name": "Twilio",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/twilio.json"
+    },
+    {
+      "slug": "twingate",
+      "name": "Twingate",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": true,
+      "file": "integrations/twingate.json"
+    },
+    {
+      "slug": "typeform",
+      "name": "Typeform",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/typeform.json"
+    },
+    {
+      "slug": "ukg-ready",
+      "name": "UKG Ready",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/ukg-ready.json"
+    },
+    {
+      "slug": "upcloud",
+      "name": "UpCloud",
+      "category": "Cloud",
+      "authType": "basic",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/upcloud.json"
+    },
+    {
+      "slug": "updown",
+      "name": "Updown.io",
+      "category": "Monitoring",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/updown.json"
+    },
+    {
+      "slug": "upstash",
+      "name": "Upstash",
+      "category": "Cloud",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/upstash.json"
+    },
+    {
+      "slug": "userflow",
+      "name": "Userflow",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/userflow.json"
+    },
+    {
+      "slug": "veeam",
+      "name": "Veeam Backup & Replication",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/veeam.json"
+    },
+    {
+      "slug": "veracode",
+      "name": "Veracode",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/veracode.json"
+    },
+    {
+      "slug": "vercel",
+      "name": "Vercel",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/vercel.json"
+    },
+    {
+      "slug": "vitally",
+      "name": "Vitally",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/vitally.json"
+    },
+    {
+      "slug": "vmware-workspace-one",
+      "name": "VMware Workspace ONE",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/vmware-workspace-one.json"
+    },
+    {
+      "slug": "vonage",
+      "name": "Vonage",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/vonage.json"
+    },
+    {
+      "slug": "vulncheck",
+      "name": "VulnCheck",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/vulncheck.json"
+    },
+    {
+      "slug": "vultr",
+      "name": "Vultr",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/vultr.json"
+    },
+    {
+      "slug": "watchguard",
+      "name": "WatchGuard",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": false,
+      "file": "integrations/watchguard.json"
+    },
+    {
+      "slug": "webex",
+      "name": "Webex",
+      "category": "Communication",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/webex.json"
+    },
+    {
+      "slug": "webflow",
+      "name": "Webflow",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/webflow.json"
+    },
+    {
+      "slug": "wandb",
+      "name": "Weights & Biases",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/wandb.json"
+    },
+    {
+      "slug": "when-i-work",
+      "name": "When I Work",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/when-i-work.json"
+    },
+    {
+      "slug": "wistia",
+      "name": "Wistia",
+      "category": "Communication",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/wistia.json"
+    },
+    {
+      "slug": "wiz",
+      "name": "Wiz",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/wiz.json"
+    },
+    {
+      "slug": "workable",
+      "name": "Workable",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/workable.json"
+    },
+    {
+      "slug": "workato",
+      "name": "Workato",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/workato.json"
+    },
+    {
+      "slug": "workday",
+      "name": "Workday",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/workday.json"
+    },
+    {
+      "slug": "workos",
+      "name": "WorkOS",
+      "category": "Identity & Access",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/workos.json"
+    },
+    {
+      "slug": "workramp",
+      "name": "WorkRamp",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/workramp.json"
+    },
+    {
+      "slug": "wrike",
+      "name": "Wrike",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/wrike.json"
+    },
+    {
+      "slug": "xata",
+      "name": "Xata",
+      "category": "Cloud",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/xata.json"
+    },
+    {
+      "slug": "xero",
+      "name": "Xero",
+      "category": "Productivity",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/xero.json"
+    },
+    {
+      "slug": "zapier",
+      "name": "Zapier",
+      "category": "Productivity",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/zapier.json"
+    },
+    {
+      "slug": "zelt",
+      "name": "Zelt",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/zelt.json"
+    },
+    {
+      "slug": "zendesk",
+      "name": "Zendesk",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/zendesk.json"
+    },
+    {
+      "slug": "zenefits",
+      "name": "Zenefits",
+      "category": "HR & People",
+      "authType": "api_key",
+      "checkCount": 1,
+      "syncSupported": false,
+      "file": "integrations/zenefits.json"
+    },
+    {
+      "slug": "zerotier",
+      "name": "ZeroTier",
+      "category": "Infrastructure",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/zerotier.json"
+    },
+    {
+      "slug": "zoho-crm",
+      "name": "Zoho CRM",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 3,
+      "syncSupported": true,
+      "file": "integrations/zoho-crm.json"
+    },
+    {
+      "slug": "zoho-people",
+      "name": "Zoho People",
+      "category": "HR & People",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": true,
+      "file": "integrations/zoho-people.json"
+    },
+    {
+      "slug": "zoom",
+      "name": "Zoom",
+      "category": "Communication",
+      "authType": "oauth2",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/zoom.json"
+    },
+    {
+      "slug": "zscaler-zia",
+      "name": "Zscaler Internet Access",
+      "category": "Security",
+      "authType": "custom",
+      "checkCount": 4,
+      "syncSupported": false,
+      "file": "integrations/zscaler-zia.json"
+    },
+    {
+      "slug": "zscaler-zpa",
+      "name": "Zscaler Private Access",
+      "category": "Security",
+      "authType": "api_key",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/zscaler-zpa.json"
+    },
+    {
+      "slug": "zuora",
+      "name": "Zuora",
+      "category": "Productivity",
+      "authType": "custom",
+      "checkCount": 2,
+      "syncSupported": false,
+      "file": "integrations/zuora.json"
+    }
+  ]
+}
diff --git a/integrations-catalog/integrations/15five.json b/integrations-catalog/integrations/15five.json
new file mode 100644
index 0000000000..de18545f25
--- /dev/null
+++ b/integrations-catalog/integrations/15five.json
@@ -0,0 +1,45 @@
+{
+  "slug": "15five",
+  "name": "15Five",
+  "description": "Monitor 15Five HR performance platform for team access and employee engagement compliance",
+  "category": "HR & People",
+  "docsUrl": "https://my.15five.com/api/public/",
+  "baseUrl": "https://my.15five.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to 15Five at https://my.15five.com\n2. Go to Settings → Integrations → API\n3. Generate an API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in 15Five Settings → Integrations → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "15five_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews 15Five users with access to performance management data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "15five_app_availability",
+      "name": "App Availability",
+      "description": "Verifies 15Five HR performance platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/1password.json b/integrations-catalog/integrations/1password.json
new file mode 100644
index 0000000000..dcfdc8f318
--- /dev/null
+++ b/integrations-catalog/integrations/1password.json
@@ -0,0 +1,51 @@
+{
+  "slug": "1password",
+  "name": "1Password",
+  "description": "Monitor 1Password audit events, vault access, and sign-in activity for secrets management compliance. Requires a 1Password Business plan.",
+  "category": "Security",
+  "docsUrl": "https://developer.1password.com/docs/events-api/",
+  "baseUrl": "https://events.1password.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "Requires: 1Password Business plan (not available on Teams or Teams Starter Pack).\n\n1. Sign in to 1Password.com as an owner or admin\n2. Go to Integrations → Events Reporting\n3. Click New Integration → select Other\n4. Enable scopes: Sign-in attempts, Item usages, Audit events\n5. Copy the generated token\n6. Enter your region: com (US), eu (Europe), or ca (Canada)\n7. Paste the token below\n\nNote: Do NOT use a Service Account token — Events Reporting tokens are required.",
+      "credentialFields": [
+        {
+          "label": "Events API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create an Events Reporting integration at 1Password.com → Integrations → Events Reporting. Enable scopes: Sign-in attempts, Item usages, Audit events."
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Enter your account region: com (US), eu (Europe), or ca (Canada)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "onepassword_audit_logging",
+      "name": "Secure Secrets",
+      "description": "Verifies 1Password audit logging is enabled and the Events API token has access to audit events",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "onepassword_signin_attempts",
+      "name": "Employee Access",
+      "description": "Reviews recent 1Password sign-in attempts for unauthorized access and suspicious activity",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/360learning.json b/integrations-catalog/integrations/360learning.json
new file mode 100644
index 0000000000..ef796562ff
--- /dev/null
+++ b/integrations-catalog/integrations/360learning.json
@@ -0,0 +1,52 @@
+{
+  "slug": "360learning",
+  "name": "360Learning",
+  "description": "Monitor 360Learning LMS for compliance training completion and user management.",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to 360Learning as an admin\n2. Go to Settings > API\n3. Copy your Company ID and API Key (v1 credentials)\n4. If you don't have API credentials, contact your 360Learning Customer Success Partner (CSP)\n5. Enter both values below\n\nNote: API v2 credentials are NOT compatible. Use API v1 credentials only.",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Your 360Learning API v1 key. Go to Settings > API to generate or find your API key."
+        },
+        {
+          "label": "Company ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your 360Learning company ID. Found in Settings > API or ask your 360Learning Customer Success Partner."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "360learning_employee_access",
+      "name": "360Learning Employee Access",
+      "description": "Verifies that the 360Learning LMS is accessible and lists platform users.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "360learning_training_completion",
+      "name": "360Learning Training Completion",
+      "description": "Verifies that employees have completed required training courses in 360Learning.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/abnormal-security.json b/integrations-catalog/integrations/abnormal-security.json
new file mode 100644
index 0000000000..1c07f8e4aa
--- /dev/null
+++ b/integrations-catalog/integrations/abnormal-security.json
@@ -0,0 +1,45 @@
+{
+  "slug": "abnormal-security",
+  "name": "Abnormal Security",
+  "description": "Monitor Abnormal Security AI-powered email security for threat detection and compliance",
+  "category": "Security",
+  "docsUrl": "https://app.abnormalsecurity.com/settings/integrations/api",
+  "baseUrl": "https://api.abnormalplatform.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Abnormal Security at https://app.abnormalsecurity.com\n2. Go to Settings → Integrations → API\n3. Generate an API token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Abnormal Security Portal → Settings → Integrations → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "abnormal_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Abnormal Security is detecting and blocking email threats",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "abnormal_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Abnormal Security vendor integrations are configured for email protection",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/absolute.json b/integrations-catalog/integrations/absolute.json
new file mode 100644
index 0000000000..93c3a02c19
--- /dev/null
+++ b/integrations-catalog/integrations/absolute.json
@@ -0,0 +1,53 @@
+{
+  "slug": "absolute",
+  "name": "Absolute",
+  "description": "Endpoint security and persistence platform. Monitor device inventory, applications, and security compliance.",
+  "category": "Security",
+  "docsUrl": "https://api.absolute.com/api-doc/doc.html",
+  "baseUrl": "https://api.absolute.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Token ID",
+          "type": "text",
+          "required": true
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true
+        },
+        {
+          "label": "API Base URL",
+          "type": "text",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_inventory",
+      "name": "Device Inventory",
+      "description": "Monitor enrolled endpoint devices and their security status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "application_inventory",
+      "name": "Application Inventory",
+      "description": "Monitor installed applications across managed devices",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/absorb-lms.json b/integrations-catalog/integrations/absorb-lms.json
new file mode 100644
index 0000000000..27d311c917
--- /dev/null
+++ b/integrations-catalog/integrations/absorb-lms.json
@@ -0,0 +1,63 @@
+{
+  "slug": "absorb-lms",
+  "name": "Absorb LMS",
+  "description": "Monitor user access, admin roles, and employee enrollment in Absorb Learning Management System",
+  "category": "Productivity",
+  "docsUrl": "https://docs.myabsorb.com/",
+  "baseUrl": "https://myabsorb.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Portal URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Absorb LMS portal URL, e.g. yourcompany.myabsorb.com (no https:// prefix)"
+        },
+        {
+          "label": "Admin Username",
+          "type": "text",
+          "required": true,
+          "helpText": "An LMS administrator account username"
+        },
+        {
+          "label": "Admin Password",
+          "type": "password",
+          "required": true,
+          "helpText": "The LMS administrator account password"
+        },
+        {
+          "label": "API Private Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Your unique API Private Key (GUID). Request from Absorb Support or your System Admin."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Lists all users/learners in Absorb LMS to verify active employee access and account status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "admin_roles",
+      "name": "Role-based Access Controls",
+      "description": "Checks administrative roles and permissions in Absorb LMS to ensure proper role-based access control",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/acronis-cyber-protect-cloud.json b/integrations-catalog/integrations/acronis-cyber-protect-cloud.json
new file mode 100644
index 0000000000..294fabc5e2
--- /dev/null
+++ b/integrations-catalog/integrations/acronis-cyber-protect-cloud.json
@@ -0,0 +1,76 @@
+{
+  "slug": "acronis-cyber-protect-cloud",
+  "name": "Acronis Cyber Protect Cloud",
+  "description": "Monitor backup activities, protection policies, alerts, and tenant usage for cyber protection compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://developer.acronis.com/doc/index.html",
+  "baseUrl": "https://us-cloud.acronis.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Datacenter URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Acronis datacenter URL (e.g., https://us-cloud.acronis.com, https://eu-cloud.acronis.com)"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "API client ID from Acronis management console"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "API client secret from Acronis management console"
+        },
+        {
+          "label": "Tenant ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Acronis tenant ID"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "backup_monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Checks for active backup and security alerts that require attention",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "backup_policies",
+      "name": "Infrastructure Inventory",
+      "description": "Verifies that backup protection policies are properly configured and active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "backup_activities",
+      "name": "Backup logs",
+      "description": "Reviews recent backup activities and tasks for successful completion",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "tenant_usage",
+      "name": "Systems Description",
+      "description": "Monitors tenant usage and resource consumption for backup services",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/action1.json b/integrations-catalog/integrations/action1.json
new file mode 100644
index 0000000000..845783407b
--- /dev/null
+++ b/integrations-catalog/integrations/action1.json
@@ -0,0 +1,72 @@
+{
+  "slug": "action1",
+  "name": "Action1",
+  "description": "Patch management and endpoint management platform. Monitor vulnerability status, patch compliance, and device inventory.",
+  "category": "Security",
+  "docsUrl": "https://www.action1.com/api-documentation/",
+  "baseUrl": "https://app.action1.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Action1 at https://app.action1.com\n2. Go to Settings → API Credentials\n3. Click 'Add' to create new credentials\n4. Copy the Client ID and Client Secret\n5. Paste both values below",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Action1 Console → Settings → API Credentials."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Generated when you create API credentials in Action1."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "action1_app_availability",
+      "name": "Action1 App Availability",
+      "description": "Verifies Action1 API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "action1_asset_inventory",
+      "name": "Action1 Asset Inventory",
+      "description": "Verifies endpoint inventory in Action1.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "action1_vulnerability_management",
+      "name": "Action1 Vulnerability Management",
+      "description": "Verifies vulnerability scanning and tracking in Action1.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "action1_patch_validation",
+      "name": "Action1 Patch Validation",
+      "description": "Checks for missing patches across managed endpoints.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "action1_device_configuration",
+      "name": "Action1 Device Configuration",
+      "description": "Verifies device configuration policies are defined in Action1.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/activecampaign.json b/integrations-catalog/integrations/activecampaign.json
new file mode 100644
index 0000000000..8bf29f824c
--- /dev/null
+++ b/integrations-catalog/integrations/activecampaign.json
@@ -0,0 +1,51 @@
+{
+  "slug": "activecampaign",
+  "name": "ActiveCampaign",
+  "description": "Monitor ActiveCampaign marketing automation for contact list access and campaign compliance",
+  "category": "Communication",
+  "docsUrl": "https://developers.activecampaign.com/reference/overview",
+  "baseUrl": "https://app.activecampaign.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to ActiveCampaign\n2. Go to Settings → Developer → API Access\n3. Copy your API URL and API Key\n4. Enter both below",
+      "credentialFields": [
+        {
+          "label": "API URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your ActiveCampaign API URL. Found in Settings → Developer → API Access (e.g. https://myaccount.api-us1.com)"
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in ActiveCampaign Settings → Developer → API Access"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "activecampaign_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews ActiveCampaign users with access to marketing automation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "activecampaign_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies ActiveCampaign automations are running for campaign delivery",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/addigy.json b/integrations-catalog/integrations/addigy.json
new file mode 100644
index 0000000000..928bdfd6bf
--- /dev/null
+++ b/integrations-catalog/integrations/addigy.json
@@ -0,0 +1,35 @@
+{
+  "slug": "addigy",
+  "name": "Addigy",
+  "description": "Monitor managed Apple devices for security compliance and device management status",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Retrieve all managed devices in the organization",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Check device compliance and security configuration",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/adp.json b/integrations-catalog/integrations/adp.json
new file mode 100644
index 0000000000..35034f17ef
--- /dev/null
+++ b/integrations-catalog/integrations/adp.json
@@ -0,0 +1,59 @@
+{
+  "slug": "adp",
+  "name": "ADP",
+  "description": "Human resource information system (HRIS). Monitor employee records, hiring compliance, and workforce data.",
+  "category": "HR & People",
+  "docsUrl": "https://developers.adp.com/",
+  "baseUrl": "https://api.adp.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to ADP Workforce Now as an admin\n2. Go to Setup → Developers → Data Connector Credentials\n3. Create new credentials (or use existing app credentials)\n4. Copy the Client ID and Client Secret\n5. Paste both values below\n\nNote: If your organization requires an SSL certificate for API access, contact your ADP admin to configure the credentials without certificate requirement, or use the ADP Marketplace Data Connector setup.",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "From your ADP app registration or Data Connector credentials."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "From your ADP app registration or Data Connector credentials."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "adp_app_availability",
+      "name": "ADP App Availability",
+      "description": "Verifies ADP API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "adp_employee_access",
+      "name": "ADP Employee Access",
+      "description": "Verifies employee records are accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "adp_hiring_compliance",
+      "name": "ADP Hiring Compliance",
+      "description": "Verifies active workers exist with valid employment status.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/adyen.json b/integrations-catalog/integrations/adyen.json
new file mode 100644
index 0000000000..fb77ecf39e
--- /dev/null
+++ b/integrations-catalog/integrations/adyen.json
@@ -0,0 +1,35 @@
+{
+  "slug": "adyen",
+  "name": "Adyen",
+  "description": "Global payment platform. Monitor API credential access and merchant configuration.",
+  "category": "Productivity",
+  "docsUrl": "https://docs.adyen.com/api-explorer/Management/3/overview",
+  "baseUrl": "https://management-live.adyen.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "adyen_app_availability",
+      "name": "Adyen App Availability",
+      "description": "Checks that the Adyen API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "adyen_employee_access",
+      "name": "Adyen Employee Access",
+      "description": "Verifies employee access to Adyen via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/affinity.json b/integrations-catalog/integrations/affinity.json
new file mode 100644
index 0000000000..ff03f9f650
--- /dev/null
+++ b/integrations-catalog/integrations/affinity.json
@@ -0,0 +1,45 @@
+{
+  "slug": "affinity",
+  "name": "Affinity",
+  "description": "Monitor Affinity relationship intelligence CRM for team access and deal data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://api-docs.affinity.co/",
+  "baseUrl": "https://api.affinity.co/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Affinity at https://affinity.co\n2. Go to Settings → API\n3. Copy your API Key\n4. Base64 encode 'api_key:' (with colon): echo -n 'apikey:' | base64\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'api_key:' (with trailing colon). Found in Affinity Settings → API. Command: echo -n 'apikey:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "affinity_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Affinity CRM users with access to relationship and deal data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "affinity_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Affinity CRM platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/aha.json b/integrations-catalog/integrations/aha.json
new file mode 100644
index 0000000000..047c39deb1
--- /dev/null
+++ b/integrations-catalog/integrations/aha.json
@@ -0,0 +1,51 @@
+{
+  "slug": "aha",
+  "name": "Aha!",
+  "description": "Monitor Aha! product roadmap and strategy platform for team access and product planning compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.aha.io/api",
+  "baseUrl": "https://secure.aha.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Aha! at https://secure.aha.io\n2. Go to Profile → Developer → API Key\n3. Note your account subdomain from the URL\n4. Enter both below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Aha! → Profile → Developer → API Key"
+        },
+        {
+          "label": "Account Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Aha! account subdomain (e.g. mycompany from mycompany.aha.io)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "aha_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Aha! account users and their product roadmap access",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "aha_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Aha! product management is active and accessible",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/aikido.json b/integrations-catalog/integrations/aikido.json
new file mode 100644
index 0000000000..bb5f3ff3ad
--- /dev/null
+++ b/integrations-catalog/integrations/aikido.json
@@ -0,0 +1,35 @@
+{
+  "slug": "aikido",
+  "name": "Aikido Security",
+  "description": "Application security platform for code scanning and vulnerability management.",
+  "category": "Security",
+  "docsUrl": "https://app.aikido.dev/api/public/v1/docs",
+  "baseUrl": "https://app.aikido.dev",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "aikido_app_availability",
+      "name": "Aikido Security App Availability",
+      "description": "Checks that the Aikido Security API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "aikido_employee_access",
+      "name": "Aikido Security Employee Access",
+      "description": "Verifies employee access to Aikido Security via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/airbyte.json b/integrations-catalog/integrations/airbyte.json
new file mode 100644
index 0000000000..b2cfe6d139
--- /dev/null
+++ b/integrations-catalog/integrations/airbyte.json
@@ -0,0 +1,45 @@
+{
+  "slug": "airbyte",
+  "name": "Airbyte",
+  "description": "Monitor Airbyte data integration pipelines for connection status and workspace access compliance",
+  "category": "Cloud",
+  "docsUrl": "https://reference.airbyte.com/reference/getting-started",
+  "baseUrl": "https://api.airbyte.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Airbyte Cloud at https://cloud.airbyte.com\n2. Go to Settings → API Keys\n3. Generate a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Airbyte Cloud Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "airbyte_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Airbyte workspaces for data pipeline infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "airbyte_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Airbyte workspace users and their data pipeline access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/aircall.json b/integrations-catalog/integrations/aircall.json
new file mode 100644
index 0000000000..3f3b6c98bb
--- /dev/null
+++ b/integrations-catalog/integrations/aircall.json
@@ -0,0 +1,47 @@
+{
+  "slug": "aircall",
+  "name": "Aircall",
+  "description": "Cloud-based phone system for business. Monitor user access, role-based controls, and sync employees from Aircall.",
+  "category": "Communication",
+  "docsUrl": "https://developer.aircall.io/api-references/",
+  "baseUrl": "https://api.aircall.io",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "setupInstructions": "1. Log in to Aircall Dashboard at https://dashboard.aircall.io\n2. Go to Company Settings\n3. In the API Keys section, click 'Add a new API key'\n4. Copy the API ID and API Token\n5. Enter them below",
+      "usernameField": "api_id",
+      "passwordField": "api_token"
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "aircall_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Aircall users with their email and availability status to verify employee access controls.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "aircall_role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Verifies Aircall user roles by retrieving individual user details to check admin vs agent role separation.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "aircall_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Checks Aircall webhook configurations to verify monitoring and alerting is properly set up for call and user events.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/airtable.json b/integrations-catalog/integrations/airtable.json
new file mode 100644
index 0000000000..0566821177
--- /dev/null
+++ b/integrations-catalog/integrations/airtable.json
@@ -0,0 +1,35 @@
+{
+  "slug": "airtable",
+  "name": "Airtable",
+  "description": "Monitor Airtable bases and workspace configuration for data access compliance",
+  "category": "Productivity",
+  "docsUrl": "https://airtable.com/developers/web/api/introduction",
+  "baseUrl": "https://api.airtable.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "airtable_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Airtable bases and verifies workspace is properly configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "airtable_access_review",
+      "name": "Access Review Log",
+      "description": "Reviews Airtable workspace configuration for access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/aiven.json b/integrations-catalog/integrations/aiven.json
new file mode 100644
index 0000000000..4428af1b96
--- /dev/null
+++ b/integrations-catalog/integrations/aiven.json
@@ -0,0 +1,45 @@
+{
+  "slug": "aiven",
+  "name": "Aiven",
+  "description": "Monitor Aiven managed database services for infrastructure inventory and access compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.aiven.io/docs/tools/api",
+  "baseUrl": "https://api.aiven.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Aiven at https://console.aiven.io\n2. Click your user icon → Profile\n3. Go to Authentication → Tokens\n4. Create a new token and enter it below",
+      "credentialFields": [
+        {
+          "label": "Authentication Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Aiven Console → Profile → Authentication → Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "aiven_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Aiven managed database services for cloud infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "aiven_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Aiven account users with access to managed database services",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/akamai.json b/integrations-catalog/integrations/akamai.json
new file mode 100644
index 0000000000..c74cfb0c5f
--- /dev/null
+++ b/integrations-catalog/integrations/akamai.json
@@ -0,0 +1,70 @@
+{
+  "slug": "akamai",
+  "name": "Akamai",
+  "description": "Monitor Akamai CDN configurations, edge security policies, and API client access",
+  "category": "Infrastructure",
+  "docsUrl": "https://techdocs.akamai.com/developer/docs/edgegrid",
+  "baseUrl": "https://placeholder.luna.akamaiapis.net",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Akamai Control Center\n2. Go to Identity and Access Management\n3. Click Create API client\n4. Select Quick for basic access or Advanced for specific API permissions\n5. Download the .edgerc file\n6. Copy the host, client_token, client_secret, and access_token values\n\nRequired API permissions:\n- Identity Management: read access (for Employee Access check)\n- Property Manager: read access (for Infrastructure Inventory check)\n- Application Security: read access (for Production Firewall check)",
+      "credentialFields": [
+        {
+          "label": "API Host",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Akamai API host from the .edgerc file (e.g., akab-xxxxx.luna.akamaiapis.net). Do NOT include https://"
+        },
+        {
+          "label": "Client Token",
+          "type": "text",
+          "required": true,
+          "helpText": "Client token from your .edgerc file (starts with akab-)"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Client secret from your .edgerc file"
+        },
+        {
+          "label": "Access Token",
+          "type": "text",
+          "required": true,
+          "helpText": "Access token from your .edgerc file (starts with akab-)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Verifies API client authentication and retrieves the current user profile to confirm access controls are in place",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all Akamai property configurations to provide an inventory of CDN and edge delivery assets",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "production_firewall",
+      "name": "Production Firewall",
+      "description": "Lists Akamai Application Security configurations to verify WAF and edge security policies are in place",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/alexishr.json b/integrations-catalog/integrations/alexishr.json
new file mode 100644
index 0000000000..5fec49244b
--- /dev/null
+++ b/integrations-catalog/integrations/alexishr.json
@@ -0,0 +1,36 @@
+{
+  "slug": "alexishr",
+  "name": "AlexisHR",
+  "description": "Modern HR platform. Monitor employee records and organizational data.",
+  "category": "HR & People",
+  "docsUrl": "https://docs.alexishr.com/",
+  "baseUrl": "https://api.alexishr.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "alexishr_app_availability",
+      "name": "AlexisHR App Availability",
+      "description": "Verifies AlexisHR API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "alexishr_employee_access",
+      "name": "AlexisHR Employee Access",
+      "description": "Verifies employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/algolia.json b/integrations-catalog/integrations/algolia.json
new file mode 100644
index 0000000000..05794cf6a6
--- /dev/null
+++ b/integrations-catalog/integrations/algolia.json
@@ -0,0 +1,51 @@
+{
+  "slug": "algolia",
+  "name": "Algolia",
+  "description": "Monitor Algolia search infrastructure for index security and API key access compliance",
+  "category": "Development",
+  "docsUrl": "https://www.algolia.com/doc/rest-api/search/",
+  "baseUrl": "https://algolia.net/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Algolia at https://dashboard.algolia.com\n2. Go to Settings → API Keys\n3. Copy your Application ID and Admin API Key\n4. Enter both below",
+      "credentialFields": [
+        {
+          "label": "Application ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Algolia Dashboard → Settings → API Keys (Application ID)"
+        },
+        {
+          "label": "Admin API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Algolia Dashboard → Settings → API Keys (Admin API Key — keep this secret)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "algolia_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Algolia search indexes for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "algolia_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Algolia API keys are scoped with least-privilege permissions",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/amplitude.json b/integrations-catalog/integrations/amplitude.json
new file mode 100644
index 0000000000..c3b3ddf5cb
--- /dev/null
+++ b/integrations-catalog/integrations/amplitude.json
@@ -0,0 +1,35 @@
+{
+  "slug": "amplitude",
+  "name": "Amplitude",
+  "description": "Monitor Amplitude projects and user access for product analytics compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://www.docs.developers.amplitude.com/analytics/apis/management-api/",
+  "baseUrl": "https://management.us.amplitude.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "amplitude_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Amplitude projects are configured and tracking is active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "amplitude_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Amplitude users with analytics access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/anodot.json b/integrations-catalog/integrations/anodot.json
new file mode 100644
index 0000000000..2f98f6c3bb
--- /dev/null
+++ b/integrations-catalog/integrations/anodot.json
@@ -0,0 +1,45 @@
+{
+  "slug": "anodot",
+  "name": "Anodot",
+  "description": "Anodot AI-powered monitoring and anomaly detection",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.anodot.com/",
+  "baseUrl": "https://app.anodot.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Anodot\n2. Settings → Access Tokens\n3. Create a new token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Anodot → Settings → Access Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "anodot_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Anodot has active anomaly detection alerts",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "anodot_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Anodot users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/anthropic.json b/integrations-catalog/integrations/anthropic.json
new file mode 100644
index 0000000000..865dae2a92
--- /dev/null
+++ b/integrations-catalog/integrations/anthropic.json
@@ -0,0 +1,35 @@
+{
+  "slug": "anthropic",
+  "name": "Anthropic",
+  "description": "AI safety company building Claude. Monitor API access and usage.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.anthropic.com/en/api/",
+  "baseUrl": "https://api.anthropic.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "anthropic_app_availability",
+      "name": "Anthropic App Availability",
+      "description": "Checks that the Anthropic API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "anthropic_employee_access",
+      "name": "Anthropic Employee Access",
+      "description": "Verifies employee access to Anthropic via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/apiiro.json b/integrations-catalog/integrations/apiiro.json
new file mode 100644
index 0000000000..d26e6cfacf
--- /dev/null
+++ b/integrations-catalog/integrations/apiiro.json
@@ -0,0 +1,45 @@
+{
+  "slug": "apiiro",
+  "name": "Apiiro",
+  "description": "Apiiro risk-based application security platform",
+  "category": "Security",
+  "docsUrl": "https://docs.apiiro.com/",
+  "baseUrl": "https://app.apiiro.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Apiiro\n2. Settings → API Tokens\n3. Create a token with read access\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Apiiro → Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "apiiro_code_security",
+      "name": "Code Changes",
+      "description": "Verifies Apiiro has repositories connected for risk scanning",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "apiiro_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Apiiro users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/apollo.json b/integrations-catalog/integrations/apollo.json
new file mode 100644
index 0000000000..07fc642c2c
--- /dev/null
+++ b/integrations-catalog/integrations/apollo.json
@@ -0,0 +1,45 @@
+{
+  "slug": "apollo",
+  "name": "Apollo.io",
+  "description": "Monitor Apollo.io sales intelligence platform for API access and contact data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://apolloio.github.io/apollo-api-docs/",
+  "baseUrl": "https://api.apollo.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Apollo.io at https://app.apollo.io\n2. Go to Settings → Integrations → API\n3. Copy your API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Apollo.io Settings → Integrations → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "apollo_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Apollo.io API credentials are active for sales intelligence access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "apollo_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Apollo.io contact data access is controlled via scoped API keys",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/apple-business-manager.json b/integrations-catalog/integrations/apple-business-manager.json
new file mode 100644
index 0000000000..8d9008faba
--- /dev/null
+++ b/integrations-catalog/integrations/apple-business-manager.json
@@ -0,0 +1,70 @@
+{
+  "slug": "apple-business-manager",
+  "name": "Apple Business Manager",
+  "description": "Verify device enrollment, MDM assignment, and profile status in Apple Business Manager (DEP)",
+  "category": "Security",
+  "docsUrl": "https://developer.apple.com/documentation/devicemanagement/device-assignment",
+  "baseUrl": "https://mdmenrollment.apple.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log into Apple Business (business.apple.com) as an Administrator\n2. Go to Settings > MDM Server > your MDM server name\n3. Click 'Download Token' to get the server token file (.p7m)\n4. Decrypt the S/MIME token using your MDM server's private key\n5. The decrypted JSON contains: consumer_key, consumer_secret, access_token, access_secret\n6. Enter those 4 values below\n\nNote: Your MDM server must be registered in Apple Business before you can download a token.",
+      "credentialFields": [
+        {
+          "label": "Consumer Key",
+          "type": "text",
+          "required": true,
+          "helpText": "The consumer_key from your decrypted DEP server token"
+        },
+        {
+          "label": "Consumer Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "The consumer_secret from your decrypted DEP server token"
+        },
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "The access_token from your decrypted DEP server token"
+        },
+        {
+          "label": "Access Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "The access_secret from your decrypted DEP server token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "abm_connectivity",
+      "name": "App Availability",
+      "description": "Verifies connectivity to Apple Business Manager DEP API by establishing an OAuth 1.0a session",
+      "defaultSeverity": "critical",
+      "enabled": true
+    },
+    {
+      "slug": "abm_device_enrollment",
+      "name": "Secure Devices",
+      "description": "Checks that devices are registered in Apple Business Manager and assigned to an MDM server with enrollment profiles",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "abm_device_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Maintains an inventory of all devices registered in Apple Business Manager with their details",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/aqua-security.json b/integrations-catalog/integrations/aqua-security.json
new file mode 100644
index 0000000000..2ce9471324
--- /dev/null
+++ b/integrations-catalog/integrations/aqua-security.json
@@ -0,0 +1,45 @@
+{
+  "slug": "aqua-security",
+  "name": "Aqua Security",
+  "description": "Aqua Security cloud-native security platform",
+  "category": "Security",
+  "docsUrl": "https://docs.aquasec.com/",
+  "baseUrl": "https://api.cloudsploit.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to cloud.aquasec.com\n2. Settings → API Keys\n3. Create an API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Aqua Platform → Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "aqua_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Aqua Security users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "aqua_infra_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Verifies Aqua Security has scanned your infrastructure",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/asana.json b/integrations-catalog/integrations/asana.json
new file mode 100644
index 0000000000..45165e9177
--- /dev/null
+++ b/integrations-catalog/integrations/asana.json
@@ -0,0 +1,35 @@
+{
+  "slug": "asana",
+  "name": "Asana",
+  "description": "Monitor Asana workspace members and project organization for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.asana.com/docs",
+  "baseUrl": "https://app.asana.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "asana_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Asana workspace members and verifies active user access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "asana_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies that Asana projects are organized showing environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ashby.json b/integrations-catalog/integrations/ashby.json
new file mode 100644
index 0000000000..5a383014fc
--- /dev/null
+++ b/integrations-catalog/integrations/ashby.json
@@ -0,0 +1,38 @@
+{
+  "slug": "ashby",
+  "name": "Ashby",
+  "description": "Ashby all-in-one recruiting platform",
+  "category": "HR & People",
+  "docsUrl": "https://developers.ashbyhq.com/",
+  "baseUrl": "https://api.ashbyhq.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Ashby\n2. Go to Settings → Integrations → API Keys\n3. Create a new API key\n4. Run: echo -n 'YOUR_API_KEY:' | base64\n5. Paste the output below",
+      "credentialFields": [
+        {
+          "label": "Basic Auth Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64-encode your API key with a colon: echo -n 'your_api_key:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ashby_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Ashby is connected and accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/atera.json b/integrations-catalog/integrations/atera.json
new file mode 100644
index 0000000000..694733bc94
--- /dev/null
+++ b/integrations-catalog/integrations/atera.json
@@ -0,0 +1,51 @@
+{
+  "slug": "atera",
+  "name": "Atera",
+  "description": "Monitor Atera RMM for device security, patch compliance, and alert management across your managed endpoints",
+  "category": "Security",
+  "docsUrl": "https://app.atera.com/apidocs",
+  "baseUrl": "https://app.atera.com/api/v3/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Atera Admin > API Management"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_security",
+      "name": "Secure Devices",
+      "description": "Verifies that managed devices have antivirus enabled and are up to date with patches",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "active_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Checks for active critical alerts in the Atera monitoring system",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "device_inventory",
+      "name": "Device List",
+      "description": "Validates comprehensive inventory of all managed devices and endpoints",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/attio.json b/integrations-catalog/integrations/attio.json
new file mode 100644
index 0000000000..c4dd161264
--- /dev/null
+++ b/integrations-catalog/integrations/attio.json
@@ -0,0 +1,45 @@
+{
+  "slug": "attio",
+  "name": "Attio",
+  "description": "Monitor Attio CRM for team member access and workspace data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.attio.com/reference/get_v2-self",
+  "baseUrl": "https://api.attio.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Attio at https://app.attio.com\n2. Go to Workspace Settings → Developers → API Keys\n3. Create a new API key with read access\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Attio Workspace Settings → Developers → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "attio_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Attio workspace members and their CRM access permissions",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "attio_access_review",
+      "name": "Access Review Log",
+      "description": "Audits Attio workspace member roles for access review compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/auth0.json b/integrations-catalog/integrations/auth0.json
new file mode 100644
index 0000000000..1d95d8edc7
--- /dev/null
+++ b/integrations-catalog/integrations/auth0.json
@@ -0,0 +1,52 @@
+{
+  "slug": "auth0",
+  "name": "Auth0",
+  "description": "Monitor Auth0 MFA configuration, user access, and authentication logs for identity compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://auth0.com/docs/api/management/v2",
+  "baseUrl": "https://auth0.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Auth0 Dashboard > Applications > Create Application\n2. Select Machine to Machine\n3. Authorize the Auth0 Management API with read:users, read:logs, read:guardian_factors permissions\n4. Deploy and copy the access token\n5. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Management API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a Machine-to-Machine app authorized for the Auth0 Management API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mfa_factors",
+      "name": "2FA",
+      "description": "Verifies that at least one MFA factor is enabled in Auth0 Guardian",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews Auth0 users to verify employee access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "auth_logs",
+      "name": "Access Review Log",
+      "description": "Verifies Auth0 authentication logs are available for access review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/automox.json b/integrations-catalog/integrations/automox.json
new file mode 100644
index 0000000000..e946f67906
--- /dev/null
+++ b/integrations-catalog/integrations/automox.json
@@ -0,0 +1,35 @@
+{
+  "slug": "automox",
+  "name": "Automox",
+  "description": "Cloud-native endpoint management and patch automation. Monitor patch compliance and device status.",
+  "category": "Security",
+  "docsUrl": "https://developer.automox.com/",
+  "baseUrl": "https://console.automox.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "automox_app_availability",
+      "name": "Automox App Availability",
+      "description": "Checks that the Automox API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "automox_employee_access",
+      "name": "Automox Employee Access",
+      "description": "Verifies access to Automox.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/auvik.json b/integrations-catalog/integrations/auvik.json
new file mode 100644
index 0000000000..6901d9eced
--- /dev/null
+++ b/integrations-catalog/integrations/auvik.json
@@ -0,0 +1,56 @@
+{
+  "slug": "auvik",
+  "name": "Auvik",
+  "description": "Monitor Auvik network infrastructure for device inventory, alerts, and network management compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://support.auvik.com/hc/en-us/articles/360031007111-Auvik-API-Integration-Guide",
+  "baseUrl": "https://auvikapi.{{credentials.region}}.my.auvik.com",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Auvik > Admin > Integrations > API"
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Auvik > Admin > Integrations > API"
+        },
+        {
+          "label": "Region",
+          "type": "select",
+          "required": true,
+          "helpText": "Select your Auvik data region"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "List network devices from Auvik",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Check alerts from Auvik network monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/axiom.json b/integrations-catalog/integrations/axiom.json
new file mode 100644
index 0000000000..4a2a68e2c7
--- /dev/null
+++ b/integrations-catalog/integrations/axiom.json
@@ -0,0 +1,51 @@
+{
+  "slug": "axiom",
+  "name": "Axiom",
+  "description": "Monitor Axiom log analytics datasets and organization access for observability compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://axiom.co/docs/restapi/overview",
+  "baseUrl": "https://api.axiom.co/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Axiom at https://app.axiom.co\n2. Go to Settings > API Tokens\n3. Create a new API token with read access (or use a Personal Access Token)\n4. If using a PAT, also note your Organization ID from Settings > General\n5. Enter the values below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Axiom > Settings > API Tokens. Works with both API tokens and Personal Access Tokens (PAT)."
+        },
+        {
+          "label": "Organization ID",
+          "type": "text",
+          "required": false,
+          "helpText": "Required only if using a Personal Access Token (PAT). Found in Settings > General."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "axiom_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Axiom datasets are configured for log ingestion and observability",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "axiom_utility_monitoring",
+      "name": "Utility Monitoring",
+      "description": "Verifies Axiom monitors are configured for alerting on log anomalies",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/axonius.json b/integrations-catalog/integrations/axonius.json
new file mode 100644
index 0000000000..ac7f3e3b26
--- /dev/null
+++ b/integrations-catalog/integrations/axonius.json
@@ -0,0 +1,76 @@
+{
+  "slug": "axonius",
+  "name": "Axonius",
+  "description": "Axonius cybersecurity asset management platform integration for asset discovery, device compliance, and user visibility",
+  "category": "Security",
+  "docsUrl": "https://docs.axonius.com/docs/axonius-rest-api",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Axonius instance\n2. For Axonius v6.1.74 and later: go to System Settings > Managing Users and Roles > Managing Service Accounts, create a service account, and copy its API Key and API Secret\n3. For older versions (pre-6.1.74): click your user icon > User Settings and copy your API Key and API Secret\n4. Enter your full instance URL (e.g. https://mycompany.axonius.com), API Key, and API Secret above\n5. More details: https://docs.axonius.com/docs/manage-service-accounts",
+      "credentialFields": [
+        {
+          "label": "Instance URL",
+          "type": "text",
+          "required": true
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true
+        },
+        {
+          "label": "API Secret",
+          "type": "password",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "axonius_device_inventory",
+      "name": "Device List",
+      "description": "Retrieve and verify all discovered device assets from Axonius",
+      "defaultSeverity": "info",
+      "enabled": true
+    },
+    {
+      "slug": "axonius_adapter_coverage",
+      "name": "Infrastructure Inventory",
+      "description": "Verify adapter connections and data source coverage in Axonius",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "axonius_user_assets",
+      "name": "Employee Access",
+      "description": "Verify user asset discovery and access visibility in Axonius",
+      "defaultSeverity": "info",
+      "enabled": true
+    },
+    {
+      "slug": "axonius_system_health",
+      "name": "Monitoring & Alerting",
+      "description": "Verify Axonius system health, instance status, and discovery cycle",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "axonius_security_settings",
+      "name": "Secure Devices",
+      "description": "Check Axonius security settings and feature flags for security enforcement",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/azure-devops.json b/integrations-catalog/integrations/azure-devops.json
new file mode 100644
index 0000000000..43dcc34dc4
--- /dev/null
+++ b/integrations-catalog/integrations/azure-devops.json
@@ -0,0 +1,52 @@
+{
+  "slug": "azure-devops",
+  "name": "Azure DevOps",
+  "description": "Monitor Azure DevOps repositories, projects, and teams for development and access compliance",
+  "category": "Development",
+  "docsUrl": "https://learn.microsoft.com/en-us/rest/api/azure/devops/",
+  "baseUrl": "https://dev.azure.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Azure DevOps > User Settings (top right) > Personal access tokens\n2. Create a new token with Read permissions for Code, Project and Team\n3. Paste the token below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a PAT in Azure DevOps > User Settings > Personal access tokens. No encoding needed - just paste the token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "repos",
+      "name": "Code Changes",
+      "description": "Lists Azure DevOps Git repositories to verify code changes are tracked",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "projects",
+      "name": "Separation of Environments",
+      "description": "Verifies Azure DevOps projects exist for environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "teams",
+      "name": "Access Review Log",
+      "description": "Reviews Azure DevOps teams for access review log",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/backblaze.json b/integrations-catalog/integrations/backblaze.json
new file mode 100644
index 0000000000..b2f64a364a
--- /dev/null
+++ b/integrations-catalog/integrations/backblaze.json
@@ -0,0 +1,51 @@
+{
+  "slug": "backblaze",
+  "name": "Backblaze B2",
+  "description": "Backblaze B2 cloud object storage for backup and archival",
+  "category": "Infrastructure",
+  "docsUrl": "https://www.backblaze.com/apidocs",
+  "baseUrl": "https://api.backblazeb2.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Backblaze\n2. Go to Account → App Keys\n3. Note your Account ID and Application Key\n4. Encode them: echo -n 'accountId:applicationKey' | base64\n5. Paste the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Account ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Backblaze → Account → App Keys → Account ID"
+        },
+        {
+          "label": "Basic Auth Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Run: echo -n 'accountId:applicationKey' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "backblaze_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Backblaze B2 storage account is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "backblaze_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Backblaze B2 credentials are valid and storage access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bamboohr.json b/integrations-catalog/integrations/bamboohr.json
new file mode 100644
index 0000000000..940cb554b6
--- /dev/null
+++ b/integrations-catalog/integrations/bamboohr.json
@@ -0,0 +1,45 @@
+{
+  "slug": "bamboohr",
+  "name": "BambooHR",
+  "description": "Monitor employee records, onboarding/offboarding status, and HR compliance in BambooHR",
+  "category": "HR & People",
+  "docsUrl": "https://documentation.bamboohr.com/reference/",
+  "baseUrl": "https://api.bamboohr.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to BambooHR > profile icon > API Keys > Add New Key\n2. Copy the API key\n3. Encode it: run echo -n YOUR_API_KEY:x | base64\n4. Enter the encoded result and your subdomain below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode your API key: run echo -n YOUR_API_KEY:x | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_records",
+      "name": "Employee Verification",
+      "description": "Verifies that all active employees in BambooHR have required profile fields completed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_descriptions",
+      "name": "Employee Descriptions",
+      "description": "Verifies that active employees have job titles and department assignments documented",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/baremetrics.json b/integrations-catalog/integrations/baremetrics.json
new file mode 100644
index 0000000000..4ced762cb2
--- /dev/null
+++ b/integrations-catalog/integrations/baremetrics.json
@@ -0,0 +1,45 @@
+{
+  "slug": "baremetrics",
+  "name": "Baremetrics",
+  "description": "Monitor Baremetrics subscription analytics for revenue metrics and access compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.baremetrics.com/reference/introduction",
+  "baseUrl": "https://api.baremetrics.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Baremetrics at https://app.baremetrics.com\n2. Go to Settings → API\n3. Copy your API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Baremetrics Settings → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "baremetrics_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Baremetrics data sources are connected and syncing revenue data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "baremetrics_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Baremetrics account members with access to revenue data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/barracuda-email-gateway-defense.json b/integrations-catalog/integrations/barracuda-email-gateway-defense.json
new file mode 100644
index 0000000000..3b3acf68b5
--- /dev/null
+++ b/integrations-catalog/integrations/barracuda-email-gateway-defense.json
@@ -0,0 +1,48 @@
+{
+  "slug": "barracuda-email-gateway-defense",
+  "name": "Barracuda Email Gateway Defense",
+  "description": "Monitor Barracuda Email Gateway Defense cloud email security platform for domain configuration, account access, and security compliance",
+  "category": "Communication",
+  "docsUrl": "https://documentation.campus.barracuda.com/wiki/spaces/EGD/pages/2851437/Getting+Started+with+the+API",
+  "baseUrl": "https://api.barracudanetworks.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "scopes": [
+        "ess:account:read"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": false
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": true,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "account_access",
+      "name": "Employee Access",
+      "description": "Verifies employee access to Barracuda Email Gateway Defense accounts",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "domain_verification",
+      "name": "TLS / HTTPS",
+      "description": "Verifies that email domains are properly verified and configured in Barracuda Email Gateway Defense",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Barracuda Email Gateway Defense service monitoring and alerting configuration",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/basecamp.json b/integrations-catalog/integrations/basecamp.json
new file mode 100644
index 0000000000..98decf5a9d
--- /dev/null
+++ b/integrations-catalog/integrations/basecamp.json
@@ -0,0 +1,51 @@
+{
+  "slug": "basecamp",
+  "name": "Basecamp",
+  "description": "Monitor Basecamp project management platform for team access and collaboration compliance",
+  "category": "Productivity",
+  "docsUrl": "https://github.com/basecamp/bc3-api",
+  "baseUrl": "https://3.basecampapi.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Register an app at https://launchpad.37signals.com/integrations\n2. Authorize the app to get an access token\n3. Find your account ID in your Basecamp URL\n4. Enter both below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "OAuth2 access token from Basecamp. Authorize via https://launchpad.37signals.com/authorization/new"
+        },
+        {
+          "label": "Account ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Basecamp account ID — visible in your Basecamp URL: https://3.basecamp.com/{account_id}/"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "basecamp_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Basecamp team members with access to projects and collaboration data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "basecamp_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Basecamp project management platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/baseten.json b/integrations-catalog/integrations/baseten.json
new file mode 100644
index 0000000000..6b31e51295
--- /dev/null
+++ b/integrations-catalog/integrations/baseten.json
@@ -0,0 +1,45 @@
+{
+  "slug": "baseten",
+  "name": "Baseten",
+  "description": "Baseten ML model deployment and inference infrastructure platform",
+  "category": "Development",
+  "docsUrl": "https://docs.baseten.co",
+  "baseUrl": "https://api.baseten.co",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Baseten\n2. Go to Settings → API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Baseten → Settings → API Keys → Create API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "baseten_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Baseten ML platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "baseten_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Baseten models to verify ML infrastructure access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/beamer.json b/integrations-catalog/integrations/beamer.json
new file mode 100644
index 0000000000..91618ffde9
--- /dev/null
+++ b/integrations-catalog/integrations/beamer.json
@@ -0,0 +1,45 @@
+{
+  "slug": "beamer",
+  "name": "Beamer",
+  "description": "Beamer product changelog and announcement platform",
+  "category": "Productivity",
+  "docsUrl": "https://www.getbeamer.com/api-docs",
+  "baseUrl": "https://api.getbeamer.com/v0",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Beamer\n2. Settings → API & Integrations\n3. Copy your API Key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Beamer → Settings → API & Integrations"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "beamer_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Beamer is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "beamer_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Beamer team access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/beehiiv.json b/integrations-catalog/integrations/beehiiv.json
new file mode 100644
index 0000000000..42240478ee
--- /dev/null
+++ b/integrations-catalog/integrations/beehiiv.json
@@ -0,0 +1,35 @@
+{
+  "slug": "beehiiv",
+  "name": "beehiiv",
+  "description": "Newsletter platform for creators. Monitor publication access and management.",
+  "category": "Communication",
+  "docsUrl": "https://developers.beehiiv.com/docs/v2",
+  "baseUrl": "https://api.beehiiv.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "beehiiv_app_availability",
+      "name": "beehiiv App Availability",
+      "description": "Checks that the beehiiv API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "beehiiv_employee_access",
+      "name": "beehiiv Employee Access",
+      "description": "Verifies employee access to beehiiv via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/better-uptime.json b/integrations-catalog/integrations/better-uptime.json
new file mode 100644
index 0000000000..69109d7084
--- /dev/null
+++ b/integrations-catalog/integrations/better-uptime.json
@@ -0,0 +1,35 @@
+{
+  "slug": "better-uptime",
+  "name": "Better Stack",
+  "description": "Uptime monitoring and incident management platform.",
+  "category": "Monitoring",
+  "docsUrl": "https://betterstack.com/docs/uptime/api/",
+  "baseUrl": "https://uptime.betterstack.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "better_uptime_app_availability",
+      "name": "Better Stack App Availability",
+      "description": "Checks Better Stack app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "better_uptime_employee_access",
+      "name": "Better Stack Employee Access",
+      "description": "Checks Better Stack employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/betterstack.json b/integrations-catalog/integrations/betterstack.json
new file mode 100644
index 0000000000..2c0758b0bb
--- /dev/null
+++ b/integrations-catalog/integrations/betterstack.json
@@ -0,0 +1,35 @@
+{
+  "slug": "betterstack",
+  "name": "BetterStack",
+  "description": "Monitor BetterStack uptime monitors and incident alerts for availability compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://betterstack.com/docs/uptime/api/getting-started-with-uptime-api/",
+  "baseUrl": "https://uptime.betterstack.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "betterstack_app_availability",
+      "name": "App Availability",
+      "description": "Verifies BetterStack monitors are configured and services are up",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "betterstack_incident_response",
+      "name": "Incident Response",
+      "description": "Checks BetterStack for open incidents requiring response",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/beyond-trust.json b/integrations-catalog/integrations/beyond-trust.json
new file mode 100644
index 0000000000..bb5b34ffe3
--- /dev/null
+++ b/integrations-catalog/integrations/beyond-trust.json
@@ -0,0 +1,63 @@
+{
+  "slug": "beyond-trust",
+  "name": "BeyondTrust",
+  "description": "Monitor privileged access management, managed accounts, user groups, and managed systems in BeyondTrust Password Safe",
+  "category": "Security",
+  "docsUrl": "https://docs.beyondtrust.com/bips/v24.3/docs/api",
+  "baseUrl": "https://beyondtrust.placeholder.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "BeyondTrust API Base URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Full API base URL including path, e.g. https://your-server/BeyondTrust/api/public/v3"
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "API Key from BeyondTrust API Registration (Configuration > General > API Registrations)"
+        },
+        {
+          "label": "RunAs User",
+          "type": "text",
+          "required": true,
+          "helpText": "BeyondTrust RunAs user for API authentication (e.g. domain\\username or local user)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all managed accounts in BeyondTrust Password Safe to verify privileged account inventory and access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Lists user groups and roles in BeyondTrust to verify role-based access control configuration for privileged access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Lists managed systems and vaults in BeyondTrust Password Safe to verify secure credential management across infrastructure",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bigid.json b/integrations-catalog/integrations/bigid.json
new file mode 100644
index 0000000000..035ab57ef8
--- /dev/null
+++ b/integrations-catalog/integrations/bigid.json
@@ -0,0 +1,63 @@
+{
+  "slug": "bigid",
+  "name": "BigID",
+  "description": "Monitor BigID data privacy and discovery platform for data source inventory, user access, and scan status",
+  "category": "Security",
+  "docsUrl": "https://docs.bigid.com",
+  "baseUrl": "https://bigid.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "BigID Instance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Full URL of your BigID instance (e.g., https://your-company.bigid.cloud)"
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "BigID admin username for API access"
+        },
+        {
+          "label": "Password",
+          "type": "password",
+          "required": true,
+          "helpText": "BigID password for the admin user"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "data_source_inventory",
+      "name": "Systems Description",
+      "description": "Retrieves data source connections from BigID to verify data source inventory and classification coverage",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "platform_users",
+      "name": "Employee Access",
+      "description": "Retrieves BigID platform users to verify access controls and user management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "scan_status",
+      "name": "Monitoring & Alerting",
+      "description": "Retrieves BigID scan status to verify data discovery scans are running and completing successfully",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bird.json b/integrations-catalog/integrations/bird.json
new file mode 100644
index 0000000000..ecae0f0355
--- /dev/null
+++ b/integrations-catalog/integrations/bird.json
@@ -0,0 +1,45 @@
+{
+  "slug": "bird",
+  "name": "Bird",
+  "description": "Bird omnichannel communications platform for WhatsApp, email, SMS, and voice",
+  "category": "Communication",
+  "docsUrl": "https://docs.bird.com",
+  "baseUrl": "https://api.bird.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Bird\n2. Go to Developers → API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Bird → Developers → API Keys → Create API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "bird_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Bird communications platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bird_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Bird organization access and team membership",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bitbucket.json b/integrations-catalog/integrations/bitbucket.json
new file mode 100644
index 0000000000..5242b143f1
--- /dev/null
+++ b/integrations-catalog/integrations/bitbucket.json
@@ -0,0 +1,45 @@
+{
+  "slug": "bitbucket",
+  "name": "Bitbucket",
+  "description": "Monitor Bitbucket repositories and workspace members for source code management and access compliance",
+  "category": "Development",
+  "docsUrl": "https://developer.atlassian.com/cloud/bitbucket/rest/",
+  "baseUrl": "https://api.bitbucket.org/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Bitbucket\n2. Go to Personal Settings > App passwords\n3. Create an App Password with Repositories:Read and Account:Read permissions\n4. Base64-encode 'your_username:app_password'\n5. Paste the encoded string below",
+      "credentialFields": [
+        {
+          "label": "Base64 Encoded Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64-encode 'username:app_password'. Create an App Password in Bitbucket > Personal Settings > App passwords"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "repos",
+      "name": "Code Changes",
+      "description": "Lists Bitbucket repositories to verify code changes are tracked",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "members",
+      "name": "Employee Access",
+      "description": "Reviews Bitbucket workspace members for employee access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bitdefender-gravityzone.json b/integrations-catalog/integrations/bitdefender-gravityzone.json
new file mode 100644
index 0000000000..f0078851b9
--- /dev/null
+++ b/integrations-catalog/integrations/bitdefender-gravityzone.json
@@ -0,0 +1,72 @@
+{
+  "slug": "bitdefender-gravityzone",
+  "name": "Bitdefender GravityZone",
+  "description": "Monitor endpoint security, device inventory, and compliance policies in Bitdefender GravityZone",
+  "category": "Security",
+  "docsUrl": "https://www.bitdefender.com/business/support/en/77209-125277-public-api.html",
+  "baseUrl": "https://{{credentials.region}}/api/v1.0/jsonrpc/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log into your Bitdefender GravityZone Control Center\n2. Click your username (top-right) and select My Account\n3. Go to the API keys section and click Add\n4. Select the APIs you need (Network, Policies, General, Quarantine) and click Generate\n5. Copy the API key and paste it here\n6. Select your region (Global or EU)",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Bitdefender GravityZone API key from MyAccount > API keys in the Control Center"
+        },
+        {
+          "label": "Region",
+          "type": "select",
+          "required": true,
+          "helpText": "Select your GravityZone region"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "network_endpoints",
+      "name": "Secure Devices",
+      "description": "Verifies managed endpoints are protected and not infected",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_inventory",
+      "name": "Device List",
+      "description": "Lists managed and unmanaged devices in the network inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "security_policies",
+      "name": "Publish Policies",
+      "description": "Verifies security policies are configured in GravityZone",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "quarantine_management",
+      "name": "Monitoring & Alerting",
+      "description": "Monitors quarantined threats for recent security incidents",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "license_status",
+      "name": "Infrastructure Inventory",
+      "description": "Checks GravityZone license validity and slot usage",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bitsight.json b/integrations-catalog/integrations/bitsight.json
new file mode 100644
index 0000000000..ceabc4e26f
--- /dev/null
+++ b/integrations-catalog/integrations/bitsight.json
@@ -0,0 +1,66 @@
+{
+  "slug": "bitsight",
+  "name": "Bitsight",
+  "description": "Bitsight is a cybersecurity ratings platform that provides data-driven security ratings and risk analytics. This integration monitors your organization's security rating, risk vectors, vulnerability findings, alerting configuration, and third-party portfolio coverage.",
+  "category": "Security",
+  "docsUrl": "https://help.bitsighttech.com/hc/en-us/sections/360001428594-API-Guide",
+  "baseUrl": "https://api.bitsighttech.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to the Bitsight Security Ratings Platform at https://service.bitsight.com\n2. Go to Settings (gear icon) > Account > User Preferences\n3. Under 'User API Token' or 'Company API Token', generate a new token\n4. Copy the token and paste it here\n\nNote: Company API tokens provide broader access than user tokens and are not user-specific. API tokens should be treated as passwords.",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Your BitSight API token. Find it in the BitSight platform under Settings > Account > User Preferences > API Token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "bitsight_security_rating",
+      "name": "Bitsight Security Rating",
+      "description": "Verifies that the organization's Bitsight security rating is retrieved and meets acceptable thresholds. A rating below 640 indicates significant security risk.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bitsight_risk_vectors",
+      "name": "Bitsight Risk Vector Assessment",
+      "description": "Evaluates the organization's Bitsight risk vector grades across security categories (Compromised Systems, Diligence, User Behavior, Public Disclosures). Flags any risk vectors graded D or F.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bitsight_alerts_monitoring",
+      "name": "Bitsight Alerts Configuration",
+      "description": "Verifies that Bitsight alerting is active and configured. Checks for the presence of alert configurations to ensure security events are being monitored.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bitsight_portfolio_monitoring",
+      "name": "Bitsight Portfolio Monitoring",
+      "description": "Verifies third-party risk monitoring by checking the Bitsight portfolio for monitored companies. Ensures vendors and third parties are being tracked for security risk.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bitsight_vulnerability_findings",
+      "name": "Bitsight Vulnerability Findings",
+      "description": "Checks for open vulnerability findings in the organization's Bitsight profile. Reviews diligence findings that may indicate security gaps in the infrastructure.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bitwarden.json b/integrations-catalog/integrations/bitwarden.json
new file mode 100644
index 0000000000..0c8645e203
--- /dev/null
+++ b/integrations-catalog/integrations/bitwarden.json
@@ -0,0 +1,64 @@
+{
+  "slug": "bitwarden",
+  "name": "Bitwarden",
+  "description": "Bitwarden open-source password manager and credential vault for teams",
+  "category": "Security",
+  "docsUrl": "https://bitwarden.com/help/public-api",
+  "baseUrl": "https://api.bitwarden.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Bitwarden Web Vault\n2. Go to your Organization > Settings > API Key\n3. Copy the Client ID and Client Secret\n4. For Server Region: enter bitwarden.com (US), bitwarden.eu (EU), or your self-hosted domain",
+      "credentialFields": [
+        {
+          "label": "Server Region",
+          "type": "combobox",
+          "required": true,
+          "helpText": "Select US or EU, or type your self-hosted domain (e.g. bitwarden.company.com)"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Organization API client ID from Bitwarden Web Vault > Organization > Settings > API Key."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Organization API client secret."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "bitwarden_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Bitwarden organization members to verify credential vault access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bitwarden_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Bitwarden credential vault is active and accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bitwarden_2fa",
+      "name": "2FA",
+      "description": "Verifies all Bitwarden organization members have two-factor authentication enabled",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bob.json b/integrations-catalog/integrations/bob.json
new file mode 100644
index 0000000000..deba040358
--- /dev/null
+++ b/integrations-catalog/integrations/bob.json
@@ -0,0 +1,38 @@
+{
+  "slug": "bob",
+  "name": "HiBob",
+  "description": "HR platform for mid-size businesses. Monitor employee records and workforce data.",
+  "category": "HR & People",
+  "docsUrl": "https://apidocs.hibob.com/",
+  "baseUrl": "https://api.hibob.com",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "setupInstructions": "1. Log in to HiBob\n2. Go to Settings → Integrations → API\n3. Create a Service User\n4. Copy the Service User ID and Token\n5. Use Service User ID as username and Token as password below"
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "bob_app_availability",
+      "name": "HiBob App Availability",
+      "description": "Verifies HiBob API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bob_employee_access",
+      "name": "HiBob Employee Access",
+      "description": "Verifies employee directory access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bonusly.json b/integrations-catalog/integrations/bonusly.json
new file mode 100644
index 0000000000..ec74633d9c
--- /dev/null
+++ b/integrations-catalog/integrations/bonusly.json
@@ -0,0 +1,38 @@
+{
+  "slug": "bonusly",
+  "name": "Bonusly",
+  "description": "Bonusly employee recognition and rewards platform",
+  "category": "HR & People",
+  "docsUrl": "https://bonusly.docs.apiary.io/",
+  "baseUrl": "https://bonus.ly/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Bonusly\n2. Go to Account Settings → API\n3. Generate an API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Bonusly → Account Settings → API → Generate token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "bonusly_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Bonusly users to verify recognition platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/box.json b/integrations-catalog/integrations/box.json
new file mode 100644
index 0000000000..989fac4263
--- /dev/null
+++ b/integrations-catalog/integrations/box.json
@@ -0,0 +1,43 @@
+{
+  "slug": "box",
+  "name": "Box",
+  "description": "Monitor Box enterprise users and metadata templates for access management and encryption compliance",
+  "category": "Cloud",
+  "docsUrl": "https://developer.box.com/reference/",
+  "baseUrl": "https://api.box.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to Box Developer Console (app.box.com/developers/console)\n2. Create a new Custom App with OAuth 2.0 authentication\n3. Add redirect URL: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Set scopes: Manage Groups, Manage Enterprise Properties\n5. Copy Client ID and Client Secret",
+      "scopes": [
+        "manage_groups",
+        "manage_enterprise_properties"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews Box managed users for employee access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "metadata_templates",
+      "name": "Encryption at Rest",
+      "description": "Verifies that Box enterprise metadata templates are configured for data classification",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/braze.json b/integrations-catalog/integrations/braze.json
new file mode 100644
index 0000000000..1e9f748568
--- /dev/null
+++ b/integrations-catalog/integrations/braze.json
@@ -0,0 +1,51 @@
+{
+  "slug": "braze",
+  "name": "Braze",
+  "description": "Monitor Braze customer engagement platform for API security and campaign access compliance",
+  "category": "Communication",
+  "docsUrl": "https://www.braze.com/docs/api/basics/",
+  "baseUrl": "https://rest.iad-01.braze.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Braze at https://dashboard.braze.com\n2. Go to Settings → API Keys\n3. Create a key with campaigns.list permission\n4. Find your REST endpoint URL in the same settings page\n5. Enter both below",
+      "credentialFields": [
+        {
+          "label": "REST API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Braze → Settings → API Keys (create a key with campaigns.list and email.unsubscribes permissions)"
+        },
+        {
+          "label": "REST Endpoint URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Braze REST endpoint URL. Found in Braze → Settings → API Keys. Example: https://rest.iad-01.braze.com"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "braze_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Braze campaigns to audit active customer engagement workflows",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "braze_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Braze API keys are scoped with least-privilege permissions",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/breathe-hr.json b/integrations-catalog/integrations/breathe-hr.json
new file mode 100644
index 0000000000..c92c6e55c5
--- /dev/null
+++ b/integrations-catalog/integrations/breathe-hr.json
@@ -0,0 +1,46 @@
+{
+  "slug": "breathe-hr",
+  "name": "Breathe HR",
+  "description": "HR software for SMEs. Monitor employee records and leave management.",
+  "category": "HR & People",
+  "docsUrl": "https://developer.breathehr.com/",
+  "baseUrl": "https://api.breathehr.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Breathe HR\n2. Go to Settings → API Keys\n3. Generate a new API key\n4. Copy and paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Breathe HR → Settings → API Keys → Generate New Key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "breathe_hr_app_availability",
+      "name": "Breathe HR App Availability",
+      "description": "Verifies Breathe HR API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "breathe_hr_employee_access",
+      "name": "Breathe HR Employee Access",
+      "description": "Verifies employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/brevo.json b/integrations-catalog/integrations/brevo.json
new file mode 100644
index 0000000000..75165b9cde
--- /dev/null
+++ b/integrations-catalog/integrations/brevo.json
@@ -0,0 +1,45 @@
+{
+  "slug": "brevo",
+  "name": "Brevo",
+  "description": "Monitor Brevo email marketing platform for user access and data compliance",
+  "category": "Communication",
+  "docsUrl": "https://developers.brevo.com/reference/getting-started-1",
+  "baseUrl": "https://api.brevo.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Brevo at https://app.brevo.com\n2. Go to Account → SMTP & API\n3. Click Generate a new API key\n4. Copy the key and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Brevo → Account → SMTP & API → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "brevo_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Brevo account users and their access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "brevo_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Brevo email sending domain is authenticated to prevent spoofing",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/brex.json b/integrations-catalog/integrations/brex.json
new file mode 100644
index 0000000000..8859c8061e
--- /dev/null
+++ b/integrations-catalog/integrations/brex.json
@@ -0,0 +1,28 @@
+{
+  "slug": "brex",
+  "name": "Brex",
+  "description": "Monitor Brex corporate card users and accounts for financial compliance",
+  "category": "Cloud",
+  "docsUrl": "https://developer.brex.com/docs/authentication/",
+  "baseUrl": "https://platform.brexapis.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "brex_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Brex users with corporate card access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/browserstack.json b/integrations-catalog/integrations/browserstack.json
new file mode 100644
index 0000000000..7b75fbf12f
--- /dev/null
+++ b/integrations-catalog/integrations/browserstack.json
@@ -0,0 +1,45 @@
+{
+  "slug": "browserstack",
+  "name": "BrowserStack",
+  "description": "Monitor BrowserStack automated testing platform for test coverage and account compliance",
+  "category": "Development",
+  "docsUrl": "https://www.browserstack.com/docs/automate/api-reference/selenium/introduction",
+  "baseUrl": "https://api.browserstack.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to BrowserStack at https://browserstack.com\n2. Go to Account → Summary to find your Username and Access Key\n3. Encode them: base64('username:access_key')\n4. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'username:access_key'. Command: echo -n 'user@email.com:access_key' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "browserstack_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies BrowserStack automated testing is configured for validating code changes",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "browserstack_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies BrowserStack builds are running to validate code quality",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/buddy.json b/integrations-catalog/integrations/buddy.json
new file mode 100644
index 0000000000..b5c3a1383c
--- /dev/null
+++ b/integrations-catalog/integrations/buddy.json
@@ -0,0 +1,45 @@
+{
+  "slug": "buddy",
+  "name": "Buddy",
+  "description": "Monitor Buddy CI/CD pipelines for automated build, test, and deployment compliance",
+  "category": "Development",
+  "docsUrl": "https://buddy.works/docs/api/getting-started/overview",
+  "baseUrl": "https://api.buddy.works/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Buddy at https://app.buddy.works\n2. Go to Profile → Personal Access Tokens\n3. Generate a new token with workspace and pipeline scopes\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Buddy Profile → Personal Access Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "buddy_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Buddy CI/CD pipelines are configured to automate code deployments",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "buddy_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Buddy account is active with authorized team members",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bugsnag.json b/integrations-catalog/integrations/bugsnag.json
new file mode 100644
index 0000000000..4ee1a8801a
--- /dev/null
+++ b/integrations-catalog/integrations/bugsnag.json
@@ -0,0 +1,35 @@
+{
+  "slug": "bugsnag",
+  "name": "Bugsnag",
+  "description": "Monitor Bugsnag error tracking and team access for incident management compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://bugsnagapiv2.docs.apiary.io/",
+  "baseUrl": "https://api.bugsnag.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "bugsnag_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Bugsnag has projects configured for error monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "bugsnag_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies Bugsnag has team members configured for incident response",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/buildkite.json b/integrations-catalog/integrations/buildkite.json
new file mode 100644
index 0000000000..82c53d5444
--- /dev/null
+++ b/integrations-catalog/integrations/buildkite.json
@@ -0,0 +1,45 @@
+{
+  "slug": "buildkite",
+  "name": "Buildkite",
+  "description": "Monitor Buildkite CI/CD pipelines for code change automation and deployment compliance",
+  "category": "Development",
+  "docsUrl": "https://buildkite.com/docs/apis/rest-api",
+  "baseUrl": "https://api.buildkite.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Buildkite at https://buildkite.com\n2. Go to Personal Settings → API Access Tokens\n3. Create a token with read_organizations and read_pipelines scopes\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Buildkite → Personal Settings → API Access Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "buildkite_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Buildkite pipelines are configured for automated code change validation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "buildkite_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Buildkite pipelines separate staging and production deployments",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/bunny-net.json b/integrations-catalog/integrations/bunny-net.json
new file mode 100644
index 0000000000..8b8c4e26bd
--- /dev/null
+++ b/integrations-catalog/integrations/bunny-net.json
@@ -0,0 +1,45 @@
+{
+  "slug": "bunny-net",
+  "name": "Bunny.net",
+  "description": "Bunny.net CDN and video delivery network for global content distribution",
+  "category": "Infrastructure",
+  "docsUrl": "https://docs.bunny.net",
+  "baseUrl": "https://api.bunny.net",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Bunny.net\n2. Go to Account → API\n3. Copy your Access Key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Bunny.net → Account → API → Access Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "bunny_net_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Bunny.net CDN platform is accessible",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "bunny_net_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Bunny.net storage zones to verify CDN access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cal-com.json b/integrations-catalog/integrations/cal-com.json
new file mode 100644
index 0000000000..52aa6e0ca3
--- /dev/null
+++ b/integrations-catalog/integrations/cal-com.json
@@ -0,0 +1,45 @@
+{
+  "slug": "cal-com",
+  "name": "Cal.com",
+  "description": "Monitor Cal.com scheduling infrastructure for team access and availability compliance",
+  "category": "Productivity",
+  "docsUrl": "https://cal.com/docs/enterprise-features/api/api-reference",
+  "baseUrl": "https://api.cal.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Cal.com at https://cal.com\n2. Go to Settings → Developer → API Keys\n3. Create a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Cal.com Settings → Developer → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "calcom_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Cal.com team members and their scheduling access",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "calcom_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Cal.com scheduling service is active and accessible",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/calendly.json b/integrations-catalog/integrations/calendly.json
new file mode 100644
index 0000000000..9f0d7cfa7e
--- /dev/null
+++ b/integrations-catalog/integrations/calendly.json
@@ -0,0 +1,45 @@
+{
+  "slug": "calendly",
+  "name": "Calendly",
+  "description": "Monitor Calendly scheduling platform for team access and meeting link security compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.calendly.com/api-docs/",
+  "baseUrl": "https://api.calendly.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Calendly at https://calendly.com\n2. Go to Integrations → API & Webhooks\n3. Generate a Personal Access Token\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Calendly Integrations → API & Webhooks"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "calendly_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Calendly organization members and their scheduling access",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "calendly_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Calendly scheduling service is active",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/canny.json b/integrations-catalog/integrations/canny.json
new file mode 100644
index 0000000000..ef393971f6
--- /dev/null
+++ b/integrations-catalog/integrations/canny.json
@@ -0,0 +1,45 @@
+{
+  "slug": "canny",
+  "name": "Canny",
+  "description": "Monitor Canny product feedback platform for team access and user feedback data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.canny.io/api-reference",
+  "baseUrl": "https://canny.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Canny at https://canny.io\n2. Go to Settings → API\n3. Copy your API Key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Canny Settings → API → API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "canny_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Canny admin users with access to product feedback and voting data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "canny_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Canny product feedback platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/canva.json b/integrations-catalog/integrations/canva.json
new file mode 100644
index 0000000000..d1b219d756
--- /dev/null
+++ b/integrations-catalog/integrations/canva.json
@@ -0,0 +1,35 @@
+{
+  "slug": "canva",
+  "name": "Canva",
+  "description": "Design and visual content platform. Monitor team access and workspace.",
+  "category": "Productivity",
+  "docsUrl": "https://www.canva.dev/docs/connect/",
+  "baseUrl": "https://api.canva.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "canva_app_availability",
+      "name": "Canva App Availability",
+      "description": "Checks that the Canva API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "canva_employee_access",
+      "name": "Canva Employee Access",
+      "description": "Verifies access to Canva.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/carbon-black.json b/integrations-catalog/integrations/carbon-black.json
new file mode 100644
index 0000000000..6cb3a8a220
--- /dev/null
+++ b/integrations-catalog/integrations/carbon-black.json
@@ -0,0 +1,35 @@
+{
+  "slug": "carbon-black",
+  "name": "Carbon Black",
+  "description": "Monitor VMware Carbon Black endpoint protection and device security compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.carbonblack.com/reference/carbon-black-cloud/",
+  "baseUrl": "https://defense.conferdeploy.net/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cb_secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies Carbon Black endpoints are registered and protected",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "cb_device_list",
+      "name": "Device List",
+      "description": "Lists all endpoints managed by Carbon Black for device inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cato-networks.json b/integrations-catalog/integrations/cato-networks.json
new file mode 100644
index 0000000000..3aa9d06cd7
--- /dev/null
+++ b/integrations-catalog/integrations/cato-networks.json
@@ -0,0 +1,35 @@
+{
+  "slug": "cato-networks",
+  "name": "Cato Networks",
+  "description": "SASE platform providing SD-WAN and security services through a global cloud network",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "production_firewall",
+      "name": "Production Firewall",
+      "description": "Verify firewall policies and rules are properly configured for production environments",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verify security events monitoring and alerting configurations are in place",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/census.json b/integrations-catalog/integrations/census.json
new file mode 100644
index 0000000000..12616a366d
--- /dev/null
+++ b/integrations-catalog/integrations/census.json
@@ -0,0 +1,45 @@
+{
+  "slug": "census",
+  "name": "Census",
+  "description": "Monitor Census reverse ETL data pipelines for warehouse-to-destination sync compliance",
+  "category": "Development",
+  "docsUrl": "https://docs.getcensus.com/api-reference/introduction",
+  "baseUrl": "https://app.getcensus.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Census at https://app.getcensus.com\n2. Go to Settings → API Keys\n3. Generate a new API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Census Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "census_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Census source connections are configured for structured data pipeline management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "census_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Census syncs are running to keep downstream tools updated",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ceridian-dayforce.json b/integrations-catalog/integrations/ceridian-dayforce.json
new file mode 100644
index 0000000000..65bf538c5d
--- /dev/null
+++ b/integrations-catalog/integrations/ceridian-dayforce.json
@@ -0,0 +1,64 @@
+{
+  "slug": "ceridian-dayforce",
+  "name": "Ceridian Dayforce",
+  "description": "Monitor employee access, role assignments, and sync employee records from Ceridian Dayforce HCM",
+  "category": "HR & People",
+  "docsUrl": "https://developers.dayforce.com/Build/API-Explorer.aspx",
+  "baseUrl": "https://placeholder.dayforcehcm.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Contact your Dayforce admin for API access credentials\n2. You will need: your Dayforce host URL, client namespace, and a service account username/password\n3. The host is the domain from your Dayforce URL (e.g. usXXservices.dayforcehcm.com)\n4. The namespace is your company identifier in the API path",
+      "credentialFields": [
+        {
+          "label": "Dayforce Host",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Dayforce instance hostname (e.g. usXXservices.dayforcehcm.com or your-company.dayforcehcm.com)"
+        },
+        {
+          "label": "Client Namespace",
+          "type": "text",
+          "required": true,
+          "helpText": "The company identifier used in API paths (provided by your Dayforce admin)"
+        },
+        {
+          "label": "API Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Dayforce service account username for API access"
+        },
+        {
+          "label": "API Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Dayforce service account password"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all employees from Dayforce and verifies their employment status is tracked",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access_controls",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that employees have defined roles assigned in Dayforce for proper access control",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/certn.json b/integrations-catalog/integrations/certn.json
new file mode 100644
index 0000000000..26fb3561c9
--- /dev/null
+++ b/integrations-catalog/integrations/certn.json
@@ -0,0 +1,51 @@
+{
+  "slug": "certn",
+  "name": "Certn",
+  "description": "Monitor Certn background check platform for employee verification and access management compliance",
+  "category": "Security",
+  "docsUrl": "https://docs.certn.co/api",
+  "baseUrl": "https://api.certn.co",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Certn at https://app.certn.co/login\n2. Click the Partner tab in the dashboard\n3. Click Refresh Keys to generate a new Client ID and Secret\n4. Copy both values immediately (Secret is only shown once)\n5. Paste them here",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Certn Dashboard - Partner tab - API Keys"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Generated when creating/refreshing API keys in the Partner tab. Only shown once at creation time."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "certn_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies that background checks are being conducted through Certn for employee screening",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "certn_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews users with access to the Certn background check platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/chainguard.json b/integrations-catalog/integrations/chainguard.json
new file mode 100644
index 0000000000..b1fc5be781
--- /dev/null
+++ b/integrations-catalog/integrations/chainguard.json
@@ -0,0 +1,45 @@
+{
+  "slug": "chainguard",
+  "name": "Chainguard",
+  "description": "Chainguard container security and software supply chain protection",
+  "category": "Security",
+  "docsUrl": "https://edu.chainguard.dev/chainguard/chainctl",
+  "baseUrl": "https://console-api.enforce.dev",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Install chainctl CLI\n2. Run: chainctl auth login\n3. Run: chainctl auth token to retrieve your API token\n4. Paste the token below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Run: chainctl auth token to get your API token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "chainguard_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Chainguard platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "chainguard_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Chainguard organization members",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/chameleon.json b/integrations-catalog/integrations/chameleon.json
new file mode 100644
index 0000000000..8e3f8345a7
--- /dev/null
+++ b/integrations-catalog/integrations/chameleon.json
@@ -0,0 +1,45 @@
+{
+  "slug": "chameleon",
+  "name": "Chameleon",
+  "description": "Monitor Chameleon product adoption platform for access and user data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.chameleon.io/",
+  "baseUrl": "https://api.chameleon.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Chameleon at https://app.chameleon.io\n2. Go to Settings → API\n3. Copy your Account Secret\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Account Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Chameleon Dashboard → Settings → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "chameleon_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Chameleon team members with access to product tour and user adoption data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "chameleon_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Chameleon product adoption platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/chargebee.json b/integrations-catalog/integrations/chargebee.json
new file mode 100644
index 0000000000..df69a19c1f
--- /dev/null
+++ b/integrations-catalog/integrations/chargebee.json
@@ -0,0 +1,51 @@
+{
+  "slug": "chargebee",
+  "name": "Chargebee",
+  "description": "Monitor Chargebee subscription billing for revenue compliance and customer data management",
+  "category": "Productivity",
+  "docsUrl": "https://apidocs.chargebee.com/docs/api",
+  "baseUrl": "https://app.chargebee.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Chargebee at https://app.chargebee.com\n2. Go to Settings → Configure Chargebee → API Keys\n3. Copy your Full-Access or Read-Only API key\n4. Base64 encode 'api_key:' (with trailing colon, empty password)\n5. Enter your site name and encoded key below",
+      "credentialFields": [
+        {
+          "label": "Site Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Chargebee site name (e.g. mycompany — the subdomain of your Chargebee URL)"
+        },
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'api_key:' (with colon, empty password). Command: echo -n 'your_api_key:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "chargebee_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Chargebee user access to billing and subscription management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "chargebee_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Chargebee customer data is accessible only via authenticated API with proper scoping",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/charthop.json b/integrations-catalog/integrations/charthop.json
new file mode 100644
index 0000000000..3658120b17
--- /dev/null
+++ b/integrations-catalog/integrations/charthop.json
@@ -0,0 +1,59 @@
+{
+  "slug": "charthop",
+  "name": "ChartHop",
+  "description": "Monitor ChartHop people operations platform for employee access, role-based access controls, and organizational structure compliance",
+  "category": "HR & People",
+  "docsUrl": "https://docs.charthop.com/developer-basics",
+  "baseUrl": "https://api.charthop.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Contact support@charthop.com with subject 'New App Request' to create an API App for your organization\n2. Specify required permission levels (at minimum VIEW access)\n3. After approval, ChartHop will provide an API Authorization Token\n4. Enter the token and your Organization ID below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "ChartHop App API authorization token. Contact support@charthop.com to create an App for your organization."
+        },
+        {
+          "label": "Organization ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your ChartHop organization ID or slug (found in ChartHop URL or organization settings)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "charthop_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews ChartHop users with access to the people operations platform, checking for active and inactive accounts",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "charthop_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Reviews ChartHop roles and their associated policies to verify proper access control configuration",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "charthop_org_chart",
+      "name": "Organisation Chart",
+      "description": "Verifies that an organizational structure exists in ChartHop with active job positions",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/chartmogul.json b/integrations-catalog/integrations/chartmogul.json
new file mode 100644
index 0000000000..b88af1f362
--- /dev/null
+++ b/integrations-catalog/integrations/chartmogul.json
@@ -0,0 +1,45 @@
+{
+  "slug": "chartmogul",
+  "name": "ChartMogul",
+  "description": "Monitor ChartMogul revenue analytics for subscription data access and compliance",
+  "category": "Productivity",
+  "docsUrl": "https://dev.chartmogul.com/reference/introduction",
+  "baseUrl": "https://api.chartmogul.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to ChartMogul at https://app.chartmogul.com\n2. Go to Profile → View API Key\n3. Copy your API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in ChartMogul Profile → View API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "chartmogul_app_availability",
+      "name": "App Availability",
+      "description": "Verifies ChartMogul data sources are connected for revenue analytics",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "chartmogul_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews ChartMogul users with access to revenue analytics",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/checkly.json b/integrations-catalog/integrations/checkly.json
new file mode 100644
index 0000000000..e24f1a96b2
--- /dev/null
+++ b/integrations-catalog/integrations/checkly.json
@@ -0,0 +1,35 @@
+{
+  "slug": "checkly",
+  "name": "Checkly",
+  "description": "Monitor Checkly synthetic tests and alert channels for endpoint availability compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://developers.checklyhq.com/reference/",
+  "baseUrl": "https://api.checklyhq.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "checkly_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Checkly synthetic checks are configured and monitoring endpoints",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "checkly_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Checkly alert channels are configured to receive failure notifications",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/checkmarx.json b/integrations-catalog/integrations/checkmarx.json
new file mode 100644
index 0000000000..567dfd8b63
--- /dev/null
+++ b/integrations-catalog/integrations/checkmarx.json
@@ -0,0 +1,45 @@
+{
+  "slug": "checkmarx",
+  "name": "Checkmarx",
+  "description": "Checkmarx One SAST/SCA application security platform",
+  "category": "Security",
+  "docsUrl": "https://docs.checkmarx.com/",
+  "baseUrl": "https://ast.checkmarx.net",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Checkmarx One\n2. Go to IAM → API Keys\n3. Create a key with read access\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Checkmarx One → IAM → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "checkmarx_code_security",
+      "name": "Code Changes",
+      "description": "Verifies Checkmarx One has active security projects configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "checkmarx_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Checkmarx One users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/checkr.json b/integrations-catalog/integrations/checkr.json
new file mode 100644
index 0000000000..fe0a265a1c
--- /dev/null
+++ b/integrations-catalog/integrations/checkr.json
@@ -0,0 +1,35 @@
+{
+  "slug": "checkr",
+  "name": "Checkr",
+  "description": "Monitor Checkr background check candidates for HR verification compliance",
+  "category": "HR & People",
+  "docsUrl": "https://docs.checkr.com/reference",
+  "baseUrl": "https://api.checkr.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "checkr_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies Checkr is being used for background check screening",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "checkr_employee_descriptions",
+      "name": "Employee Descriptions",
+      "description": "Verifies Checkr screening packages are configured for role-based checks",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/circleci.json b/integrations-catalog/integrations/circleci.json
new file mode 100644
index 0000000000..2b0772cecd
--- /dev/null
+++ b/integrations-catalog/integrations/circleci.json
@@ -0,0 +1,45 @@
+{
+  "slug": "circleci",
+  "name": "CircleCI",
+  "description": "Monitor CircleCI pipelines and contexts for CI/CD code changes and secrets management compliance",
+  "category": "Development",
+  "docsUrl": "https://circleci.com/docs/api/v2/",
+  "baseUrl": "https://circleci.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to CircleCI\n2. Go to User Settings > Personal API Tokens\n3. Click 'Create New Token'\n4. Copy and paste the token below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a Personal API Token in CircleCI > User Settings > Personal API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pipelines",
+      "name": "Code Changes",
+      "description": "Lists CircleCI pipelines to verify code changes are tracked",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "contexts",
+      "name": "Secure Secrets",
+      "description": "Verifies that CircleCI contexts are configured for secure secrets management",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cisco-meraki.json b/integrations-catalog/integrations/cisco-meraki.json
new file mode 100644
index 0000000000..c5c5cb2954
--- /dev/null
+++ b/integrations-catalog/integrations/cisco-meraki.json
@@ -0,0 +1,45 @@
+{
+  "slug": "cisco-meraki",
+  "name": "Cisco Meraki",
+  "description": "Cloud-managed networking platform. Monitor network infrastructure and device access.",
+  "category": "Infrastructure",
+  "docsUrl": "https://developer.cisco.com/meraki/api-v1/",
+  "baseUrl": "https://api.meraki.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Meraki Dashboard\n2. Go to Organization → Settings\n3. Under API access, enable API and generate an API key\n4. Copy the key and paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Meraki Dashboard → Organization → Settings → API access → Generate API key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cisco_meraki_app_availability",
+      "name": "Cisco Meraki App Availability",
+      "description": "Verifies Meraki API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cisco_meraki_employee_access",
+      "name": "Cisco Meraki Employee Access",
+      "description": "Verifies access to Meraki network management.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cisco-secure-endpoint.json b/integrations-catalog/integrations/cisco-secure-endpoint.json
new file mode 100644
index 0000000000..436c6132fc
--- /dev/null
+++ b/integrations-catalog/integrations/cisco-secure-endpoint.json
@@ -0,0 +1,63 @@
+{
+  "slug": "cisco-secure-endpoint",
+  "name": "Cisco Secure Endpoint",
+  "description": "Monitor Cisco Secure Endpoint (formerly AMP for Endpoints) for device security, malware detection, and security policy compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.cisco.com/docs/secure-endpoint/",
+  "baseUrl": "https://api.amp.cisco.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "API region - use 'api.amp.cisco.com' for North America, 'api.eu.amp.cisco.com' for Europe, or 'api.apjc.amp.cisco.com' for Asia Pacific"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "3rd Party API Client ID from Cisco Secure Endpoint console"
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "API Key from Cisco Secure Endpoint console"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies that endpoint devices are properly protected and monitored by Cisco Secure Endpoint",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Reviews endpoint device inventory and connection status in Cisco Secure Endpoint",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies security event monitoring and policy enforcement across managed endpoints",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cisco-umbrella.json b/integrations-catalog/integrations/cisco-umbrella.json
new file mode 100644
index 0000000000..d3e4fda08a
--- /dev/null
+++ b/integrations-catalog/integrations/cisco-umbrella.json
@@ -0,0 +1,51 @@
+{
+  "slug": "cisco-umbrella",
+  "name": "Cisco Umbrella",
+  "description": "Cloud-delivered DNS security and web filtering platform. Monitor policies and admin access.",
+  "category": "Security",
+  "docsUrl": "https://developer.cisco.com/docs/cloud-security/",
+  "baseUrl": "https://api.umbrella.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Cisco Umbrella Dashboard\n2. Go to Admin → API Keys\n3. Create a new key with Admin scope\n4. Copy API Key and Secret\n5. Paste both below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "text",
+          "required": true,
+          "helpText": "From Umbrella Dashboard → Admin → API Keys."
+        },
+        {
+          "label": "API Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Shown once when creating the API key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cisco_umbrella_app_availability",
+      "name": "Cisco Umbrella App Availability",
+      "description": "Verifies Cisco Umbrella API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cisco_umbrella_employee_access",
+      "name": "Cisco Umbrella Admin Access",
+      "description": "Verifies admin access to Umbrella.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/civo.json b/integrations-catalog/integrations/civo.json
new file mode 100644
index 0000000000..afb11bf627
--- /dev/null
+++ b/integrations-catalog/integrations/civo.json
@@ -0,0 +1,45 @@
+{
+  "slug": "civo",
+  "name": "Civo",
+  "description": "Monitor Civo Kubernetes cloud infrastructure for cluster inventory and team access compliance",
+  "category": "Cloud",
+  "docsUrl": "https://www.civo.com/api",
+  "baseUrl": "https://api.civo.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Civo Dashboard at https://dashboard.civo.com\n2. Go to Settings → Profile → Security\n3. Generate an API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Civo Dashboard → Settings → Profile → Security"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "civo_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Civo Kubernetes clusters for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "civo_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Civo organization teams and member access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/clearbit.json b/integrations-catalog/integrations/clearbit.json
new file mode 100644
index 0000000000..232ed53150
--- /dev/null
+++ b/integrations-catalog/integrations/clearbit.json
@@ -0,0 +1,45 @@
+{
+  "slug": "clearbit",
+  "name": "Clearbit",
+  "description": "Monitor Clearbit B2B data enrichment for API access and data handling compliance",
+  "category": "Productivity",
+  "docsUrl": "https://dashboard.clearbit.com/docs",
+  "baseUrl": "https://company.clearbit.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Clearbit at https://dashboard.clearbit.com\n2. Go to API → Keys\n3. Copy your Secret API Key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Secret API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Clearbit Dashboard → API → Keys (Secret key)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "clearbit_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Clearbit API key is active and properly scoped for B2B data enrichment",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "clearbit_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Clearbit data enrichment access is appropriately restricted",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/clerk.json b/integrations-catalog/integrations/clerk.json
new file mode 100644
index 0000000000..44c705a7e1
--- /dev/null
+++ b/integrations-catalog/integrations/clerk.json
@@ -0,0 +1,35 @@
+{
+  "slug": "clerk",
+  "name": "Clerk",
+  "description": "Monitor Clerk user authentication — verify user access and authentication configuration",
+  "category": "Identity & Access",
+  "docsUrl": "https://clerk.com/docs/reference/backend-api",
+  "baseUrl": "https://api.clerk.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "clerk_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Clerk users and their authentication status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "clerk_2fa",
+      "name": "2FA",
+      "description": "Verifies Clerk MFA is configured for enhanced authentication security",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/clickhouse.json b/integrations-catalog/integrations/clickhouse.json
new file mode 100644
index 0000000000..899db86527
--- /dev/null
+++ b/integrations-catalog/integrations/clickhouse.json
@@ -0,0 +1,35 @@
+{
+  "slug": "clickhouse",
+  "name": "ClickHouse Cloud",
+  "description": "Cloud-native analytical database. Monitor organizations and service deployments.",
+  "category": "Cloud",
+  "docsUrl": "https://clickhouse.com/docs/en/cloud/manage/api/api-overview",
+  "baseUrl": "https://api.clickhouse.cloud",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "clickhouse_app_availability",
+      "name": "ClickHouse Cloud App Availability",
+      "description": "Checks that the ClickHouse Cloud API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "clickhouse_employee_access",
+      "name": "ClickHouse Cloud Employee Access",
+      "description": "Verifies employee access to ClickHouse Cloud via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/clickup.json b/integrations-catalog/integrations/clickup.json
new file mode 100644
index 0000000000..c7a49f7fbe
--- /dev/null
+++ b/integrations-catalog/integrations/clickup.json
@@ -0,0 +1,37 @@
+{
+  "slug": "clickup",
+  "name": "ClickUp",
+  "description": "Monitor ClickUp workspace members and space organization for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://clickup.com/api",
+  "baseUrl": "https://api.clickup.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to ClickUp as a Workspace Admin or Owner\n2. Click your avatar (top-right) > Settings > Apps\n3. Under API Token, click Generate and copy the token (starts with pk_)\n4. For the Team/Workspace ID, go to Settings > Workspace Settings — the ID is in the URL\n\nNote: Use an admin account's personal token. It gives workspace-wide access to members and spaces. Personal tokens never expire."
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "clickup_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews ClickUp workspace members and their roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "clickup_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies ClickUp spaces are organized for environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/clockify.json b/integrations-catalog/integrations/clockify.json
new file mode 100644
index 0000000000..66a84d591e
--- /dev/null
+++ b/integrations-catalog/integrations/clockify.json
@@ -0,0 +1,35 @@
+{
+  "slug": "clockify",
+  "name": "Clockify",
+  "description": "Time tracking platform. Monitor workspace access.",
+  "category": "Productivity",
+  "docsUrl": "https://clockify.me/developers-api",
+  "baseUrl": "https://api.clockify.me",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "clockify_app_availability",
+      "name": "Clockify App Availability",
+      "description": "Checks Clockify app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "clockify_employee_access",
+      "name": "Clockify Employee Access",
+      "description": "Checks Clockify employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/close-crm.json b/integrations-catalog/integrations/close-crm.json
new file mode 100644
index 0000000000..cbaa5348eb
--- /dev/null
+++ b/integrations-catalog/integrations/close-crm.json
@@ -0,0 +1,45 @@
+{
+  "slug": "close-crm",
+  "name": "Close CRM",
+  "description": "Monitor Close CRM for sales team access and customer data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.close.com/",
+  "baseUrl": "https://api.close.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Close at https://app.close.com\n2. Go to Settings → API Keys → Create API Key\n3. Base64 encode 'api_key:' (with colon): echo -n 'apikey:' | base64\n4. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'api_key:' (with trailing colon). Found in Close Settings → API Keys. Command: echo -n 'apikey:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "close_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Close CRM users with access to sales data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "close_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Close CRM platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/close.json b/integrations-catalog/integrations/close.json
new file mode 100644
index 0000000000..c178080386
--- /dev/null
+++ b/integrations-catalog/integrations/close.json
@@ -0,0 +1,35 @@
+{
+  "slug": "close",
+  "name": "Close",
+  "description": "Sales CRM platform. Monitor user access and pipeline data.",
+  "category": "Productivity",
+  "docsUrl": "https://developer.close.com/",
+  "baseUrl": "https://api.close.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "close_app_availability",
+      "name": "Close App Availability",
+      "description": "Checks Close app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "close_employee_access",
+      "name": "Close Employee Access",
+      "description": "Checks Close employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cloudflare.json b/integrations-catalog/integrations/cloudflare.json
new file mode 100644
index 0000000000..b43c673fa7
--- /dev/null
+++ b/integrations-catalog/integrations/cloudflare.json
@@ -0,0 +1,59 @@
+{
+  "slug": "cloudflare",
+  "name": "Cloudflare",
+  "description": "Monitor Cloudflare security settings including TLS/SSL configuration and WAF firewall rules for compliance evidence",
+  "category": "Infrastructure",
+  "docsUrl": "https://developers.cloudflare.com/api/",
+  "baseUrl": "https://api.cloudflare.com/client/v4/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Cloudflare Dashboard at https://dash.cloudflare.com.\n2. Go to My Profile > API Tokens > Create Token.\n3. Create a custom token with the following Zone permissions:\n   - Zone > Zone Settings > Read\n   - Zone > Zone > Read\n   - Zone > WAF > Read\n4. Set Zone Resources to 'All zones' (or select specific zones you want to monitor).\n5. Copy the token and enter it below.\n6. Copy the Zone ID(s) from each domain's overview page (right sidebar). You can enter multiple Zone IDs separated by commas.",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Cloudflare Dashboard > My Profile > API Tokens. Create a custom token with Zone Settings:Read, Zone:Read, and Zone WAF:Read permissions for all zones you want to monitor."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "tls_https",
+      "name": "TLS / HTTPS",
+      "description": "Verifies that Cloudflare SSL/TLS encryption mode is set to Full or Strict for end-to-end encryption across all monitored zones",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "production_firewall",
+      "name": "Production Firewall",
+      "description": "Verifies that Cloudflare WAF firewall rules are configured and active across all monitored zones",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Verifies Cloudflare data stores encryption at rest across all monitored zones - all Cloudflare storage is encrypted at rest by default using AES-256",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "app_availability",
+      "name": "App Availability",
+      "description": "Verifies Cloudflare zones are active with DDoS protection and performance features enabled",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cloudinary.json b/integrations-catalog/integrations/cloudinary.json
new file mode 100644
index 0000000000..892a766139
--- /dev/null
+++ b/integrations-catalog/integrations/cloudinary.json
@@ -0,0 +1,51 @@
+{
+  "slug": "cloudinary",
+  "name": "Cloudinary",
+  "description": "Monitor Cloudinary media management for asset security and API access compliance",
+  "category": "Cloud",
+  "docsUrl": "https://cloudinary.com/documentation/admin_api",
+  "baseUrl": "https://api.cloudinary.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Cloudinary at https://cloudinary.com/console\n2. Go to Settings → Access Keys\n3. Copy your API Key and API Secret\n4. Base64 encode 'api_key:api_secret'\n5. Enter your cloud name and encoded credentials below",
+      "credentialFields": [
+        {
+          "label": "Cloud Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Cloudinary cloud name (found in Dashboard)"
+        },
+        {
+          "label": "Encoded API Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'api_key:api_secret'. Found in Cloudinary Dashboard → Settings → Access Keys. Command: echo -n 'api_key:api_secret' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cloudinary_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Reviews Cloudinary media usage and storage for asset infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cloudinary_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Cloudinary sub-accounts and access keys for media access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cloudsmith.json b/integrations-catalog/integrations/cloudsmith.json
new file mode 100644
index 0000000000..d1c39fc094
--- /dev/null
+++ b/integrations-catalog/integrations/cloudsmith.json
@@ -0,0 +1,35 @@
+{
+  "slug": "cloudsmith",
+  "name": "Cloudsmith",
+  "description": "Monitor Cloudsmith artifact repository access and package security for software supply chain compliance",
+  "category": "Development",
+  "docsUrl": "https://help.cloudsmith.io/docs/api",
+  "baseUrl": "https://api.cloudsmith.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cloudsmith_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies Cloudsmith organizations are configured for secure package distribution",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cloudsmith_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Cloudsmith account is active and artifact signing is configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cobalt.json b/integrations-catalog/integrations/cobalt.json
new file mode 100644
index 0000000000..bf2ff48b63
--- /dev/null
+++ b/integrations-catalog/integrations/cobalt.json
@@ -0,0 +1,35 @@
+{
+  "slug": "cobalt",
+  "name": "Cobalt",
+  "description": "Pentest as a service platform. Monitor security assessments.",
+  "category": "Security",
+  "docsUrl": "https://docs.cobalt.io/",
+  "baseUrl": "https://api.cobalt.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cobalt_app_availability",
+      "name": "Cobalt App Availability",
+      "description": "Checks Cobalt app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cobalt_employee_access",
+      "name": "Cobalt Employee Access",
+      "description": "Checks Cobalt employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cockroachdb.json b/integrations-catalog/integrations/cockroachdb.json
new file mode 100644
index 0000000000..542526d98e
--- /dev/null
+++ b/integrations-catalog/integrations/cockroachdb.json
@@ -0,0 +1,45 @@
+{
+  "slug": "cockroachdb",
+  "name": "CockroachDB",
+  "description": "Monitor CockroachDB Cloud clusters for database infrastructure inventory and backup compliance",
+  "category": "Cloud",
+  "docsUrl": "https://www.cockroachlabs.com/docs/api/cloud/v1",
+  "baseUrl": "https://cockroachlabs.cloud/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to CockroachDB Cloud at https://cockroachlabs.cloud\n2. Go to Organization Settings → API Access\n3. Create a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in CockroachDB Cloud → Organization Settings → API Access"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cockroachdb_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists CockroachDB Cloud clusters for database infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cockroachdb_backup",
+      "name": "Backup Logs",
+      "description": "Verifies CockroachDB Cloud clusters have backup configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/coda.json b/integrations-catalog/integrations/coda.json
new file mode 100644
index 0000000000..82e754b00b
--- /dev/null
+++ b/integrations-catalog/integrations/coda.json
@@ -0,0 +1,35 @@
+{
+  "slug": "coda",
+  "name": "Coda",
+  "description": "Monitor Coda docs and workspace configuration for documentation compliance",
+  "category": "Productivity",
+  "docsUrl": "https://coda.io/developers/apis/v1",
+  "baseUrl": "https://coda.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "coda_access_review",
+      "name": "Access Review Log",
+      "description": "Verifies Coda workspace is accessible and docs are organized",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "coda_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Reviews Coda docs structure for organized workspace separation",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/codacy.json b/integrations-catalog/integrations/codacy.json
new file mode 100644
index 0000000000..50beb6ee91
--- /dev/null
+++ b/integrations-catalog/integrations/codacy.json
@@ -0,0 +1,45 @@
+{
+  "slug": "codacy",
+  "name": "Codacy",
+  "description": "Automated code quality and security analysis platform.",
+  "category": "Development",
+  "docsUrl": "https://api.codacy.com/api/v3/docs",
+  "baseUrl": "https://api.codacy.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Codacy\n2. Go to Account → API tokens\n3. Generate a new token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Codacy → Account → API tokens → Generate."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "codacy_app_availability",
+      "name": "Codacy App Availability",
+      "description": "Checks Codacy app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "codacy_employee_access",
+      "name": "Codacy Employee Access",
+      "description": "Checks Codacy employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/code42-incydr.json b/integrations-catalog/integrations/code42-incydr.json
new file mode 100644
index 0000000000..569104048c
--- /dev/null
+++ b/integrations-catalog/integrations/code42-incydr.json
@@ -0,0 +1,77 @@
+{
+  "slug": "code42-incydr",
+  "name": "Code42 Incydr",
+  "description": "Monitor Code42 Incydr insider risk management platform for device inventory, security alerts, file activity, user access, and audit logs for compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.code42.com/api/",
+  "baseUrl": "https://{{credentials.region}}/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "API client ID from Code42 Incydr console"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "API client secret from Code42 Incydr console"
+        },
+        {
+          "label": "Region",
+          "type": "select",
+          "required": true,
+          "helpText": "Select your Code42 region"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Verify devices are properly inventoried and monitored for insider risk management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "security_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Verify security alerts and monitoring sessions are configured and active for insider threat detection",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "file_activity_monitoring",
+      "name": "File Events",
+      "description": "Monitor file activity events for data exfiltration and unauthorized access patterns",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "user_access_review",
+      "name": "Employee Access",
+      "description": "Review user access and ensure proper user management for insider risk monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "audit_logs",
+      "name": "Incident Response",
+      "description": "Monitor Code42 Incydr investigation cases for insider risk incidents",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/codecov.json b/integrations-catalog/integrations/codecov.json
new file mode 100644
index 0000000000..ccd005fd35
--- /dev/null
+++ b/integrations-catalog/integrations/codecov.json
@@ -0,0 +1,35 @@
+{
+  "slug": "codecov",
+  "name": "Codecov",
+  "description": "Monitor Codecov code coverage reports to verify tests cover code changes",
+  "category": "Development",
+  "docsUrl": "https://docs.codecov.com/reference/overview",
+  "baseUrl": "https://codecov.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "codecov_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Codecov is tracking code coverage to ensure changes are tested",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "codecov_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies repositories are linked to Codecov for continuous coverage monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/codefresh.json b/integrations-catalog/integrations/codefresh.json
new file mode 100644
index 0000000000..369a972726
--- /dev/null
+++ b/integrations-catalog/integrations/codefresh.json
@@ -0,0 +1,35 @@
+{
+  "slug": "codefresh",
+  "name": "Codefresh",
+  "description": "CI/CD platform for Kubernetes and GitOps deployments. Monitor pipelines and user access.",
+  "category": "Development",
+  "docsUrl": "https://codefresh.io/docs/docs/integrations/codefresh-api/",
+  "baseUrl": "https://g.codefresh.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "codefresh_app_availability",
+      "name": "Codefresh App Availability",
+      "description": "Checks that the Codefresh API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "codefresh_employee_access",
+      "name": "Codefresh Employee Access",
+      "description": "Verifies employee access to Codefresh via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cohere.json b/integrations-catalog/integrations/cohere.json
new file mode 100644
index 0000000000..fe555a31e4
--- /dev/null
+++ b/integrations-catalog/integrations/cohere.json
@@ -0,0 +1,35 @@
+{
+  "slug": "cohere",
+  "name": "Cohere",
+  "description": "Enterprise AI platform for NLP and embeddings. Monitor API access.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.cohere.com/reference/",
+  "baseUrl": "https://api.cohere.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cohere_app_availability",
+      "name": "Cohere App Availability",
+      "description": "Checks that the Cohere API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cohere_employee_access",
+      "name": "Cohere Employee Access",
+      "description": "Verifies employee access to Cohere via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cohesity.json b/integrations-catalog/integrations/cohesity.json
new file mode 100644
index 0000000000..4dcc797f42
--- /dev/null
+++ b/integrations-catalog/integrations/cohesity.json
@@ -0,0 +1,75 @@
+{
+  "slug": "cohesity",
+  "name": "Cohesity",
+  "description": "Monitor Cohesity DataProtect for backup job status, cluster infrastructure inventory, and alerting for enterprise backup and data management compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.cohesity.com/docs/getting-started-641",
+  "baseUrl": "https://cohesity-cluster.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Cluster URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Cohesity cluster URL (e.g., https://cohesity.company.com)"
+        },
+        {
+          "label": "API Key",
+          "type": "secret",
+          "required": false,
+          "helpText": "Cohesity API key. Generate in Settings > Access Management > API Keys. If not using API key, provide username and password instead."
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": false,
+          "helpText": "Cohesity admin username (used if API Key is not provided)"
+        },
+        {
+          "label": "Password",
+          "type": "secret",
+          "required": false,
+          "helpText": "Cohesity admin password (used if API Key is not provided)"
+        },
+        {
+          "label": "Domain",
+          "type": "text",
+          "required": false,
+          "helpText": "Authentication domain (default: LOCAL)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "backup_jobs",
+      "name": "Backup logs",
+      "description": "Monitors Cohesity protection job status and recent backup runs to ensure backups are completing successfully",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Inventories Cohesity cluster nodes, protection sources, and storage domains to verify infrastructure is properly configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Reviews active Cohesity alerts to identify critical issues, hardware failures, and security events requiring attention",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/commvault.json b/integrations-catalog/integrations/commvault.json
new file mode 100644
index 0000000000..17f9969f25
--- /dev/null
+++ b/integrations-catalog/integrations/commvault.json
@@ -0,0 +1,63 @@
+{
+  "slug": "commvault",
+  "name": "Commvault",
+  "description": "Enterprise backup, recovery, and data management platform for cloud, virtual, and physical environments",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": "https://commvault.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Commvault Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Commvault Web Console or Command Center URL (e.g., https://commvault.company.com)"
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Commvault admin username with REST API access"
+        },
+        {
+          "label": "Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Password for the Commvault user"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "backup_jobs",
+      "name": "Backup Logs",
+      "description": "Reviews recent backup jobs to identify failures, warnings, and overall backup health across the Commvault environment",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all clients and servers registered in Commvault for backup and data protection coverage",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Checks for active alerts and alert rule configurations in Commvault to ensure monitoring is in place",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/conductorone.json b/integrations-catalog/integrations/conductorone.json
new file mode 100644
index 0000000000..2219dfcc8f
--- /dev/null
+++ b/integrations-catalog/integrations/conductorone.json
@@ -0,0 +1,79 @@
+{
+  "slug": "conductorone",
+  "name": "ConductorOne",
+  "description": "Monitor ConductorOne access governance including access reviews, role-based access controls, user management, application inventory, and access policies for compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://www.c1.ai/docs/conductorone-api/api",
+  "baseUrl": "https://conductorone.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to the C1 web app (https://your-tenant.conductor.one)\n2. Open your profile menu and select 'API Keys'\n3. Click 'Create credential'\n4. Give the key a name and select 'Full permissions' or 'Read-only Super Administrator'\n5. Click 'Create'\n6. Copy the Client ID and Client Secret (secret is only shown once)\n7. Your tenant domain is the subdomain in your ConductorOne URL (e.g., if your URL is https://mycompany.conductor.one, enter 'mycompany')\n\nNote: Tenant API URLs use *.conductor.one even though the product is now branded as C1.",
+      "credentialFields": [
+        {
+          "label": "Tenant Domain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your ConductorOne tenant subdomain. If your URL is https://mycompany.conductor.one, enter 'mycompany'."
+        },
+        {
+          "label": "API Key Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "The Client ID from your ConductorOne API key. Found in Profile > API Keys."
+        },
+        {
+          "label": "API Key Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "The Client Secret from your ConductorOne API key. This is only shown once when you create the key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "conductorone_access_review_log",
+      "name": "Access Review Log",
+      "description": "Verifies that access reviews are configured and being conducted in ConductorOne",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "conductorone_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that roles are configured in ConductorOne for proper access governance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "conductorone_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews ConductorOne users to verify employee access and directory status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "conductorone_app_inventory",
+      "name": "Application Inventory",
+      "description": "Lists and reviews applications managed in ConductorOne for access governance visibility",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "conductorone_policy_management",
+      "name": "Access Policies",
+      "description": "Reviews access governance policies configured in ConductorOne for compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/confluence.json b/integrations-catalog/integrations/confluence.json
new file mode 100644
index 0000000000..56aa3e97d0
--- /dev/null
+++ b/integrations-catalog/integrations/confluence.json
@@ -0,0 +1,45 @@
+{
+  "slug": "confluence",
+  "name": "Confluence",
+  "description": "Monitor Confluence spaces and user access for documentation and policy publishing compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.atlassian.com/cloud/confluence/rest/v1/",
+  "baseUrl": "https://atlassian.net/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to id.atlassian.com/manage-profile/security/api-tokens\n2. Click 'Create API token'\n3. Base64-encode 'your_email:api_token'\n4. Paste the encoded string below",
+      "credentialFields": [
+        {
+          "label": "Base64 Encoded Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64-encode 'email@example.com:api_token'. Create an API token at id.atlassian.com/manage-profile/security/api-tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "spaces",
+      "name": "Publish Policies",
+      "description": "Verifies Confluence spaces exist for policy publishing",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "members",
+      "name": "Employee Access",
+      "description": "Reviews Confluence group members for employee access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/confluent-cloud.json b/integrations-catalog/integrations/confluent-cloud.json
new file mode 100644
index 0000000000..d0c548fc79
--- /dev/null
+++ b/integrations-catalog/integrations/confluent-cloud.json
@@ -0,0 +1,49 @@
+{
+  "slug": "confluent-cloud",
+  "name": "Confluent Cloud",
+  "description": "Monitor Confluent Cloud (managed Apache Kafka) for user access, RBAC role bindings, infrastructure inventory, and encryption settings",
+  "category": "Infrastructure",
+  "docsUrl": "https://docs.confluent.io/cloud/current/api.html",
+  "baseUrl": "https://api.confluent.cloud",
+  "authConfig": {
+    "type": "basic",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all users and service accounts in the Confluent Cloud organization to verify access is appropriate",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rbac_role_bindings",
+      "name": "Role-based Access Controls",
+      "description": "Reviews RBAC role bindings across the Confluent Cloud organization to ensure least-privilege access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all environments and Kafka clusters in the Confluent Cloud organization for infrastructure tracking",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Verifies encryption configuration for Confluent Cloud by checking for BYOK (Bring Your Own Key) customer-managed encryption keys",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/connectwise-manage.json b/integrations-catalog/integrations/connectwise-manage.json
new file mode 100644
index 0000000000..5ff15888db
--- /dev/null
+++ b/integrations-catalog/integrations/connectwise-manage.json
@@ -0,0 +1,35 @@
+{
+  "slug": "connectwise-manage",
+  "name": "ConnectWise Manage",
+  "description": "ConnectWise PSA for service management and ticketing",
+  "category": "Productivity",
+  "docsUrl": "https://developer.connectwise.com/Products/Manage/REST",
+  "baseUrl": "https://placeholder.connectwise.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "incident_response",
+      "name": "Incident Response",
+      "description": "Verify service tickets and boards exist for incident tracking",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "List members and users to verify access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/contentful.json b/integrations-catalog/integrations/contentful.json
new file mode 100644
index 0000000000..ba302ac690
--- /dev/null
+++ b/integrations-catalog/integrations/contentful.json
@@ -0,0 +1,45 @@
+{
+  "slug": "contentful",
+  "name": "Contentful",
+  "description": "Monitor Contentful headless CMS for user access and content environment separation compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.contentful.com/developers/docs/references/content-management-api/",
+  "baseUrl": "https://api.contentful.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Contentful at https://app.contentful.com\n2. Go to Settings → CMA Tokens\n3. Generate a Personal Access Token\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Contentful Settings → CMA Tokens (Content Management API token)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "contentful_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Contentful organization members and their content management roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "contentful_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Contentful spaces have separate environments for development and production",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/contentstack.json b/integrations-catalog/integrations/contentstack.json
new file mode 100644
index 0000000000..eccc74f04a
--- /dev/null
+++ b/integrations-catalog/integrations/contentstack.json
@@ -0,0 +1,45 @@
+{
+  "slug": "contentstack",
+  "name": "Contentstack",
+  "description": "Monitor Contentstack enterprise headless CMS for team access and content delivery compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.contentstack.com/docs/developers/apis/content-management-api/",
+  "baseUrl": "https://api.contentstack.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Contentstack at https://app.contentstack.com\n2. Go to Account Settings → Tokens → Auth Tokens\n3. Generate a new auth token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Auth Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Contentstack Account → Tokens → Auth Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "contentstack_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Contentstack organization users with access to content management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "contentstack_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Contentstack CMS platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/contrast-security.json b/integrations-catalog/integrations/contrast-security.json
new file mode 100644
index 0000000000..a9338ba5f0
--- /dev/null
+++ b/integrations-catalog/integrations/contrast-security.json
@@ -0,0 +1,63 @@
+{
+  "slug": "contrast-security",
+  "name": "Contrast Security",
+  "description": "Application security testing platform. Monitor application vulnerabilities and compliance.",
+  "category": "Security",
+  "docsUrl": "https://docs.contrastsecurity.com/",
+  "baseUrl": "https://app.contrastsecurity.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Contrast Security\n2. Go to User Settings → Profile\n3. Copy your API Key, Service Key, Username, and Organization ID\n4. Paste all values below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Contrast → User Settings → Profile → API Key."
+        },
+        {
+          "label": "Service Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Contrast → User Settings → Profile → Service Key."
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Contrast Security username (email)."
+        },
+        {
+          "label": "Organization ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Contrast → User Settings → Profile → Organization ID."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "contrast_security_app_availability",
+      "name": "Contrast Security App Availability",
+      "description": "Verifies Contrast Security API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "contrast_security_employee_access",
+      "name": "Contrast Security Employee Access",
+      "description": "Verifies user access to Contrast Security.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/convertkit.json b/integrations-catalog/integrations/convertkit.json
new file mode 100644
index 0000000000..ebdf4b3604
--- /dev/null
+++ b/integrations-catalog/integrations/convertkit.json
@@ -0,0 +1,35 @@
+{
+  "slug": "convertkit",
+  "name": "Kit (ConvertKit)",
+  "description": "Email marketing platform for creators. Monitor account access and subscriber management.",
+  "category": "Communication",
+  "docsUrl": "https://developers.kit.com/v4",
+  "baseUrl": "https://api.convertkit.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "convertkit_app_availability",
+      "name": "Kit (ConvertKit) App Availability",
+      "description": "Checks that the Kit (ConvertKit) API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "convertkit_employee_access",
+      "name": "Kit (ConvertKit) Employee Access",
+      "description": "Verifies employee access to Kit (ConvertKit) via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/convex.json b/integrations-catalog/integrations/convex.json
new file mode 100644
index 0000000000..9a2c6a5623
--- /dev/null
+++ b/integrations-catalog/integrations/convex.json
@@ -0,0 +1,58 @@
+{
+  "slug": "convex",
+  "name": "Convex",
+  "description": "Monitor Convex projects, deployments, deploy keys, and team access for compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.convex.dev/management-api",
+  "baseUrl": "https://api.convex.dev/v1/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to https://dashboard.convex.dev/team/settings/access-tokens\n2. Copy your Team ID (numeric)\n3. Create or copy an Access Token\n4. Enter both values above",
+      "credentialFields": [
+        {
+          "label": "Team Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Get from Convex Dashboard > Team Settings > Access Tokens"
+        },
+        {
+          "label": "Team ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Numeric team ID, found in Team Settings alongside your access token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Convex projects and their deployments to verify access and deployment inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all deployments across projects with type, status, and configuration details",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "deploy_key_management",
+      "name": "Role-based Access Controls",
+      "description": "Audits deploy keys across all deployments to verify key management and access control",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/coolify.json b/integrations-catalog/integrations/coolify.json
new file mode 100644
index 0000000000..531b2e1193
--- /dev/null
+++ b/integrations-catalog/integrations/coolify.json
@@ -0,0 +1,35 @@
+{
+  "slug": "coolify",
+  "name": "Coolify",
+  "description": "Self-hosted PaaS for deploying applications. Monitor servers and service access.",
+  "category": "Infrastructure",
+  "docsUrl": "https://coolify.io/docs/api-reference",
+  "baseUrl": "https://app.coolify.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "coolify_app_availability",
+      "name": "Coolify App Availability",
+      "description": "Checks that the Coolify API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "coolify_employee_access",
+      "name": "Coolify Employee Access",
+      "description": "Verifies employee access to Coolify via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/copper.json b/integrations-catalog/integrations/copper.json
new file mode 100644
index 0000000000..dff32c924e
--- /dev/null
+++ b/integrations-catalog/integrations/copper.json
@@ -0,0 +1,51 @@
+{
+  "slug": "copper",
+  "name": "Copper CRM",
+  "description": "Monitor Copper CRM for sales team access and customer relationship data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.copper.com/",
+  "baseUrl": "https://api.copper.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Copper at https://app.copper.com\n2. Go to Settings → Integrations → API Keys\n3. Generate a new API key\n4. Enter the API key and the email of the user who generated it",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Copper Settings → Integrations → API Keys"
+        },
+        {
+          "label": "User Email",
+          "type": "text",
+          "required": true,
+          "helpText": "Email address of the Copper user who owns the API key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "copper_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Copper CRM users with access to customer relationship data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "copper_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Copper CRM platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/coralogix.json b/integrations-catalog/integrations/coralogix.json
new file mode 100644
index 0000000000..fab70b38d6
--- /dev/null
+++ b/integrations-catalog/integrations/coralogix.json
@@ -0,0 +1,51 @@
+{
+  "slug": "coralogix",
+  "name": "Coralogix",
+  "description": "Coralogix log analytics and monitoring platform",
+  "category": "Monitoring",
+  "docsUrl": "https://coralogix.com/docs/coralogix-rest-api/",
+  "baseUrl": "https://api.coralogix.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Coralogix\n2. Settings → API Access\n3. Copy the Alerts, Rules and Tags API Key\n4. Enter your region endpoint (default: api.coralogix.com)",
+      "credentialFields": [
+        {
+          "label": "Alerts API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Coralogix → Settings → API Access → Alerts, Rules and Tags API Key"
+        },
+        {
+          "label": "Region Endpoint",
+          "type": "text",
+          "required": false,
+          "helpText": "Your region API host. Examples: api.coralogix.com (US), api.eu2.coralogix.com (EU), api.coralogixsg.com (AP)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "coralogix_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Coralogix has active alerts configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "coralogix_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Coralogix users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cornerstone.json b/integrations-catalog/integrations/cornerstone.json
new file mode 100644
index 0000000000..5365a9c516
--- /dev/null
+++ b/integrations-catalog/integrations/cornerstone.json
@@ -0,0 +1,58 @@
+{
+  "slug": "cornerstone",
+  "name": "Cornerstone OnDemand",
+  "description": "Monitor Cornerstone OnDemand LMS user access and role-based access controls",
+  "category": "Productivity",
+  "docsUrl": "https://csod.dev/guides/getting-started/authentication.html",
+  "baseUrl": "https://{{credentials.portal_url}}",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Cornerstone portal\n2. Navigate to Admin > Tools > Edge > API Management\n3. Click 'Register New Application'\n4. Enter an application name (e.g. 'CompAI Integration')\n5. Enter the User ID of an active admin user (this acts as the service account)\n6. Under Scopes, select 'employee:read' and 'group:read'\n7. Click 'Register Application'\n8. Copy the Client ID and Client Secret immediately\n9. Enter your portal hostname (e.g. mycompany.csod.com), Client ID and Client Secret below",
+      "credentialFields": [
+        {
+          "label": "Portal URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Cornerstone portal hostname (e.g. 'mycompany.csod.com')"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth2 Client ID from Admin > Tools > Edge > API Management"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "OAuth2 Client Secret shown when registering the application. Copy it immediately - it is only shown once."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "cornerstone_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Cornerstone OnDemand users with their account status for access review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cornerstone_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Lists Cornerstone OnDemand user groups for role-based access control review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cortex-xdr.json b/integrations-catalog/integrations/cortex-xdr.json
new file mode 100644
index 0000000000..4067e79120
--- /dev/null
+++ b/integrations-catalog/integrations/cortex-xdr.json
@@ -0,0 +1,63 @@
+{
+  "slug": "cortex-xdr",
+  "name": "Cortex XDR",
+  "description": "Monitor endpoints, incidents, and alerts in Palo Alto Cortex XDR for endpoint detection and response",
+  "category": "Security",
+  "docsUrl": "https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API",
+  "baseUrl": "https://api-placeholder.xdr.us.paloaltonetworks.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API FQDN",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Cortex XDR API FQDN, e.g. api-YOURNAME.xdr.us.paloaltonetworks.com (no https:// prefix). Found in Settings > Configurations > Integrations > API Keys > View Examples."
+        },
+        {
+          "label": "API Key ID",
+          "type": "text",
+          "required": true,
+          "helpText": "The numeric ID of your API key. Found in Settings > Configurations > Integrations > API Keys."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "The API key value. Use a Standard security level key. Advanced keys require additional HMAC signing."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "endpoint_security",
+      "name": "Secure Devices",
+      "description": "Retrieves all endpoints managed by Cortex XDR and verifies their protection status",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "alerts_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Monitors Cortex XDR for active alerts and verifies alerting is functional",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "incident_response",
+      "name": "Incident Response",
+      "description": "Reviews incident response status in Cortex XDR to verify incidents are being managed and resolved",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/coupa.json b/integrations-catalog/integrations/coupa.json
new file mode 100644
index 0000000000..e76d2fe0eb
--- /dev/null
+++ b/integrations-catalog/integrations/coupa.json
@@ -0,0 +1,58 @@
+{
+  "slug": "coupa",
+  "name": "Coupa",
+  "description": "Monitor Coupa procurement and spend management platform for user access and role-based access controls",
+  "category": "Productivity",
+  "docsUrl": "https://compass.coupa.com/en-us/products/product-documentation/integration-technical-documentation/the-coupa-core-api",
+  "baseUrl": "https://placeholder.coupahost.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Coupa as an admin\n2. Go to Setup > OAuth2/OpenID Connect Clients\n3. Click Create with Grant Type: Client Credentials\n4. Select scopes: core.user.read\n5. Save and copy the Client ID and Secret\n6. Enter your instance URL (e.g. https://yourcompany.coupahost.com)",
+      "credentialFields": [
+        {
+          "label": "Instance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Coupa instance URL, e.g. https://yourcompany.coupahost.com"
+        },
+        {
+          "label": "Client ID (OIDC)",
+          "type": "text",
+          "required": true,
+          "helpText": "From Setup > OAuth2/OpenID Connect Clients in your Coupa instance"
+        },
+        {
+          "label": "Client Secret (OIDC)",
+          "type": "password",
+          "required": true,
+          "helpText": "The secret generated when you created the OIDC client in Coupa"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "coupa_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Coupa users to verify procurement platform access is properly managed",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "coupa_role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Verifies Coupa users have roles assigned for proper role-based access control",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/courier.json b/integrations-catalog/integrations/courier.json
new file mode 100644
index 0000000000..608c94dd1f
--- /dev/null
+++ b/integrations-catalog/integrations/courier.json
@@ -0,0 +1,45 @@
+{
+  "slug": "courier",
+  "name": "Courier",
+  "description": "Monitor Courier notification infrastructure for routing policies and delivery compliance",
+  "category": "Communication",
+  "docsUrl": "https://www.courier.com/docs/reference/",
+  "baseUrl": "https://api.courier.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Courier at https://app.courier.com\n2. Go to Settings → API Keys\n3. Copy your Production API Key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Courier Settings → API Keys (Production key)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "courier_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Courier workspace members with access to notification routing",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "courier_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Courier notification channels are configured and delivering",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/coursera-business.json b/integrations-catalog/integrations/coursera-business.json
new file mode 100644
index 0000000000..e86b2920b3
--- /dev/null
+++ b/integrations-catalog/integrations/coursera-business.json
@@ -0,0 +1,55 @@
+{
+  "slug": "coursera-business",
+  "name": "Coursera for Business",
+  "description": "Coursera for Business provides enterprise learning and compliance training, enabling organizations to upskill employees with courses from top universities and industry leaders.",
+  "category": "Security",
+  "docsUrl": "https://dev.coursera.com/get-started",
+  "baseUrl": "https://api.coursera.com/ent",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log into the Coursera Developer Portal at dev.coursera.com\n2. Click Sign In and authenticate via your Coursera account\n3. Register a new app and enable the Coursera For Business API\n4. Copy your App Key, App Secret from the app credentials page\n5. Find your Organization ID on the admin settings page at coursera.org/business/admin",
+      "credentialFields": [
+        {
+          "label": "API Key (App Key)",
+          "type": "text",
+          "required": true
+        },
+        {
+          "label": "API Secret (App Secret)",
+          "type": "secret",
+          "required": true
+        },
+        {
+          "label": "Organization ID",
+          "type": "text",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "coursera_business_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies that employees have access to Coursera for Business by listing users in the organization.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "coursera_business_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies employee training enrollment and completion status in Coursera for Business.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cronitor.json b/integrations-catalog/integrations/cronitor.json
new file mode 100644
index 0000000000..7cf10264aa
--- /dev/null
+++ b/integrations-catalog/integrations/cronitor.json
@@ -0,0 +1,35 @@
+{
+  "slug": "cronitor",
+  "name": "Cronitor",
+  "description": "Monitoring platform for cron jobs, heartbeats, and scheduled tasks.",
+  "category": "Monitoring",
+  "docsUrl": "https://cronitor.io/docs/api",
+  "baseUrl": "https://cronitor.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cronitor_app_availability",
+      "name": "Cronitor App Availability",
+      "description": "Checks that the Cronitor API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cronitor_employee_access",
+      "name": "Cronitor Employee Access",
+      "description": "Verifies employee access to Cronitor via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/crowdstrike.json b/integrations-catalog/integrations/crowdstrike.json
new file mode 100644
index 0000000000..53bbf1290f
--- /dev/null
+++ b/integrations-catalog/integrations/crowdstrike.json
@@ -0,0 +1,51 @@
+{
+  "slug": "crowdstrike",
+  "name": "CrowdStrike Falcon",
+  "description": "Monitor CrowdStrike Falcon endpoint security platform for device protection and threat detection compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.crowdstrike.com/crowdstrike/docs/welcome",
+  "baseUrl": "https://api.crowdstrike.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Falcon Console at https://falcon.crowdstrike.com\n2. Go to Support & Resources → API Clients and Keys\n3. Click Add new API client\n4. Enable scopes: Hosts (Read), User Management (Read)\n5. Copy the Client ID and Secret",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Falcon Console → Support → API Clients and Keys → Add new API client"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Generated when creating an API client in Falcon Console"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "crowdstrike_secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies CrowdStrike Falcon agent is deployed and protecting endpoints",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "crowdstrike_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews CrowdStrike Falcon users with access to the endpoint security platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/customer-io.json b/integrations-catalog/integrations/customer-io.json
new file mode 100644
index 0000000000..845fb29f47
--- /dev/null
+++ b/integrations-catalog/integrations/customer-io.json
@@ -0,0 +1,45 @@
+{
+  "slug": "customer-io",
+  "name": "Customer.io",
+  "description": "Monitor Customer.io marketing automation for user access and data handling compliance",
+  "category": "Communication",
+  "docsUrl": "https://customer.io/docs/api/app/",
+  "baseUrl": "https://api.customer.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Customer.io at https://fly.customer.io\n2. Go to Settings → Account Settings → API Credentials\n3. Create an App API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "App API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Customer.io Settings → API Credentials. Use the App API key (not tracking API key)."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "customerio_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Customer.io workspace users and their roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "customerio_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Customer.io account data handling and suppression settings",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cyberark-identity.json b/integrations-catalog/integrations/cyberark-identity.json
new file mode 100644
index 0000000000..8c4179d1a3
--- /dev/null
+++ b/integrations-catalog/integrations/cyberark-identity.json
@@ -0,0 +1,76 @@
+{
+  "slug": "cyberark-identity",
+  "name": "CyberArk Identity",
+  "description": "Monitor user access, MFA enrollment, and role-based access controls in CyberArk Identity (SSO/MFA)",
+  "category": "Security",
+  "docsUrl": "https://docs.cyberark.com/identity/latest/en/content/developer/developer-home.htm",
+  "baseUrl": "https://placeholder.id.cyberark.cloud",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Tenant URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your CyberArk Identity tenant URL, e.g. abc1234.id.cyberark.cloud (no https:// prefix)"
+        },
+        {
+          "label": "OAuth2 Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "The Client ID from your OAuth2 Confidential Client application in CyberArk Identity"
+        },
+        {
+          "label": "OAuth2 Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "The Client Secret from your OAuth2 Confidential Client application"
+        },
+        {
+          "label": "OAuth2 App ID",
+          "type": "text",
+          "required": true,
+          "helpText": "The OAuth2 application ID (used in the token endpoint path). Found in the app settings in Identity Administration."
+        },
+        {
+          "label": "OAuth2 Scope",
+          "type": "text",
+          "required": false,
+          "helpText": "OAuth2 scope (optional). Leave blank to use defaults."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Lists all users in CyberArk Identity directory to verify employee access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mfa_enrollment",
+      "name": "2FA",
+      "description": "Checks MFA enrollment status for users in CyberArk Identity to ensure multi-factor authentication is configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "role_access_controls",
+      "name": "Role-based Access Controls",
+      "description": "Reviews roles and administrative rights assignments in CyberArk Identity",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cyberark.json b/integrations-catalog/integrations/cyberark.json
new file mode 100644
index 0000000000..98c331f591
--- /dev/null
+++ b/integrations-catalog/integrations/cyberark.json
@@ -0,0 +1,57 @@
+{
+  "slug": "cyberark",
+  "name": "CyberArk",
+  "description": "CyberArk Privileged Access Management (PAM) platform that secures, manages, and monitors privileged accounts across your infrastructure.",
+  "category": "Identity & Access",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "type": "string",
+          "required": true
+        },
+        {
+          "type": "string",
+          "required": true
+        },
+        {
+          "type": "password",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verify that safes and vaults exist to securely store privileged accounts and secrets",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Verify that employee user accounts are properly managed within CyberArk",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access_controls",
+      "name": "Role-based Access Controls",
+      "description": "Verify that role-based access controls are configured through user groups and permissions",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/cycode.json b/integrations-catalog/integrations/cycode.json
new file mode 100644
index 0000000000..45be11234d
--- /dev/null
+++ b/integrations-catalog/integrations/cycode.json
@@ -0,0 +1,45 @@
+{
+  "slug": "cycode",
+  "name": "Cycode",
+  "description": "Cycode application security posture management and code security",
+  "category": "Security",
+  "docsUrl": "https://api.cycode.com/api/v1/docs",
+  "baseUrl": "https://api.cycode.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Cycode\n2. Go to Settings → API Tokens\n3. Generate a new API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Cycode → Settings → API Tokens → Generate Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cycode_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Cycode security platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "cycode_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Cycode is actively scanning code repositories",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/daily-co.json b/integrations-catalog/integrations/daily-co.json
new file mode 100644
index 0000000000..db45ac66ee
--- /dev/null
+++ b/integrations-catalog/integrations/daily-co.json
@@ -0,0 +1,45 @@
+{
+  "slug": "daily-co",
+  "name": "Daily",
+  "description": "Daily.co programmable video and audio infrastructure for real-time communication",
+  "category": "Communication",
+  "docsUrl": "https://docs.daily.co/reference",
+  "baseUrl": "https://api.daily.co",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Daily.co\n2. Go to Developers → API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Daily → Developers → API Keys → Create API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "daily_co_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Daily video infrastructure is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "daily_co_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Daily rooms to verify video infrastructure access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/darktrace.json b/integrations-catalog/integrations/darktrace.json
new file mode 100644
index 0000000000..d522ef15ba
--- /dev/null
+++ b/integrations-catalog/integrations/darktrace.json
@@ -0,0 +1,63 @@
+{
+  "slug": "darktrace",
+  "name": "Darktrace",
+  "description": "Monitor Darktrace AI-powered cybersecurity platform for model breaches, network devices, and AI Analyst incidents",
+  "category": "Security",
+  "docsUrl": "https://customerportal.darktrace.com/product-guides/main/api-tokens",
+  "baseUrl": "https://darktrace.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Darktrace Appliance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Full URL of your Darktrace appliance (e.g., https://darktrace.yourcompany.com)"
+        },
+        {
+          "label": "Public API Token",
+          "type": "text",
+          "required": true,
+          "helpText": "Threat Visualizer > System Config > Settings > API Token > New"
+        },
+        {
+          "label": "Private API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generated with the Public Token. Record securely — displayed only once."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "model_breaches",
+      "name": "Monitoring & Alerting",
+      "description": "Lists Darktrace model breaches from the past 7 days to verify active security monitoring and alerting coverage",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitored_devices",
+      "name": "Infrastructure Inventory",
+      "description": "Lists devices monitored by Darktrace to verify network infrastructure inventory and visibility",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ai_analyst_incidents",
+      "name": "Incident Response",
+      "description": "Checks Darktrace AI Analyst for critical incidents in the last 30 days to verify incident response coverage",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/darwinbox.json b/integrations-catalog/integrations/darwinbox.json
new file mode 100644
index 0000000000..9c0d1e51b4
--- /dev/null
+++ b/integrations-catalog/integrations/darwinbox.json
@@ -0,0 +1,77 @@
+{
+  "slug": "darwinbox",
+  "name": "Darwinbox",
+  "description": "Darwinbox is a global end-to-end cloud-based HRMS platform popular in the Asia-Pacific region, providing comprehensive HR management including employee lifecycle, payroll, attendance, and talent management.",
+  "category": "HR & People",
+  "docsUrl": "https://api-docs.darwinbox.com",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Contact your Darwinbox account manager or email integrationsteam@darwinbox.in to request API access\n2. You will receive: a username, password, API key, and dataset key\n3. Your subdomain is the part before .darwinbox.in in your Darwinbox URL (e.g. for https://acme.darwinbox.in, enter 'acme')\n4. Enter all credentials below\n\nNote: API access is provided on a request-only basis by the Darwinbox team.",
+      "credentialFields": [
+        {
+          "label": "Darwinbox Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Darwinbox subdomain. For example, if you access Darwinbox at https://acme.darwinbox.in, enter 'acme'."
+        },
+        {
+          "label": "API Username",
+          "type": "text",
+          "required": true,
+          "helpText": "The username provided by the Darwinbox team for API access."
+        },
+        {
+          "label": "API Password",
+          "type": "password",
+          "required": true,
+          "helpText": "The password provided by the Darwinbox team for API access."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "The API key provided by the Darwinbox team for endpoint authorization."
+        },
+        {
+          "label": "Dataset Key",
+          "type": "password",
+          "required": true,
+          "helpText": "The dataset key provided by the Darwinbox team. This determines which employee fields are returned."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "darwinbox_employee_access",
+      "name": "Darwinbox Employee Access",
+      "description": "Verifies that employee records can be accessed through the Darwinbox API, confirming the integration is properly configured and the API credentials have access to employee data.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "darwinbox_rbac",
+      "name": "Darwinbox Role-based Access Controls",
+      "description": "Verifies that role-based access controls are configured in Darwinbox by checking that employees have designated job titles and organizational roles assigned.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "darwinbox_org_chart",
+      "name": "Darwinbox Organisation Chart",
+      "description": "Verifies that the organizational structure is properly configured in Darwinbox by checking that employees have reporting managers and department hierarchies assigned.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/databricks.json b/integrations-catalog/integrations/databricks.json
new file mode 100644
index 0000000000..aea94007c9
--- /dev/null
+++ b/integrations-catalog/integrations/databricks.json
@@ -0,0 +1,35 @@
+{
+  "slug": "databricks",
+  "name": "Databricks",
+  "description": "Monitor Databricks workspace clusters and access for data platform compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.databricks.com/api/",
+  "baseUrl": "https://yourworkspace.azuredatabricks.net/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "databricks_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Databricks clusters for data infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "databricks_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Databricks workspace users and groups",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/datadog.json b/integrations-catalog/integrations/datadog.json
new file mode 100644
index 0000000000..d0c65bb3ae
--- /dev/null
+++ b/integrations-catalog/integrations/datadog.json
@@ -0,0 +1,58 @@
+{
+  "slug": "datadog",
+  "name": "Datadog",
+  "description": "Monitor Datadog observability configuration including active monitors, synthetic tests, and alerting setup for compliance evidence",
+  "category": "Cloud",
+  "docsUrl": "https://docs.datadoghq.com/api/latest/",
+  "baseUrl": "https://api.datadoghq.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Datadog > Organization Settings > API Keys and copy your API Key.\n2. Go to Organization Settings > Application Keys, create a key with scopes: monitors_read + synthetics_read.\n3. Enter your Datadog site (e.g. datadoghq.com for US, datadoghq.eu for EU).",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Datadog > Organization Settings > API Keys"
+        },
+        {
+          "label": "Application Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Datadog > Organization Settings > Application Keys. Requires scopes: monitors_read, synthetics_read"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "monitors_active",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that Datadog monitors are configured and actively monitoring your infrastructure",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "synthetic_tests",
+      "name": "Utility Monitoring",
+      "description": "Verifies that Datadog synthetic tests are configured for uptime and availability monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "alerting_channels",
+      "name": "Incident Response",
+      "description": "Verifies that Datadog monitors have notification channels configured for alerting",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/datto-rmm.json b/integrations-catalog/integrations/datto-rmm.json
new file mode 100644
index 0000000000..3308e3ebf7
--- /dev/null
+++ b/integrations-catalog/integrations/datto-rmm.json
@@ -0,0 +1,63 @@
+{
+  "slug": "datto-rmm",
+  "name": "Datto RMM",
+  "description": "Monitor Datto RMM device security, patch compliance, and alert management for managed endpoints",
+  "category": "Security",
+  "docsUrl": "https://rmm.datto.com/help/en/Content/2SETUP/APIv2.htm",
+  "baseUrl": "https://{{credentials.platform}}-api.centrastage.net/api",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Datto RMM > Admin > API Management"
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Datto RMM > Admin > API Management"
+        },
+        {
+          "label": "Platform",
+          "type": "select",
+          "required": true,
+          "helpText": "Select your Datto RMM platform region"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Retrieve all managed devices from Datto RMM",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Check device security status and patch levels",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Check open alerts and monitoring status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/datto.json b/integrations-catalog/integrations/datto.json
new file mode 100644
index 0000000000..a36c871e2a
--- /dev/null
+++ b/integrations-catalog/integrations/datto.json
@@ -0,0 +1,35 @@
+{
+  "slug": "datto",
+  "name": "Datto",
+  "description": "Backup, disaster recovery, and business continuity platform. Monitor backup status.",
+  "category": "Infrastructure",
+  "docsUrl": "https://portal.dattobackup.com/integrations/xml-api",
+  "baseUrl": "https://api.datto.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "datto_app_availability",
+      "name": "Datto App Availability",
+      "description": "Checks that the Datto API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "datto_employee_access",
+      "name": "Datto Employee Access",
+      "description": "Verifies access to Datto.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dbt-cloud.json b/integrations-catalog/integrations/dbt-cloud.json
new file mode 100644
index 0000000000..d8bca12f5d
--- /dev/null
+++ b/integrations-catalog/integrations/dbt-cloud.json
@@ -0,0 +1,35 @@
+{
+  "slug": "dbt-cloud",
+  "name": "dbt Cloud",
+  "description": "Monitor dbt Cloud jobs and user access for data transformation compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.getdbt.com/dbt-cloud/api-v2",
+  "baseUrl": "https://cloud.getdbt.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "dbt_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews dbt Cloud users with data transformation access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dbt_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies dbt Cloud has environments configured for deployment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/deel.json b/integrations-catalog/integrations/deel.json
new file mode 100644
index 0000000000..7abdd74e49
--- /dev/null
+++ b/integrations-catalog/integrations/deel.json
@@ -0,0 +1,35 @@
+{
+  "slug": "deel",
+  "name": "Deel",
+  "description": "Monitor Deel worker records and contracts for global HR compliance",
+  "category": "HR & People",
+  "docsUrl": "https://developer.deel.com/api/introduction",
+  "baseUrl": "https://api.letsdeel.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "deel_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Deel workers and contractors with active access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "deel_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies Deel worker records are complete with required information",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/deepgram.json b/integrations-catalog/integrations/deepgram.json
new file mode 100644
index 0000000000..7b603a1415
--- /dev/null
+++ b/integrations-catalog/integrations/deepgram.json
@@ -0,0 +1,35 @@
+{
+  "slug": "deepgram",
+  "name": "Deepgram",
+  "description": "AI speech-to-text and audio intelligence platform. Monitor API access.",
+  "category": "Cloud",
+  "docsUrl": "https://developers.deepgram.com/reference/",
+  "baseUrl": "https://api.deepgram.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "deepgram_app_availability",
+      "name": "Deepgram App Availability",
+      "description": "Checks that the Deepgram API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "deepgram_employee_access",
+      "name": "Deepgram Employee Access",
+      "description": "Verifies employee access to Deepgram via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/delinea.json b/integrations-catalog/integrations/delinea.json
new file mode 100644
index 0000000000..7a510e52a6
--- /dev/null
+++ b/integrations-catalog/integrations/delinea.json
@@ -0,0 +1,63 @@
+{
+  "slug": "delinea",
+  "name": "Delinea Secret Server",
+  "description": "Monitor privileged access management with Delinea Secret Server - verify secure secrets storage, user access controls, and role-based permissions",
+  "category": "Security",
+  "docsUrl": "https://docs.delinea.com/online-help/secret-server/api-scripting/rest-api/index.htm",
+  "baseUrl": "https://placeholder.secretservercloud.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Secret Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Secret Server base URL, e.g. https://mycompany.secretservercloud.com or https://ss.mycompany.com/SecretServer"
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "API user account username with View permissions on secrets, users, roles, and groups"
+        },
+        {
+          "label": "Password",
+          "type": "password",
+          "required": true,
+          "helpText": "API user account password"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies that secrets in Delinea Secret Server are actively managed and healthy",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews user accounts in Delinea Secret Server for proper access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rbac",
+      "name": "Role-based Access Controls",
+      "description": "Reviews roles and groups in Delinea Secret Server for proper role-based access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/deputy.json b/integrations-catalog/integrations/deputy.json
new file mode 100644
index 0000000000..648807b044
--- /dev/null
+++ b/integrations-catalog/integrations/deputy.json
@@ -0,0 +1,52 @@
+{
+  "slug": "deputy",
+  "name": "Deputy",
+  "description": "Workforce management platform for scheduling, time tracking, and compliance.",
+  "category": "HR & People",
+  "docsUrl": "https://www.deputy.com/api-doc/API",
+  "baseUrl": "https://once.deputy.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Deputy\n2. Go to your account icon → API Access\n3. Click 'Get Access Token'\n4. Enter your Deputy URL and the token below",
+      "credentialFields": [
+        {
+          "label": "Deputy Instance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Deputy URL (e.g. https://yourcompany.na.deputy.com). Found in your browser address bar."
+        },
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Deputy → Account → API Access → Get Access Token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "deputy_app_availability",
+      "name": "Deputy App Availability",
+      "description": "Verifies Deputy API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "deputy_employee_access",
+      "name": "Deputy Employee Access",
+      "description": "Verifies employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/descope.json b/integrations-catalog/integrations/descope.json
new file mode 100644
index 0000000000..65fc48cdcb
--- /dev/null
+++ b/integrations-catalog/integrations/descope.json
@@ -0,0 +1,45 @@
+{
+  "slug": "descope",
+  "name": "Descope",
+  "description": "Descope authentication and user management platform with no-code flows",
+  "category": "Identity & Access",
+  "docsUrl": "https://docs.descope.com/api/management",
+  "baseUrl": "https://api.descope.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Descope\n2. Go to Settings → Company → Management API Keys\n3. Create or copy a management key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Management Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Descope → Settings → Company → Management API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "descope_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Descope authentication platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "descope_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Descope users to verify identity platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/detectify.json b/integrations-catalog/integrations/detectify.json
new file mode 100644
index 0000000000..11d4bb89bb
--- /dev/null
+++ b/integrations-catalog/integrations/detectify.json
@@ -0,0 +1,45 @@
+{
+  "slug": "detectify",
+  "name": "Detectify",
+  "description": "Monitor Detectify web application security scanner for vulnerability detection and DAST compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.detectify.com/",
+  "baseUrl": "https://api.detectify.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Detectify at https://detectify.com\n2. Go to Team Settings → API Keys\n3. Generate a new API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Detectify Team Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "detectify_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Detectify web security scans are configured and running",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "detectify_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Detectify team members with access to web security scan results",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dialpad.json b/integrations-catalog/integrations/dialpad.json
new file mode 100644
index 0000000000..70905a5959
--- /dev/null
+++ b/integrations-catalog/integrations/dialpad.json
@@ -0,0 +1,45 @@
+{
+  "slug": "dialpad",
+  "name": "Dialpad",
+  "description": "Cloud communications platform providing business phone, video conferencing, and messaging services.",
+  "category": "Communication",
+  "docsUrl": "https://developers.dialpad.com/reference",
+  "baseUrl": "https://dialpad.com/api/v2",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Dialpad admin portal at https://dialpad.com/admin\n2. Go to Company Settings > API Keys\n3. Generate a new API key\n4. Copy the API key and paste it below"
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "dialpad_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Dialpad users with their roles and access levels to verify employee access controls.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dialpad_role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Reviews admin vs non-admin user distribution and access control policies to verify RBAC implementation.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dialpad_monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Reviews webhook subscriptions configured in Dialpad for monitoring and alerting capabilities.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/digitalocean.json b/integrations-catalog/integrations/digitalocean.json
new file mode 100644
index 0000000000..e292360d34
--- /dev/null
+++ b/integrations-catalog/integrations/digitalocean.json
@@ -0,0 +1,35 @@
+{
+  "slug": "digitalocean",
+  "name": "DigitalOcean",
+  "description": "Monitor DigitalOcean droplets and infrastructure resources for cloud compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.digitalocean.com/reference/api/api-reference/",
+  "baseUrl": "https://api.digitalocean.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "do_app_availability",
+      "name": "App Availability",
+      "description": "Verifies DigitalOcean droplets are active and running",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "do_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all DigitalOcean projects for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/discord.json b/integrations-catalog/integrations/discord.json
new file mode 100644
index 0000000000..b5dbc0990a
--- /dev/null
+++ b/integrations-catalog/integrations/discord.json
@@ -0,0 +1,51 @@
+{
+  "slug": "discord",
+  "name": "Discord",
+  "description": "Monitor Discord server for team membership and communication access compliance",
+  "category": "Communication",
+  "docsUrl": "https://discord.com/developers/docs/intro",
+  "baseUrl": "https://discord.com/api/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to https://discord.com/developers/applications\n2. Create a new application → Bot → Reset Token\n3. Enable Server Members Intent under Privileged Gateway Intents\n4. Invite the bot to your server with 'View Channels' + 'View Members' permissions\n5. Enable Developer Mode in Discord settings, right-click server → Copy ID\n6. Enter bot token and server ID below",
+      "credentialFields": [
+        {
+          "label": "Bot Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Discord Developer Portal → Your App → Bot → Token"
+        },
+        {
+          "label": "Server (Guild) ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Right-click your Discord server name → Copy Server ID (enable Developer Mode first)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "discord_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Discord server members with access to team communication channels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "discord_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Discord server is accessible",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dixa.json b/integrations-catalog/integrations/dixa.json
new file mode 100644
index 0000000000..fb4e69cf0d
--- /dev/null
+++ b/integrations-catalog/integrations/dixa.json
@@ -0,0 +1,45 @@
+{
+  "slug": "dixa",
+  "name": "Dixa",
+  "description": "Monitor Dixa customer service platform for agent access and conversation data compliance",
+  "category": "Communication",
+  "docsUrl": "https://docs.dixa.io/reference",
+  "baseUrl": "https://dev.dixa.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Dixa at https://app.dixa.io\n2. Go to Settings → Integrations → API Tokens\n3. Generate a new API token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Dixa Settings → Integrations → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "dixa_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Dixa agents with access to the customer service platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dixa_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Dixa customer service platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/docebo.json b/integrations-catalog/integrations/docebo.json
new file mode 100644
index 0000000000..9fcdcb76cd
--- /dev/null
+++ b/integrations-catalog/integrations/docebo.json
@@ -0,0 +1,57 @@
+{
+  "slug": "docebo",
+  "name": "Docebo",
+  "description": "Monitor Docebo LMS user access and role-based access controls",
+  "category": "Productivity",
+  "docsUrl": "https://help.docebo.com/hc/en-us/articles/360020082060-APIs-authentication",
+  "baseUrl": "https://{{credentials.subdomain}}.docebosaas.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Docebo Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Docebo subdomain (e.g., 'mycompany' from mycompany.docebosaas.com)"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth2 Client ID from Admin Menu > API & SSO > API Credentials"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "OAuth2 Client Secret from Admin Menu > API & SSO > API Credentials"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Docebo LMS users with their account status and role for access review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rbac",
+      "name": "Role-based Access Controls",
+      "description": "Lists Docebo user groups for role-based access control review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/docker-hub.json b/integrations-catalog/integrations/docker-hub.json
new file mode 100644
index 0000000000..6ef7c4f042
--- /dev/null
+++ b/integrations-catalog/integrations/docker-hub.json
@@ -0,0 +1,63 @@
+{
+  "slug": "docker-hub",
+  "name": "Docker Hub",
+  "description": "Monitor Docker Hub organization members, teams, and container repositories for compliance",
+  "category": "Development",
+  "docsUrl": "https://docs.docker.com/reference/api/hub/latest/",
+  "baseUrl": "https://hub.docker.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Docker Hub Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Docker Hub username (must be an owner/admin of the organization)"
+        },
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Docker Hub Personal Access Token with Read-only access. Generate at https://hub.docker.com/settings/security"
+        },
+        {
+          "label": "Organization Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Docker Hub organization name (the namespace shown in hub.docker.com/orgs/<name>)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "org_members",
+      "name": "Employee Access",
+      "description": "Reviews Docker Hub organization members and their roles to ensure proper access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "teams_permissions",
+      "name": "Role-based Access Controls",
+      "description": "Verifies Docker Hub organization teams are properly configured with members and descriptions",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "repo_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all Docker Hub repositories in the organization for infrastructure inventory tracking",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/docusign.json b/integrations-catalog/integrations/docusign.json
new file mode 100644
index 0000000000..7b674f9541
--- /dev/null
+++ b/integrations-catalog/integrations/docusign.json
@@ -0,0 +1,43 @@
+{
+  "slug": "docusign",
+  "name": "DocuSign",
+  "description": "Monitor DocuSign user access and envelope status for eSignature compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.docusign.com/docs/esign-rest-api/",
+  "baseUrl": "https://account.docusign.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to https://developers.docusign.com/apps-and-keys\n2. Create an Integration (App)\n3. Set redirect URI to: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Copy Integration Key (Client ID) and Secret Key\n5. After connecting, enter your DocuSign Account ID and API base URL (found in DocuSign Admin > API and Keys)",
+      "scopes": [
+        "signature",
+        "offline_access"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "docusign_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews DocuSign users and their signing access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "docusign_access_review",
+      "name": "Access Review Log",
+      "description": "Reviews recent DocuSign envelope activity for access audit",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/domo.json b/integrations-catalog/integrations/domo.json
new file mode 100644
index 0000000000..c7146f4165
--- /dev/null
+++ b/integrations-catalog/integrations/domo.json
@@ -0,0 +1,51 @@
+{
+  "slug": "domo",
+  "name": "Domo",
+  "description": "Monitor Domo business intelligence platform for user access and data governance compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.domo.com/portal/1845fc11bbe5d-domo-ap-is",
+  "baseUrl": "https://api.domo.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Domo at https://developer.domo.com\n2. Go to New Client → create a client with User Read scope\n3. Copy the Client ID and Client Secret\n4. Enter both below",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Domo Developer Portal → New Client"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Domo Developer Portal → New Client"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "domo_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Domo users with access to business intelligence dashboards",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "domo_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Domo BI platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/doppler.json b/integrations-catalog/integrations/doppler.json
new file mode 100644
index 0000000000..0345535dda
--- /dev/null
+++ b/integrations-catalog/integrations/doppler.json
@@ -0,0 +1,35 @@
+{
+  "slug": "doppler",
+  "name": "Doppler",
+  "description": "Monitor Doppler secrets management — verify project configurations and team member access for secrets hygiene compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.doppler.com/reference/api",
+  "baseUrl": "https://api.doppler.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "doppler_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Doppler projects are configured for secrets management across environments",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "doppler_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Doppler workplace members and their access roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/drift.json b/integrations-catalog/integrations/drift.json
new file mode 100644
index 0000000000..9e363849e0
--- /dev/null
+++ b/integrations-catalog/integrations/drift.json
@@ -0,0 +1,38 @@
+{
+  "slug": "drift",
+  "name": "Drift",
+  "description": "Drift conversational marketing and sales platform",
+  "category": "Communication",
+  "docsUrl": "https://devdocs.drift.com/",
+  "baseUrl": "https://driftapi.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Drift\n2. Settings → App Settings → Drift App\n3. Generate an access token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Drift → Settings → App Settings → Access Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "drift_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Drift users to verify agent access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/drip.json b/integrations-catalog/integrations/drip.json
new file mode 100644
index 0000000000..10b6284719
--- /dev/null
+++ b/integrations-catalog/integrations/drip.json
@@ -0,0 +1,45 @@
+{
+  "slug": "drip",
+  "name": "Drip",
+  "description": "Drip ecommerce CRM and email marketing automation platform",
+  "category": "Communication",
+  "docsUrl": "https://developer.drip.com",
+  "baseUrl": "https://api.getdrip.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Drip\n2. Go to User Settings (top-right) → API Token\n3. Copy your API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Drip → User Settings → API Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "drip_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Drip platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "drip_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Drip accounts to verify access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dropbox-business.json b/integrations-catalog/integrations/dropbox-business.json
new file mode 100644
index 0000000000..e7a4abc7f1
--- /dev/null
+++ b/integrations-catalog/integrations/dropbox-business.json
@@ -0,0 +1,52 @@
+{
+  "slug": "dropbox-business",
+  "name": "Dropbox Business",
+  "description": "Dropbox Business team management. Monitor team members, devices, sharing policies, and audit logs.",
+  "category": "Productivity",
+  "docsUrl": "https://www.dropbox.com/developers/documentation/http/teams",
+  "baseUrl": "https://api.dropboxapi.com",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "scopes": [
+        "team_info.read",
+        "members.read",
+        "sessions.list",
+        "events.read"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "dropbox_business_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Dropbox Business team members and verifies their account status and email verification.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dropbox_business_device_list",
+      "name": "Device List",
+      "description": "Lists all devices (web sessions, desktop clients, mobile clients) connected to the Dropbox Business team.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dropbox_business_app_availability",
+      "name": "App Availability",
+      "description": "Verifies that the Dropbox Business API is accessible and returns team information.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dropbox-sign.json b/integrations-catalog/integrations/dropbox-sign.json
new file mode 100644
index 0000000000..46fad8dddd
--- /dev/null
+++ b/integrations-catalog/integrations/dropbox-sign.json
@@ -0,0 +1,38 @@
+{
+  "slug": "dropbox-sign",
+  "name": "Dropbox Sign",
+  "description": "Dropbox Sign (formerly HelloSign) e-signature platform",
+  "category": "Productivity",
+  "docsUrl": "https://developers.hellosign.com/",
+  "baseUrl": "https://api.hellosign.com/v3",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Dropbox Sign\n2. Go to Settings → Integrations → API\n3. Copy your API key\n4. Run: echo -n 'YOUR_API_KEY:' | base64\n5. Paste the output below",
+      "credentialFields": [
+        {
+          "label": "Basic Auth Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64-encode your API key with a colon: echo -n 'your_api_key:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "dropboxsign_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Dropbox Sign team members to verify access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/druva.json b/integrations-catalog/integrations/druva.json
new file mode 100644
index 0000000000..e0b72b4385
--- /dev/null
+++ b/integrations-catalog/integrations/druva.json
@@ -0,0 +1,71 @@
+{
+  "slug": "druva",
+  "name": "Druva",
+  "description": "Monitor Druva cloud data protection and backup platform for storage, devices, admin users, backup sets, and audit logs",
+  "category": "Infrastructure",
+  "docsUrl": "https://developer.druva.com/docs/introduction",
+  "baseUrl": "https://apis.druva.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Client ID from Druva Cloud Platform Console > API Credentials"
+        },
+        {
+          "label": "Secret Key",
+          "type": "secret",
+          "required": true,
+          "helpText": "Secret Key from Druva Cloud Platform Console > API Credentials"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_security",
+      "name": "Secure Devices",
+      "description": "Verifies that all devices managed by Druva are properly secured and backed up",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "admin_access",
+      "name": "Employee Access",
+      "description": "Reviews admin user access and permissions in Druva platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "backup_logs",
+      "name": "Backup logs",
+      "description": "Verifies that backup operations are logged and monitored",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Provides inventory of devices and storage managed by Druva",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that monitoring and alerting is configured for backup operations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dub.json b/integrations-catalog/integrations/dub.json
new file mode 100644
index 0000000000..f59a24c73d
--- /dev/null
+++ b/integrations-catalog/integrations/dub.json
@@ -0,0 +1,45 @@
+{
+  "slug": "dub",
+  "name": "Dub.co",
+  "description": "Monitor Dub.co link management for domain security and access control compliance",
+  "category": "Productivity",
+  "docsUrl": "https://dub.co/docs/api-reference/introduction",
+  "baseUrl": "https://api.dub.co/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Dub.co at https://app.dub.co\n2. Go to Settings → API Keys\n3. Create a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Dub.co Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "dub_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Dub.co workspaces and members for link management access control",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "dub_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Dub.co platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/duo-security.json b/integrations-catalog/integrations/duo-security.json
new file mode 100644
index 0000000000..e8d43cda72
--- /dev/null
+++ b/integrations-catalog/integrations/duo-security.json
@@ -0,0 +1,51 @@
+{
+  "slug": "duo-security",
+  "name": "Duo Security",
+  "description": "Monitor Duo Security MFA platform for user enrollment and authentication policy compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://duo.com/docs/adminapi",
+  "baseUrl": "https://api.duosecurity.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Duo Admin Panel at https://admin.duosecurity.com\n2. Go to Applications → Protect an Application\n3. Find Admin API → click Protect\n4. Copy the Integration Key, Secret Key, and API Hostname\n5. Base64 encode 'integration_key:secret_key': echo -n 'ikey:skey' | base64\n6. Enter both below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'integration_key:secret_key'. Found in Duo Admin Panel → Applications → Admin API. Command: echo -n 'DIXXXXXXXX:secret' | base64"
+        },
+        {
+          "label": "API Hostname",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Duo API hostname from the Admin API application (e.g. api-XXXXXXXX.duosecurity.com)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "duo_mfa",
+      "name": "2FA",
+      "description": "Verifies Duo Security MFA is active and users are enrolled",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "duo_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Duo Security user enrollment for MFA compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/duo.json b/integrations-catalog/integrations/duo.json
new file mode 100644
index 0000000000..a4f794bc2a
--- /dev/null
+++ b/integrations-catalog/integrations/duo.json
@@ -0,0 +1,57 @@
+{
+  "slug": "duo",
+  "name": "Duo Security",
+  "description": "Multi-factor authentication platform. Monitor MFA enrollment, user access, and authentication policies.",
+  "category": "Identity & Access",
+  "docsUrl": "https://duo.com/docs/adminapi",
+  "baseUrl": "https://api.duosecurity.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Duo Admin Panel\n2. Go to Applications → Protect an Application\n3. Find 'Admin API' and click 'Protect'\n4. Grant 'Read' permission for the integration\n5. Copy the API Hostname, Integration Key, and Secret Key\n6. Paste all values below",
+      "credentialFields": [
+        {
+          "label": "API Hostname",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Duo Admin Panel → Applications → your Admin API app. Format: api-XXXXXXXX.duosecurity.com"
+        },
+        {
+          "label": "Integration Key",
+          "type": "text",
+          "required": true,
+          "helpText": "From the Admin API application in Duo Admin Panel."
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "From the Admin API application in Duo Admin Panel."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "duo_app_availability",
+      "name": "Duo Security App Availability",
+      "description": "Verifies Duo Admin API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "duo_mfa_compliance",
+      "name": "Duo MFA Compliance",
+      "description": "Verifies MFA enrollment status across users.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dynamics-365.json b/integrations-catalog/integrations/dynamics-365.json
new file mode 100644
index 0000000000..87e458464c
--- /dev/null
+++ b/integrations-catalog/integrations/dynamics-365.json
@@ -0,0 +1,70 @@
+{
+  "slug": "dynamics-365",
+  "name": "Dynamics 365",
+  "description": "CRM and business applications platform. Monitor organizational data, contacts, and user access for compliance.",
+  "category": "Productivity",
+  "docsUrl": "https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/overview",
+  "baseUrl": "https://org.api.crm.dynamics.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Register an app in Azure AD with Dynamics CRM permissions\n2. Grant admin consent\n3. Register the app as an application user in Power Platform admin center\n4. Enter all values below",
+      "credentialFields": [
+        {
+          "label": "Dynamics 365 Environment URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Dynamics 365 environment URL (e.g. https://yourorg.crm.dynamics.com)."
+        },
+        {
+          "label": "Tenant ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Azure Portal → Microsoft Entra ID → Overview → Tenant ID."
+        },
+        {
+          "label": "Application (Client) ID",
+          "type": "text",
+          "required": true,
+          "helpText": "From Azure AD app registration."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "From Azure AD app registration."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "dynamics_365_app_availability",
+      "name": "Dynamics 365 App Availability",
+      "description": "Verifies Dynamics 365 Dataverse API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dynamics_365_employee_access",
+      "name": "Dynamics 365 User Access",
+      "description": "Verifies user access to Dynamics 365.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "dynamics_365_regulatory_contacts",
+      "name": "Dynamics 365 Regulatory Contacts",
+      "description": "Verifies CRM contact records are accessible for regulatory liaison tracking.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/dynatrace.json b/integrations-catalog/integrations/dynatrace.json
new file mode 100644
index 0000000000..5705b9c18d
--- /dev/null
+++ b/integrations-catalog/integrations/dynatrace.json
@@ -0,0 +1,35 @@
+{
+  "slug": "dynatrace",
+  "name": "Dynatrace",
+  "description": "Monitor Dynatrace problems, synthetic monitors, and alerts for observability compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://www.dynatrace.com/support/help/dynatrace-api",
+  "baseUrl": "https://example.live.dynatrace.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "dynatrace_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Checks Dynatrace for open problems requiring attention",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "dynatrace_synthetic",
+      "name": "Utility Monitoring",
+      "description": "Verifies Dynatrace synthetic monitors are configured for uptime monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/egnyte.json b/integrations-catalog/integrations/egnyte.json
new file mode 100644
index 0000000000..8ae2cfda7b
--- /dev/null
+++ b/integrations-catalog/integrations/egnyte.json
@@ -0,0 +1,59 @@
+{
+  "slug": "egnyte",
+  "name": "Egnyte",
+  "description": "Egnyte is an enterprise file sharing, storage, and governance platform. This integration monitors user access, role-based controls, and encryption compliance.",
+  "category": "Cloud",
+  "docsUrl": null,
+  "baseUrl": "https://placeholder.egnyte.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Egnyte admin console\n2. Go to Settings > Developer\n3. Generate an API token with user management permissions\n4. Enter your Egnyte subdomain (e.g., 'acme' from acme.egnyte.com) and the API token",
+      "credentialFields": [
+        {
+          "label": "Egnyte Domain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Egnyte subdomain (e.g., if your URL is acme.egnyte.com, enter 'acme')"
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate an API token from your Egnyte admin console under Settings > Developer"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "egnyte_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Egnyte users with their access types, roles, and activity status to verify appropriate access controls.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "egnyte_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies Egnyte user types (admin, power, standard) and authentication types (SSO, AD, local) to ensure proper role-based access control.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "egnyte_encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Verifies that Egnyte encrypts stored data at rest. Egnyte uses AES-256 encryption by default for all accounts.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/elastic-cloud.json b/integrations-catalog/integrations/elastic-cloud.json
new file mode 100644
index 0000000000..e681fcfe41
--- /dev/null
+++ b/integrations-catalog/integrations/elastic-cloud.json
@@ -0,0 +1,45 @@
+{
+  "slug": "elastic-cloud",
+  "name": "Elastic Cloud",
+  "description": "Managed Elasticsearch and Kibana. Monitor deployments and cluster health.",
+  "category": "Cloud",
+  "docsUrl": "https://www.elastic.co/docs/api/doc/cloud",
+  "baseUrl": "https://api.elastic-cloud.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Elastic Cloud at https://cloud.elastic.co\n2. Go to Organization → API keys\n3. Click 'Create API key'\n4. Select 'Organization viewer' role (minimum)\n5. Copy the generated key and paste below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Elastic Cloud console → Organization → API keys. Create an API key with at least 'Organization viewer' role."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "elastic_cloud_app_availability",
+      "name": "Elastic Cloud App Availability",
+      "description": "Checks that the Elastic Cloud API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "elastic_cloud_employee_access",
+      "name": "Elastic Cloud Employee Access",
+      "description": "Verifies employee access to Elastic Cloud.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/elastic.json b/integrations-catalog/integrations/elastic.json
new file mode 100644
index 0000000000..86973609ba
--- /dev/null
+++ b/integrations-catalog/integrations/elastic.json
@@ -0,0 +1,45 @@
+{
+  "slug": "elastic",
+  "name": "Elastic Cloud",
+  "description": "Monitor Elastic Cloud cluster health and user accounts for monitoring and access review compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://www.elastic.co/docs/api/",
+  "baseUrl": "https://elastic.co/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Kibana\n2. Go to Stack Management > Security > API keys\n3. Create an API key with cluster:monitor and security permissions\n4. The key is provided as id:value — base64-encode it\n5. Paste the encoded value below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Create an API key in Kibana > Stack Management > Security > API keys. Use the base64-encoded 'id:value' format"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "cluster_health",
+      "name": "Monitoring & Alerting",
+      "description": "Checks that Elastic cluster health is not in a critical (red) state",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "user_review",
+      "name": "Access Review Log",
+      "description": "Retrieves Elasticsearch users for access review log compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/employment-hero.json b/integrations-catalog/integrations/employment-hero.json
new file mode 100644
index 0000000000..3c4f461f81
--- /dev/null
+++ b/integrations-catalog/integrations/employment-hero.json
@@ -0,0 +1,58 @@
+{
+  "slug": "employment-hero",
+  "name": "Employment Hero",
+  "description": "Monitor Employment Hero HR platform for employee access management, role-based controls, and HR policy compliance",
+  "category": "HR & People",
+  "docsUrl": "https://developer.employmenthero.com/api-references/",
+  "baseUrl": "https://api.employmenthero.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Token (Bearer Token)",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Employment Hero OAuth2 Bearer token. Obtain from the Developer Portal in your Employment Hero account under your profile menu."
+        },
+        {
+          "label": "Organisation ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Employment Hero organisation ID (UUID). Found via GET /api/v1/organisations after authenticating."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employment_hero_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews all employees in Employment Hero with access to the HR platform, identifying active and terminated users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employment_hero_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies employee roles and team assignments in Employment Hero to ensure proper access control governance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employment_hero_policies",
+      "name": "Publish Policies",
+      "description": "Verifies that HR policies are configured and published in Employment Hero for organizational compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/endor-labs.json b/integrations-catalog/integrations/endor-labs.json
new file mode 100644
index 0000000000..5ec5d051af
--- /dev/null
+++ b/integrations-catalog/integrations/endor-labs.json
@@ -0,0 +1,44 @@
+{
+  "slug": "endor-labs",
+  "name": "Endor Labs",
+  "description": "Endor Labs software supply chain security platform",
+  "category": "Security",
+  "docsUrl": "https://docs.endorlabs.com/",
+  "baseUrl": "https://api.endorlabs.com/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Endor Labs\n2. Go to Settings → API Keys\n3. Create an API key\n4. Enter your namespace and paste the key below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Endor Labs → Settings → API Keys → Create API key"
+        },
+        {
+          "label": "Namespace",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Endor Labs namespace (organization identifier)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "endorlabs_code_security",
+      "name": "Code Changes",
+      "description": "Verifies Endor Labs has projects connected for supply chain security",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/entra-id.json b/integrations-catalog/integrations/entra-id.json
new file mode 100644
index 0000000000..183d494056
--- /dev/null
+++ b/integrations-catalog/integrations/entra-id.json
@@ -0,0 +1,72 @@
+{
+  "slug": "entra-id",
+  "name": "Microsoft Entra ID",
+  "description": "Identity provider and directory service. Monitor user access, MFA status, and conditional access policies.",
+  "category": "Identity & Access",
+  "docsUrl": "https://learn.microsoft.com/en-us/graph/api/overview",
+  "baseUrl": "https://graph.microsoft.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Azure Portal → Microsoft Entra ID → App registrations\n2. Click 'New registration', name it 'CompAI Integration'\n3. Under API permissions, add Microsoft Graph (Application):\n   - User.Read.All\n   - Directory.Read.All\n   - AuditLog.Read.All\n4. Click 'Grant admin consent'\n5. Go to Certificates & secrets → New client secret\n6. Copy the Tenant ID, Application ID, and Client Secret below",
+      "credentialFields": [
+        {
+          "label": "Tenant ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Azure Portal → Microsoft Entra ID → Overview → Tenant ID."
+        },
+        {
+          "label": "Application (Client) ID",
+          "type": "text",
+          "required": true,
+          "helpText": "From your Azure AD app registration → Overview → Application (client) ID."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "From your Azure AD app registration → Certificates & secrets → New client secret."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "entra_id_app_availability",
+      "name": "Entra ID App Availability",
+      "description": "Verifies Microsoft Graph API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "entra_id_employee_access",
+      "name": "Entra ID Identity & Access",
+      "description": "Verifies user directory access via Microsoft Graph.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "entra_id_mfa",
+      "name": "Entra ID MFA Compliance",
+      "description": "Checks MFA registration status.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "entra_id_access_review",
+      "name": "Entra ID Access Review",
+      "description": "Verifies access reviews are configured in Entra ID.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/env0.json b/integrations-catalog/integrations/env0.json
new file mode 100644
index 0000000000..8345839602
--- /dev/null
+++ b/integrations-catalog/integrations/env0.json
@@ -0,0 +1,35 @@
+{
+  "slug": "env0",
+  "name": "env0",
+  "description": "Infrastructure automation platform. Monitor environments and deployments.",
+  "category": "Infrastructure",
+  "docsUrl": "https://developer.env0.com/",
+  "baseUrl": "https://api.env0.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "env0_app_availability",
+      "name": "env0 App Availability",
+      "description": "Checks env0 app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "env0_employee_access",
+      "name": "env0 Employee Access",
+      "description": "Checks env0 employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/envoy.json b/integrations-catalog/integrations/envoy.json
new file mode 100644
index 0000000000..53f1ac22cc
--- /dev/null
+++ b/integrations-catalog/integrations/envoy.json
@@ -0,0 +1,45 @@
+{
+  "slug": "envoy",
+  "name": "Envoy",
+  "description": "Verify workplace security through Envoy visitor management - review employee access, visitor sign-in flows, and location configurations.",
+  "category": "Security",
+  "docsUrl": "https://developers.envoy.com/hub/reference",
+  "baseUrl": "https://api.envoy.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to the Envoy Dev Dashboard at https://dashboard.envoy.com\n2. Navigate to Integrations > Dev Dashboard\n3. Click 'Create New'\n4. Provide a name for your integration (e.g., 'CompAI')\n5. Under API Scopes, add: employees.read, locations.read, flows.read\n6. Save the integration\n7. Copy your Client API Key from the integration settings\n8. Paste it below"
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "envoy_employee_access",
+      "name": "Envoy Employee Access",
+      "description": "Lists all employees registered in Envoy to verify user access and directory completeness.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "envoy_visitor_sign_in_flows",
+      "name": "Envoy Visitor Sign-In Flows",
+      "description": "Verifies that visitor and employee sign-in flows are configured and enabled in Envoy locations.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "envoy_location_configuration",
+      "name": "Envoy Location Configuration",
+      "description": "Verifies that company locations are configured and active in Envoy.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/eset-protect.json b/integrations-catalog/integrations/eset-protect.json
new file mode 100644
index 0000000000..3bbc89ebc4
--- /dev/null
+++ b/integrations-catalog/integrations/eset-protect.json
@@ -0,0 +1,64 @@
+{
+  "slug": "eset-protect",
+  "name": "ESET Protect",
+  "description": "Monitor ESET Protect Cloud managed devices and endpoint security compliance",
+  "category": "Security",
+  "docsUrl": "https://help.eset.com/eset_connect/en-US/",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to ESET Protect Cloud console\n2. Go to More > Users > API Users\n3. Create a new API user with Device Management read permissions\n4. Note your region from the console URL (eu, de, us, jpn, or ca)\n5. Enter the API username, password, and region prefix",
+      "credentialFields": [
+        {
+          "label": "API Username",
+          "type": "text",
+          "required": true,
+          "helpText": "The username of the API user created in ESET Protect Cloud"
+        },
+        {
+          "label": "API Password",
+          "type": "password",
+          "required": true,
+          "helpText": "The password for the API user"
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Your ESET region prefix: eu, de, us, jpn, or ca"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Lists all managed devices enrolled in ESET Protect Cloud",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies endpoint protection status across all managed devices",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that ESET Protect has incident detection and alerting configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/expensify.json b/integrations-catalog/integrations/expensify.json
new file mode 100644
index 0000000000..f705fd2cd4
--- /dev/null
+++ b/integrations-catalog/integrations/expensify.json
@@ -0,0 +1,43 @@
+{
+  "slug": "expensify",
+  "name": "Expensify",
+  "description": "Monitor employee access and policy membership in Expensify expense management",
+  "category": "Productivity",
+  "docsUrl": "https://integrations.expensify.com/Integration-Server/doc/",
+  "baseUrl": "https://integrations.expensify.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Partner User ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Expensify partnerUserID. Found at https://www.expensify.com/tools/integrations/"
+        },
+        {
+          "label": "Partner User Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Expensify partnerUserSecret. Found at https://www.expensify.com/tools/integrations/"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Retrieves Expensify policy list and verifies active employee access to expense management policies",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/factorial.json b/integrations-catalog/integrations/factorial.json
new file mode 100644
index 0000000000..96b2a5bdc2
--- /dev/null
+++ b/integrations-catalog/integrations/factorial.json
@@ -0,0 +1,45 @@
+{
+  "slug": "factorial",
+  "name": "Factorial",
+  "description": "Factorial HR platform for employee management, time-off, and payroll",
+  "category": "HR & People",
+  "docsUrl": "https://apidoc.factorialhr.com",
+  "baseUrl": "https://api.factorialhr.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Factorial\n2. Go to Settings → API\n3. Generate a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Factorial → Settings → API → Generate API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "factorial_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Factorial HR platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "factorial_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Factorial HR user identity and access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fastly.json b/integrations-catalog/integrations/fastly.json
new file mode 100644
index 0000000000..213d3fb00d
--- /dev/null
+++ b/integrations-catalog/integrations/fastly.json
@@ -0,0 +1,35 @@
+{
+  "slug": "fastly",
+  "name": "Fastly",
+  "description": "Monitor Fastly CDN and WAF services for TLS configuration and availability compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://developer.fastly.com/reference/api/",
+  "baseUrl": "https://api.fastly.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "fastly_tls",
+      "name": "TLS / HTTPS",
+      "description": "Verifies Fastly services are active and serving traffic over TLS",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "fastly_app_availability",
+      "name": "App Availability",
+      "description": "Reviews Fastly service health and version configuration",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fibery.json b/integrations-catalog/integrations/fibery.json
new file mode 100644
index 0000000000..1ba63bacba
--- /dev/null
+++ b/integrations-catalog/integrations/fibery.json
@@ -0,0 +1,51 @@
+{
+  "slug": "fibery",
+  "name": "Fibery",
+  "description": "Fibery is a work management platform that combines project management, knowledge management, and collaboration tools in a connected workspace.",
+  "category": "Productivity",
+  "docsUrl": "https://the.fibery.io/@public/User_Guide/Guide/Fibery-API-Overview-279",
+  "baseUrl": "https://fibery.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Fibery workspace\n2. Go to Settings (gear icon) > API Tokens\n3. Click 'Create Token' and give it a name (e.g. 'CompAI')\n4. Copy the generated token\n5. Enter your workspace name (the subdomain from your Fibery URL) and the API token below",
+      "credentialFields": [
+        {
+          "label": "Workspace Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Fibery workspace subdomain. For example, if your Fibery URL is https://mycompany.fibery.io, enter 'mycompany'"
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Go to Fibery Settings > API Tokens > Create Token. Copy the generated token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "fibery_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all users in the Fibery workspace to verify employee access is properly managed.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "fibery_role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Checks user roles and permissions in the Fibery workspace to verify role-based access controls are implemented.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/figma.json b/integrations-catalog/integrations/figma.json
new file mode 100644
index 0000000000..3e97fd0182
--- /dev/null
+++ b/integrations-catalog/integrations/figma.json
@@ -0,0 +1,35 @@
+{
+  "slug": "figma",
+  "name": "Figma",
+  "description": "Monitor Figma team members and project organization for access compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.figma.com/developers/api",
+  "baseUrl": "https://api.figma.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "figma_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Figma team members and verifies access is appropriate",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "figma_access_review",
+      "name": "Access Review Log",
+      "description": "Reviews Figma team projects for access control and organization",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/firebase.json b/integrations-catalog/integrations/firebase.json
new file mode 100644
index 0000000000..52191a5e69
--- /dev/null
+++ b/integrations-catalog/integrations/firebase.json
@@ -0,0 +1,51 @@
+{
+  "slug": "firebase",
+  "name": "Firebase",
+  "description": "Monitor Firebase Authentication MFA settings, user access, and security rules for Firestore and Cloud Storage",
+  "category": "Cloud",
+  "docsUrl": "https://firebase.google.com/docs/reference/rest",
+  "baseUrl": "https://identitytoolkit.googleapis.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "Use your existing Google OAuth app or create one at Google Cloud Console > APIs & Credentials. Enable the Identity Toolkit API and Firebase Rules API. Add scopes: identitytoolkit and firebase.readonly.",
+      "createAppUrl": "https://console.cloud.google.com/apis/credentials",
+      "scopes": [
+        "https://www.googleapis.com/auth/identitytoolkit",
+        "https://www.googleapis.com/auth/firebase.readonly"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mfa_config",
+      "name": "2FA",
+      "description": "Verifies that multi-factor authentication is enabled at the Firebase project level",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews Firebase Authentication users, their sign-in providers, MFA enrollment, and last activity",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "security_rules",
+      "name": "Security Rules",
+      "description": "Checks that Firestore and Cloud Storage security rules are deployed and not using wide-open defaults",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/firehydrant.json b/integrations-catalog/integrations/firehydrant.json
new file mode 100644
index 0000000000..d1e51a574b
--- /dev/null
+++ b/integrations-catalog/integrations/firehydrant.json
@@ -0,0 +1,35 @@
+{
+  "slug": "firehydrant",
+  "name": "FireHydrant",
+  "description": "Monitor FireHydrant incident response platform for team access and runbook coverage",
+  "category": "Monitoring",
+  "docsUrl": "https://developers.firehydrant.io/docs/api/",
+  "baseUrl": "https://api.firehydrant.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "firehydrant_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies FireHydrant has runbooks configured for incident response procedures",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "firehydrant_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews FireHydrant team members with incident response access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fireworks-ai.json b/integrations-catalog/integrations/fireworks-ai.json
new file mode 100644
index 0000000000..c82176ccd6
--- /dev/null
+++ b/integrations-catalog/integrations/fireworks-ai.json
@@ -0,0 +1,35 @@
+{
+  "slug": "fireworks-ai",
+  "name": "Fireworks AI",
+  "description": "AI inference platform for deploying and running LLMs. Monitor API access.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.fireworks.ai/",
+  "baseUrl": "https://api.fireworks.ai",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "fireworks_ai_app_availability",
+      "name": "Fireworks AI App Availability",
+      "description": "Checks that the Fireworks AI API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "fireworks_ai_employee_access",
+      "name": "Fireworks AI Employee Access",
+      "description": "Verifies employee access to Fireworks AI via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fivetran.json b/integrations-catalog/integrations/fivetran.json
new file mode 100644
index 0000000000..09ca808d72
--- /dev/null
+++ b/integrations-catalog/integrations/fivetran.json
@@ -0,0 +1,45 @@
+{
+  "slug": "fivetran",
+  "name": "Fivetran",
+  "description": "Monitor Fivetran data pipeline connectors and user access for data integration compliance",
+  "category": "Cloud",
+  "docsUrl": "https://fivetran.com/docs/rest-api",
+  "baseUrl": "https://api.fivetran.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Fivetran Dashboard → Settings → API Config\n2. Generate an API key and secret\n3. Encode them: base64('api_key:api_secret')\n4. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'api_key:api_secret'. Command: echo -n 'key:secret' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "fivetran_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Fivetran account users and their access roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "fivetran_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Fivetran platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/flagsmith.json b/integrations-catalog/integrations/flagsmith.json
new file mode 100644
index 0000000000..df41c4735c
--- /dev/null
+++ b/integrations-catalog/integrations/flagsmith.json
@@ -0,0 +1,45 @@
+{
+  "slug": "flagsmith",
+  "name": "Flagsmith",
+  "description": "Open-source feature flag and remote config platform. Monitor organizations and feature states.",
+  "category": "Development",
+  "docsUrl": "https://docs.flagsmith.com",
+  "baseUrl": "https://api.flagsmith.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Flagsmith at https://app.flagsmith.com\n2. Go to Organisation Settings → API Keys\n3. Copy the Master API Key\n4. Paste it below\n\nNote: Server-side and Client-side keys won't work — you need the Master API Key.",
+      "credentialFields": [
+        {
+          "label": "Master API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Flagsmith → Organisation Settings → API Keys → Master API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "flagsmith_app_availability",
+      "name": "Flagsmith App Availability",
+      "description": "Checks that the Flagsmith API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "flagsmith_employee_access",
+      "name": "Flagsmith Employee Access",
+      "description": "Verifies employee access to Flagsmith.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fleetdm.json b/integrations-catalog/integrations/fleetdm.json
new file mode 100644
index 0000000000..26496c96e6
--- /dev/null
+++ b/integrations-catalog/integrations/fleetdm.json
@@ -0,0 +1,42 @@
+{
+  "slug": "fleetdm",
+  "name": "FleetDM",
+  "description": "Open-source device management platform for monitoring and securing endpoints",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "List all enrolled hosts and devices in Fleet",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Check host compliance status and policy adherence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verify Fleet policies are configured and active",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fly.json b/integrations-catalog/integrations/fly.json
new file mode 100644
index 0000000000..cd7dfdc5f5
--- /dev/null
+++ b/integrations-catalog/integrations/fly.json
@@ -0,0 +1,35 @@
+{
+  "slug": "fly",
+  "name": "Fly.io",
+  "description": "Monitor Fly.io applications for edge infrastructure inventory and availability",
+  "category": "Cloud",
+  "docsUrl": "https://fly.io/docs/machines/api/",
+  "baseUrl": "https://api.machines.dev/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "fly_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Fly.io applications for edge compute infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "fly_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Fly.io apps are deployed and running",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/forescout.json b/integrations-catalog/integrations/forescout.json
new file mode 100644
index 0000000000..ba660ae800
--- /dev/null
+++ b/integrations-catalog/integrations/forescout.json
@@ -0,0 +1,63 @@
+{
+  "slug": "forescout",
+  "name": "Forescout",
+  "description": "Monitor Forescout eyeSight network access control for device compliance, managed device inventory, and active policies/alerts",
+  "category": "Security",
+  "docsUrl": "https://docs.forescout.com/bundle/web-api-1-5-16-h/page/gitdoc-eyeextend/eyeExtend/conmod-webapi-plugin-h/about-web-api.html",
+  "baseUrl": "https://placeholder.forescout.local",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Enterprise Manager URL",
+          "type": "text",
+          "required": true,
+          "helpText": "The HTTPS URL of your Forescout Enterprise Manager (e.g. https://em.yourcompany.com)"
+        },
+        {
+          "label": "Web API Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Username configured in the Forescout Web API plugin settings"
+        },
+        {
+          "label": "Web API Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Password configured in the Forescout Web API plugin settings"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Retrieves all managed devices from Forescout and checks their compliance status based on policy matching",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Retrieves the full inventory of managed devices from Forescout for compliance evidence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that Forescout has active policies configured for network monitoring and alerting",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fortinet-fortigate.json b/integrations-catalog/integrations/fortinet-fortigate.json
new file mode 100644
index 0000000000..8a149ff6a1
--- /dev/null
+++ b/integrations-catalog/integrations/fortinet-fortigate.json
@@ -0,0 +1,62 @@
+{
+  "slug": "fortinet-fortigate",
+  "name": "Fortinet FortiGate",
+  "description": "Monitor Fortinet FortiGate firewall and UTM security appliance for firewall policies, admin users, system configuration, firmware status, and logging compliance",
+  "category": "Security",
+  "docsUrl": "https://docs.fortinet.com/document/fortigate/7.6.6/administration-guide/940602/using-apis",
+  "baseUrl": "https://api.fortigate.local/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Api Token",
+          "type": "secret",
+          "required": true
+        },
+        {
+          "label": "Server Url",
+          "type": "text",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "production_firewall",
+      "name": "Production Firewall",
+      "description": "Verifies firewall policies are configured to protect network traffic and segment environments",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews FortiGate administrator users and access controls for system management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "systems_description",
+      "name": "Systems Description",
+      "description": "Documents FortiGate system information including hostname, firmware version, and operational status",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies FortiGate syslog configuration for centralized logging and monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/frame-io.json b/integrations-catalog/integrations/frame-io.json
new file mode 100644
index 0000000000..413ec9397e
--- /dev/null
+++ b/integrations-catalog/integrations/frame-io.json
@@ -0,0 +1,38 @@
+{
+  "slug": "frame-io",
+  "name": "Frame.io",
+  "description": "Frame.io video review and collaboration platform by Adobe",
+  "category": "Productivity",
+  "docsUrl": "https://developer.frame.io/",
+  "baseUrl": "https://api.frame.io/v2",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Frame.io\n2. Go to Account Settings → Developer → Tokens\n3. Create a developer token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Developer Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Frame.io → Developer → Tokens → Create token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "frameio_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Frame.io is connected and accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/freshbooks.json b/integrations-catalog/integrations/freshbooks.json
new file mode 100644
index 0000000000..f55c0bfc52
--- /dev/null
+++ b/integrations-catalog/integrations/freshbooks.json
@@ -0,0 +1,45 @@
+{
+  "slug": "freshbooks",
+  "name": "FreshBooks",
+  "description": "Monitor FreshBooks accounting platform for financial data access and client management compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.freshbooks.com/api/start",
+  "baseUrl": "https://api.freshbooks.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to FreshBooks at https://my.freshbooks.com\n2. Go to Settings → Developer Portal\n3. Create an app and generate an OAuth access token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "OAuth access token from FreshBooks Developer Portal"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "freshbooks_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews FreshBooks account members with access to financial data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "freshbooks_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies FreshBooks financial data is properly access-controlled",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/freshdesk.json b/integrations-catalog/integrations/freshdesk.json
new file mode 100644
index 0000000000..0b759d2b18
--- /dev/null
+++ b/integrations-catalog/integrations/freshdesk.json
@@ -0,0 +1,45 @@
+{
+  "slug": "freshdesk",
+  "name": "Freshdesk",
+  "description": "Monitor Freshdesk agents and group configuration for customer support compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.freshdesk.com/api/",
+  "baseUrl": "https://yoursubdomain.freshdesk.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Freshdesk Profile Settings (top-right avatar > Profile Settings)\n2. Copy your API Key\n3. Encode it: base64('your_api_key:X') — note the literal ':X' suffix\n4. Enter the encoded value below along with your subdomain",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode your API key followed by ':X'. Example: base64('your_api_key:X'). Use https://www.base64encode.org/"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "freshdesk_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Freshdesk agents and their access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "freshdesk_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Freshdesk groups are configured for support team organization",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/freshsales.json b/integrations-catalog/integrations/freshsales.json
new file mode 100644
index 0000000000..b6c49c04f0
--- /dev/null
+++ b/integrations-catalog/integrations/freshsales.json
@@ -0,0 +1,52 @@
+{
+  "slug": "freshsales",
+  "name": "Freshsales",
+  "description": "Monitor Freshsales CRM user access and role-based access controls for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.freshworks.com/crm/api/",
+  "baseUrl": "https://example.myfreshworks.com/crm/sales",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Freshsales at https://your-domain.myfreshworks.com/crm/sales\n2. Click your profile picture and select Profile Settings\n3. Click the API Settings tab\n4. Copy your API key\n5. Find your Bundle alias (domain) below the API key\n6. Enter both values below",
+      "credentialFields": [
+        {
+          "label": "Freshworks Domain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Freshworks domain (e.g. 'acme' from acme.myfreshworks.com)"
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Freshsales Profile Settings > API Settings"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "freshsales_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Freshsales CRM users/owners and reports their active status for access review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "freshsales_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies Freshsales CRM user access controls by reviewing user assignments and availability",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/freshservice.json b/integrations-catalog/integrations/freshservice.json
new file mode 100644
index 0000000000..11a0b69ef2
--- /dev/null
+++ b/integrations-catalog/integrations/freshservice.json
@@ -0,0 +1,45 @@
+{
+  "slug": "freshservice",
+  "name": "Freshservice",
+  "description": "Monitor Freshservice IT agents and incident tickets for ITSM compliance",
+  "category": "Productivity",
+  "docsUrl": "https://api.freshservice.com/",
+  "baseUrl": "https://yoursubdomain.freshservice.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Freshservice Profile Settings (top-right avatar)\n2. Copy your API Key\n3. Encode: base64('your_api_key:X')\n4. Enter the encoded value below along with your subdomain",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode your API key: base64('your_api_key:X'). Use https://www.base64encode.org/ — note the literal ':X' suffix"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "freshservice_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Freshservice agents and their IT service access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "freshservice_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies Freshservice has a process for tracking and resolving incidents",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/freshteam.json b/integrations-catalog/integrations/freshteam.json
new file mode 100644
index 0000000000..8161ec43fe
--- /dev/null
+++ b/integrations-catalog/integrations/freshteam.json
@@ -0,0 +1,59 @@
+{
+  "slug": "freshteam",
+  "name": "Freshteam",
+  "description": "Freshteam by Freshworks is a cloud-based HR software for employee management, recruitment, onboarding, time-off, and organizational management.",
+  "category": "HR & People",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Freshteam account\n2. Click your profile icon in the top right\n3. Select 'API Settings'\n4. Copy the API key displayed under 'Your API Key'\n5. Enter your subdomain (the part before .freshteam.com in your URL)\n6. Paste the API key below\n\nNote: Only HR Partner, Admin, and Account Admin roles can use the API.",
+      "credentialFields": [
+        {
+          "label": "Freshteam Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Freshteam subdomain. For example, if you log in at https://acme.freshteam.com, enter 'acme'."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Freshteam: click your profile icon > API Settings > copy Your API Key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "freshteam_employee_access",
+      "name": "Freshteam Employee Access",
+      "description": "Verifies that employee records can be accessed through the Freshteam API, confirming the integration is properly connected and employee data is available.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "freshteam_rbac",
+      "name": "Freshteam Role-based Access Controls",
+      "description": "Verifies that role-based access controls are configured in Freshteam by checking that organizational roles and departments are defined.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "freshteam_employee_descriptions",
+      "name": "Freshteam Employee Descriptions",
+      "description": "Verifies that employee records in Freshteam have job titles or designations assigned, ensuring proper role documentation for compliance.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/front.json b/integrations-catalog/integrations/front.json
new file mode 100644
index 0000000000..0d16a4a730
--- /dev/null
+++ b/integrations-catalog/integrations/front.json
@@ -0,0 +1,35 @@
+{
+  "slug": "front",
+  "name": "Front",
+  "description": "Monitor Front teammates and inbox configuration for customer support compliance",
+  "category": "Communication",
+  "docsUrl": "https://dev.frontapp.com/reference/",
+  "baseUrl": "https://api2.frontapp.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "front_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Front teammates and their access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "front_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Front inboxes are configured for customer communication",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/frontegg.json b/integrations-catalog/integrations/frontegg.json
new file mode 100644
index 0000000000..9010aac5ea
--- /dev/null
+++ b/integrations-catalog/integrations/frontegg.json
@@ -0,0 +1,45 @@
+{
+  "slug": "frontegg",
+  "name": "Frontegg",
+  "description": "Monitor Frontegg authentication platform for user management and access control compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://docs.frontegg.com/reference/overview",
+  "baseUrl": "https://api.frontegg.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Frontegg at https://portal.frontegg.com\n2. Go to Environments → [your env] → Settings → API Tokens\n3. Generate an API token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Frontegg Portal → Environments → Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "frontegg_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Frontegg users to audit authentication platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "frontegg_mfa",
+      "name": "2FA",
+      "description": "Verifies Frontegg MFA is enabled for user authentication security",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fullstory.json b/integrations-catalog/integrations/fullstory.json
new file mode 100644
index 0000000000..e049de7128
--- /dev/null
+++ b/integrations-catalog/integrations/fullstory.json
@@ -0,0 +1,45 @@
+{
+  "slug": "fullstory",
+  "name": "FullStory",
+  "description": "Monitor FullStory session replay and analytics for user data handling and access compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://developer.fullstory.com/server/v2/getting-started/authentication/",
+  "baseUrl": "https://api.fullstory.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to FullStory at https://app.fullstory.com\n2. Go to Settings → Integrations → API Keys\n3. Generate a Server API key\n4. Copy and enter it below (the key itself, no encoding needed)",
+      "credentialFields": [
+        {
+          "label": "Server API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in FullStory Settings → Integrations → API Keys (Server API key)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "fullstory_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews FullStory users with access to session replay data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "fullstory_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies FullStory data capture policies are configured to protect sensitive user data",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/fusionauth.json b/integrations-catalog/integrations/fusionauth.json
new file mode 100644
index 0000000000..c0e352a0db
--- /dev/null
+++ b/integrations-catalog/integrations/fusionauth.json
@@ -0,0 +1,65 @@
+{
+  "slug": "fusionauth",
+  "name": "FusionAuth",
+  "description": "Monitor FusionAuth identity platform for MFA configuration, user access management, role-based access controls, and audit logging.",
+  "category": "Identity & Access",
+  "docsUrl": "https://fusionauth.io/docs/apis/",
+  "baseUrl": "https://placeholder.fusionauth.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "FusionAuth API key with read access. Found in Settings > API Keys."
+        },
+        {
+          "label": "Instance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your FusionAuth instance URL (e.g. https://your-app.fusionauth.io or https://auth.yourdomain.com). No trailing slash."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "fusionauth_2fa",
+      "name": "2FA",
+      "description": "Verifies that multi-factor authentication methods are enabled at the tenant level in FusionAuth.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "fusionauth_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies that user accounts exist and are properly managed in FusionAuth, with active and inactive users tracked.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "fusionauth_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that applications in FusionAuth have roles defined for role-based access control.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "fusionauth_access_review_log",
+      "name": "Access Review Log",
+      "description": "Verifies that audit logging is active in FusionAuth by checking for recent audit log entries.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/gitbook.json b/integrations-catalog/integrations/gitbook.json
new file mode 100644
index 0000000000..9cd674682e
--- /dev/null
+++ b/integrations-catalog/integrations/gitbook.json
@@ -0,0 +1,35 @@
+{
+  "slug": "gitbook",
+  "name": "GitBook",
+  "description": "Monitor GitBook documentation spaces and team access for knowledge management compliance",
+  "category": "Development",
+  "docsUrl": "https://developer.gitbook.com/",
+  "baseUrl": "https://api.gitbook.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "gitbook_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews GitBook organization members and their roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "gitbook_access_review",
+      "name": "Access Review Log",
+      "description": "Reviews GitBook spaces for documentation organization",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/gitguardian.json b/integrations-catalog/integrations/gitguardian.json
new file mode 100644
index 0000000000..3e09f3de77
--- /dev/null
+++ b/integrations-catalog/integrations/gitguardian.json
@@ -0,0 +1,35 @@
+{
+  "slug": "gitguardian",
+  "name": "GitGuardian",
+  "description": "Monitor GitGuardian for exposed secrets and code security incidents",
+  "category": "Security",
+  "docsUrl": "https://api.gitguardian.com/docs",
+  "baseUrl": "https://api.gitguardian.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "gitguardian_secure_code",
+      "name": "Secure Code",
+      "description": "Checks GitGuardian for open incidents of exposed secrets in code",
+      "defaultSeverity": "critical",
+      "enabled": true
+    },
+    {
+      "slug": "gitguardian_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Reviews GitGuardian monitored sources for secret scanning coverage",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/github-copilot.json b/integrations-catalog/integrations/github-copilot.json
new file mode 100644
index 0000000000..a8a77f1545
--- /dev/null
+++ b/integrations-catalog/integrations/github-copilot.json
@@ -0,0 +1,50 @@
+{
+  "slug": "github-copilot",
+  "name": "GitHub Copilot",
+  "description": "Monitor GitHub Copilot seat assignments, usage activity, and policy configuration for compliance",
+  "category": "Development",
+  "docsUrl": "https://docs.github.com/en/rest/copilot",
+  "baseUrl": "https://api.github.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to GitHub > Settings > Developer settings > OAuth Apps > New OAuth App\n2. Set Redirect URI to: https://api.trycomp.ai/v1/integrations/oauth/callback\n3. Request scopes: read:org, manage_billing:copilot\n4. Copy Client ID and Secret to Comp AI admin panel\n5. After connecting, enter your GitHub organization name",
+      "scopes": [
+        "read:org",
+        "manage_billing:copilot"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": false
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "copilot_seat_access",
+      "name": "Employee Access",
+      "description": "Reviews GitHub Copilot seat assignments and identifies users with inactive licenses",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "copilot_policy",
+      "name": "Separation of Environments",
+      "description": "Verifies that GitHub Copilot policies are configured to control access by team and environment",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "copilot_access_review",
+      "name": "Access Review Log",
+      "description": "Reviews all GitHub Copilot seat assignments for access review compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/github.json b/integrations-catalog/integrations/github.json
new file mode 100644
index 0000000000..ede74a7c1a
--- /dev/null
+++ b/integrations-catalog/integrations/github.json
@@ -0,0 +1,35 @@
+{
+  "slug": "github",
+  "name": "GitHub",
+  "description": "Monitor GitHub organization members and repository access for code compliance",
+  "category": "Development",
+  "docsUrl": "https://docs.github.com/en/rest",
+  "baseUrl": "https://api.github.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "github_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews GitHub organization members and verifies appropriate access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "github_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies GitHub repositories have proper branch protection and access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/gitlab.json b/integrations-catalog/integrations/gitlab.json
new file mode 100644
index 0000000000..610c01d994
--- /dev/null
+++ b/integrations-catalog/integrations/gitlab.json
@@ -0,0 +1,58 @@
+{
+  "slug": "gitlab",
+  "name": "GitLab",
+  "description": "Monitor GitLab group security including 2FA enforcement, protected branches, and member access controls",
+  "category": "Development",
+  "docsUrl": "https://docs.gitlab.com/ee/api/",
+  "baseUrl": "https://gitlab.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to GitLab\n2. Go to your group > Settings > General > find the numeric Group ID\n3. Go to User Settings > Access Tokens > create a token with read_api scope\n4. Enter the token and your GitLab domain below (e.g. gitlab.com for cloud, or your self-hosted domain)",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in GitLab > Profile > Access Tokens. Create a token with api or read_api scope. Must be a group Owner or Admin to view 2FA status."
+        },
+        {
+          "label": "GitLab Domain",
+          "type": "text",
+          "required": true,
+          "helpText": "Use 'gitlab.com' for GitLab SaaS, or your self-hosted domain e.g. gitlab.company.com"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "two_factor_enforcement",
+      "name": "2FA",
+      "description": "Verifies that two-factor authentication is enforced at the GitLab group level",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "protected_branches",
+      "name": "Code Changes",
+      "description": "Verifies that GitLab projects have protected branches configured to enforce code review.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all members of the GitLab group with their access levels and status.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/go1.json b/integrations-catalog/integrations/go1.json
new file mode 100644
index 0000000000..7f976b0b8b
--- /dev/null
+++ b/integrations-catalog/integrations/go1.json
@@ -0,0 +1,45 @@
+{
+  "slug": "go1",
+  "name": "Go1",
+  "description": "Go1 is a learning content aggregator and training platform used for compliance training, L&D, and security awareness. Connect Go1 to verify employee access and training enrollment status.",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "Create a Developer App in Go1 Developer Portal (https://developers.go1.com). Copy the Client ID and Client Secret. Ensure the app has user.read, enrollment.read, and lo.read scopes enabled.",
+      "scopes": [
+        "user.read",
+        "enrollment.read",
+        "lo.read"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "go1_employee_access",
+      "name": "Go1 Employee Access",
+      "description": "Verifies that employees have active accounts in Go1 for security training access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "go1_training_enrollment",
+      "name": "Go1 Training Enrollment Verification",
+      "description": "Verifies that training enrollments exist in Go1, confirming employees are assigned and completing required training content.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/gong.json b/integrations-catalog/integrations/gong.json
new file mode 100644
index 0000000000..d7bdb8cb8b
--- /dev/null
+++ b/integrations-catalog/integrations/gong.json
@@ -0,0 +1,45 @@
+{
+  "slug": "gong",
+  "name": "Gong",
+  "description": "Monitor Gong revenue intelligence platform for call recording access and data retention compliance",
+  "category": "Security",
+  "docsUrl": "https://app.gong.io/settings/api/documentation",
+  "baseUrl": "https://api.gong.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Gong at https://app.gong.io\n2. Go to Settings → Ecosystem → API\n3. Generate API credentials (access key + secret)\n4. Base64 encode 'access_key:access_key_secret'\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'access_key:access_key_secret'. Found in Gong Settings → Ecosystem → API. Command: echo -n 'access_key:access_key_secret' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "gong_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Gong users with access to call recordings and revenue intelligence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "gong_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Gong account settings manage call recording retention and access appropriately",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/goodhire.json b/integrations-catalog/integrations/goodhire.json
new file mode 100644
index 0000000000..ba701303ac
--- /dev/null
+++ b/integrations-catalog/integrations/goodhire.json
@@ -0,0 +1,35 @@
+{
+  "slug": "goodhire",
+  "name": "GoodHire",
+  "description": "Monitor GoodHire background check candidates and screening reports for HR compliance",
+  "category": "Security",
+  "docsUrl": "https://www.goodhire.com/api/",
+  "baseUrl": "https://api.goodhire.com/v1",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "goodhire_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies GoodHire is being used for background check screening of employees",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "goodhire_employee_access",
+      "name": "Employee Access",
+      "description": "Lists GoodHire candidates and their background check status for access review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/google-cloud.json b/integrations-catalog/integrations/google-cloud.json
new file mode 100644
index 0000000000..359738e420
--- /dev/null
+++ b/integrations-catalog/integrations/google-cloud.json
@@ -0,0 +1,42 @@
+{
+  "slug": "google-cloud",
+  "name": "Google Cloud",
+  "description": "Monitor GCP projects and infrastructure for cloud compliance",
+  "category": "Cloud",
+  "docsUrl": "https://cloud.google.com/apis/docs/overview",
+  "baseUrl": "https://cloudresourcemanager.googleapis.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to Google Cloud Console > APIs & Services > Credentials\n2. Create an OAuth 2.0 Client ID (Web application)\n3. Add redirect URI: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Enable Cloud Resource Manager API\n5. Copy Client ID and Client Secret",
+      "scopes": [
+        "https://www.googleapis.com/auth/cloudplatformprojects.readonly"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "gcp_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists GCP projects for cloud infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "gcp_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies GCP has separate projects per environment",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/google-workspace-admin.json b/integrations-catalog/integrations/google-workspace-admin.json
new file mode 100644
index 0000000000..027ae0f94c
--- /dev/null
+++ b/integrations-catalog/integrations/google-workspace-admin.json
@@ -0,0 +1,43 @@
+{
+  "slug": "google-workspace-admin",
+  "name": "Google Workspace",
+  "description": "Monitor Google Workspace user access, organizational units, and admin activity for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.google.com/admin-sdk/directory/v1/guides/manage-users",
+  "baseUrl": "https://admin.googleapis.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Create or use existing OAuth app in Google Cloud Console > APIs & Services > Credentials\n2. Enable Admin SDK Directory API and Reports API\n3. Add redirect URI: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Copy Client ID and Secret to Comp AI admin panel\n5. Must be authorized by a Google Workspace super admin account",
+      "scopes": [
+        "https://www.googleapis.com/auth/admin.directory.user.readonly",
+        "https://www.googleapis.com/auth/admin.directory.orgunit.readonly"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "gws_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Google Workspace users, their account status, and 2FA enrollment",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "gws_org_units",
+      "name": "Separation of Environments",
+      "description": "Verifies that Google Workspace organizational units are configured to separate teams and environments",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": false
+}
diff --git a/integrations-catalog/integrations/gorgias.json b/integrations-catalog/integrations/gorgias.json
new file mode 100644
index 0000000000..a030cd1040
--- /dev/null
+++ b/integrations-catalog/integrations/gorgias.json
@@ -0,0 +1,51 @@
+{
+  "slug": "gorgias",
+  "name": "Gorgias",
+  "description": "Monitor Gorgias e-commerce helpdesk for agent access and customer support compliance",
+  "category": "Communication",
+  "docsUrl": "https://developers.gorgias.com/reference/introduction",
+  "baseUrl": "https://app.gorgias.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Gorgias at https://yourstore.gorgias.com\n2. Go to Settings → REST API\n3. Generate an API key\n4. Base64 encode 'your_email:api_key'\n5. Enter your subdomain and encoded credentials below",
+      "credentialFields": [
+        {
+          "label": "Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Gorgias subdomain (e.g. mystore from mystore.gorgias.com)"
+        },
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'email:api_key'. Found in Gorgias Settings → REST API. Command: echo -n 'email@company.com:api_key' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "gorgias_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Gorgias agent accounts with access to customer conversations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "gorgias_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Gorgias helpdesk is active for customer support",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/grafana-cloud.json b/integrations-catalog/integrations/grafana-cloud.json
new file mode 100644
index 0000000000..cedc72e2f4
--- /dev/null
+++ b/integrations-catalog/integrations/grafana-cloud.json
@@ -0,0 +1,65 @@
+{
+  "slug": "grafana-cloud",
+  "name": "Grafana Cloud",
+  "description": "Observability platform for metrics, logs, and traces. Verifies monitoring configuration, app availability, and user access in Grafana Cloud.",
+  "category": "Monitoring",
+  "docsUrl": "https://grafana.com/docs/grafana-cloud/developer-resources/api-reference/",
+  "baseUrl": "https://grafana.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Grafana Cloud instance (e.g. https://mycompany.grafana.net)\n2. Go to Administration > Service Accounts\n3. Create a service account with Admin role (required for user access checks)\n4. Generate a service account token (starts with glsa_)\n5. Enter your stack URL and the token below",
+      "credentialFields": [
+        {
+          "label": "Grafana Stack URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Grafana Cloud stack URL, e.g. https://mycompany.grafana.net"
+        },
+        {
+          "label": "Service Account Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a service account with Admin role in your Grafana instance: Administration > Service Accounts > create a token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "grafana_cloud_app_availability",
+      "name": "Grafana Cloud App Availability",
+      "description": "Verifies Grafana Cloud is accessible and the service account token is valid",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "grafana_cloud_employee_access",
+      "name": "Grafana Cloud Employee Access",
+      "description": "Lists Grafana Cloud users to verify access controls are in place",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "grafana_cloud_alert_rules",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that Grafana Cloud alert rules are configured for monitoring",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "grafana_cloud_datasources",
+      "name": "Utility Monitoring",
+      "description": "Verifies that Grafana Cloud datasources are configured for monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/greenhouse.json b/integrations-catalog/integrations/greenhouse.json
new file mode 100644
index 0000000000..20ab67215a
--- /dev/null
+++ b/integrations-catalog/integrations/greenhouse.json
@@ -0,0 +1,35 @@
+{
+  "slug": "greenhouse",
+  "name": "Greenhouse",
+  "description": "Monitor Greenhouse recruiting pipeline and user access for HR compliance",
+  "category": "HR & People",
+  "docsUrl": "https://developers.greenhouse.io/harvest.html",
+  "baseUrl": "https://harvest.greenhouse.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "greenhouse_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Greenhouse users and verifies access is appropriate",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "greenhouse_employee_descriptions",
+      "name": "Employee Descriptions",
+      "description": "Verifies Greenhouse has job postings with proper descriptions",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/groq.json b/integrations-catalog/integrations/groq.json
new file mode 100644
index 0000000000..9a595db97e
--- /dev/null
+++ b/integrations-catalog/integrations/groq.json
@@ -0,0 +1,35 @@
+{
+  "slug": "groq",
+  "name": "Groq",
+  "description": "AI inference platform with LPU hardware. Monitor API access.",
+  "category": "Cloud",
+  "docsUrl": "https://console.groq.com/docs/api-reference",
+  "baseUrl": "https://api.groq.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "groq_app_availability",
+      "name": "Groq App Availability",
+      "description": "Checks that the Groq API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "groq_employee_access",
+      "name": "Groq Employee Access",
+      "description": "Verifies employee access to Groq via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/guru.json b/integrations-catalog/integrations/guru.json
new file mode 100644
index 0000000000..ee49b07478
--- /dev/null
+++ b/integrations-catalog/integrations/guru.json
@@ -0,0 +1,44 @@
+{
+  "slug": "guru",
+  "name": "Guru",
+  "description": "Guru knowledge management platform for teams",
+  "category": "Productivity",
+  "docsUrl": "https://developer.getguru.com/",
+  "baseUrl": "https://api.getguru.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Guru as admin\n2. Settings → Integrations → Guru API\n3. Copy your User Token\n4. Enter your email and token below",
+      "credentialFields": [
+        {
+          "label": "User Email",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Guru admin email"
+        },
+        {
+          "label": "User Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Guru → Settings → Integrations → Guru API → User Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "guru_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Guru team members to verify knowledge base access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/gusto.json b/integrations-catalog/integrations/gusto.json
new file mode 100644
index 0000000000..2b6cc06154
--- /dev/null
+++ b/integrations-catalog/integrations/gusto.json
@@ -0,0 +1,43 @@
+{
+  "slug": "gusto",
+  "name": "Gusto",
+  "description": "Monitor Gusto employee records for HR compliance, access management, and employee verification",
+  "category": "HR & People",
+  "docsUrl": "https://docs.gusto.com/embedded-payroll/reference",
+  "baseUrl": "https://api.gusto.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to Gusto Developer Portal (dev.gusto.com)\n2. Create a new application\n3. Add redirect URL: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Request scopes: employees:read, companies:read\n5. Copy Client ID and Client Secret",
+      "scopes": [
+        "employees:read",
+        "companies:read"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews active Gusto employees for access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies that all Gusto employees have email addresses for verification",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hackerone.json b/integrations-catalog/integrations/hackerone.json
new file mode 100644
index 0000000000..80ca024171
--- /dev/null
+++ b/integrations-catalog/integrations/hackerone.json
@@ -0,0 +1,45 @@
+{
+  "slug": "hackerone",
+  "name": "HackerOne",
+  "description": "Monitor HackerOne bug bounty program for security research and vulnerability management compliance",
+  "category": "Security",
+  "docsUrl": "https://api.hackerone.com/customer-resources/",
+  "baseUrl": "https://api.hackerone.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to HackerOne at https://hackerone.com\n2. Go to Settings → API Token\n3. Create a new token with a name (identifier) and token value\n4. Base64 encode 'identifier:api_token' and enter below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'identifier:api_token'. Create API credentials in HackerOne → Settings → API Token. Command: echo -n 'identifier:token' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hackerone_internal_security_audit",
+      "name": "Internal Security Audit",
+      "description": "Verifies HackerOne programs are active for continuous security testing",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "hackerone_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies active HackerOne vulnerability reports are being tracked and remediated",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/harness.json b/integrations-catalog/integrations/harness.json
new file mode 100644
index 0000000000..f1602fd79d
--- /dev/null
+++ b/integrations-catalog/integrations/harness.json
@@ -0,0 +1,35 @@
+{
+  "slug": "harness",
+  "name": "Harness",
+  "description": "Monitor Harness CI/CD pipelines and user access for deployment and change management compliance",
+  "category": "Development",
+  "docsUrl": "https://apidocs.harness.io/",
+  "baseUrl": "https://app.harness.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "harness_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Harness pipelines are configured for controlled deployments and change management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "harness_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Harness has separate projects/environments for deployment stages",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/harvest.json b/integrations-catalog/integrations/harvest.json
new file mode 100644
index 0000000000..4fd7345e8b
--- /dev/null
+++ b/integrations-catalog/integrations/harvest.json
@@ -0,0 +1,51 @@
+{
+  "slug": "harvest",
+  "name": "Harvest",
+  "description": "Time tracking and invoicing platform.",
+  "category": "Productivity",
+  "docsUrl": "https://help.getharvest.com/api-v2/",
+  "baseUrl": "https://api.harvestapp.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Harvest\n2. Go to Settings → API & OAuth\n3. Create a Personal Access Token\n4. Copy the Account ID and token\n5. Paste both below",
+      "credentialFields": [
+        {
+          "label": "Account ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Harvest → Settings → API & OAuth → Account ID."
+        },
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Harvest → Settings → API & OAuth → Personal Access Tokens."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "harvest_app_availability",
+      "name": "Harvest App Availability",
+      "description": "Checks Harvest app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "harvest_employee_access",
+      "name": "Harvest Employee Access",
+      "description": "Checks Harvest employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hashicorp-vault.json b/integrations-catalog/integrations/hashicorp-vault.json
new file mode 100644
index 0000000000..ffa0bec892
--- /dev/null
+++ b/integrations-catalog/integrations/hashicorp-vault.json
@@ -0,0 +1,35 @@
+{
+  "slug": "hashicorp-vault",
+  "name": "HashiCorp Vault",
+  "description": "Monitor HashiCorp Vault health, secrets engines, and policies for secrets management compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.hashicorp.com/vault/api-docs",
+  "baseUrl": "https://vault.example.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vault_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies HashiCorp Vault is initialized, unsealed, and healthy",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "vault_encryption",
+      "name": "Encryption at Rest",
+      "description": "Verifies Vault has secrets engines configured for encryption at rest",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hellosign.json b/integrations-catalog/integrations/hellosign.json
new file mode 100644
index 0000000000..f0b6cf920c
--- /dev/null
+++ b/integrations-catalog/integrations/hellosign.json
@@ -0,0 +1,35 @@
+{
+  "slug": "hellosign",
+  "name": "Dropbox Sign",
+  "description": "Electronic signature platform. Monitor account access and signature workflows.",
+  "category": "Productivity",
+  "docsUrl": "https://developers.hellosign.com/",
+  "baseUrl": "https://api.hellosign.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hellosign_app_availability",
+      "name": "Dropbox Sign App Availability",
+      "description": "Checks Dropbox Sign app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hellosign_employee_access",
+      "name": "Dropbox Sign Employee Access",
+      "description": "Checks Dropbox Sign employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/helpscout.json b/integrations-catalog/integrations/helpscout.json
new file mode 100644
index 0000000000..c97d95ad68
--- /dev/null
+++ b/integrations-catalog/integrations/helpscout.json
@@ -0,0 +1,45 @@
+{
+  "slug": "helpscout",
+  "name": "Help Scout",
+  "description": "Monitor Help Scout customer support platform for mailbox access and team member compliance",
+  "category": "Communication",
+  "docsUrl": "https://developer.helpscout.com/mailbox-api/",
+  "baseUrl": "https://api.helpscout.net/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Help Scout at https://secure.helpscout.net\n2. Go to Your Profile → API Keys\n3. Create a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Help Scout Profile → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "helpscout_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Help Scout team members with access to customer support mailboxes",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "helpscout_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Help Scout mailboxes are active for customer support",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/heroku.json b/integrations-catalog/integrations/heroku.json
new file mode 100644
index 0000000000..6637b3441f
--- /dev/null
+++ b/integrations-catalog/integrations/heroku.json
@@ -0,0 +1,45 @@
+{
+  "slug": "heroku",
+  "name": "Heroku",
+  "description": "Monitor Heroku applications for app availability and environment separation compliance",
+  "category": "Cloud",
+  "docsUrl": "https://devcenter.heroku.com/articles/platform-api-reference",
+  "baseUrl": "https://api.heroku.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Heroku Dashboard\n2. Go to Account Settings\n3. Scroll to API Key > Reveal\n4. Copy and paste the API key below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Heroku Account Settings > API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "apps_available",
+      "name": "App Availability",
+      "description": "Verifies that Heroku applications are deployed and available",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "env_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies that multiple Heroku apps exist for environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hetzner.json b/integrations-catalog/integrations/hetzner.json
new file mode 100644
index 0000000000..4489ba4e31
--- /dev/null
+++ b/integrations-catalog/integrations/hetzner.json
@@ -0,0 +1,45 @@
+{
+  "slug": "hetzner",
+  "name": "Hetzner Cloud",
+  "description": "Monitor Hetzner Cloud servers and firewall configuration for EU infrastructure compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.hetzner.cloud/",
+  "baseUrl": "https://api.hetzner.cloud/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Hetzner Cloud Console at https://console.hetzner.cloud\n2. Go to your Project → Security → API Tokens\n3. Generate a Read-only token\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Hetzner Cloud Console → Project → Security → API Tokens. Use Read-only access."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hetzner_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all Hetzner Cloud servers for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hetzner_production_firewall",
+      "name": "Production Firewall",
+      "description": "Verifies Hetzner Cloud firewall rules are configured for network security",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hex.json b/integrations-catalog/integrations/hex.json
new file mode 100644
index 0000000000..26b84ee79c
--- /dev/null
+++ b/integrations-catalog/integrations/hex.json
@@ -0,0 +1,35 @@
+{
+  "slug": "hex",
+  "name": "Hex",
+  "description": "Collaborative data analytics platform. Monitor project access and workspace.",
+  "category": "Monitoring",
+  "docsUrl": "https://learn.hex.tech/docs/develop-logic/hex-api/api-reference",
+  "baseUrl": "https://app.hex.tech",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hex_app_availability",
+      "name": "Hex App Availability",
+      "description": "Checks that the Hex API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hex_employee_access",
+      "name": "Hex Employee Access",
+      "description": "Verifies employee access to Hex via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hexnode.json b/integrations-catalog/integrations/hexnode.json
new file mode 100644
index 0000000000..14cd5be571
--- /dev/null
+++ b/integrations-catalog/integrations/hexnode.json
@@ -0,0 +1,71 @@
+{
+  "slug": "hexnode",
+  "name": "Hexnode",
+  "description": "Hexnode UEM integration for device management, compliance monitoring, and policy enforcement",
+  "category": "Security",
+  "docsUrl": "https://www.hexnode.com/mobile-device-management/developers/",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Hexnode MDM admin portal\n2. Go to Admin > API\n3. Enable the 'Enable API Access' checkbox\n4. Copy your API key\n5. Enter your portal name (the subdomain before .hexnodemdm.com) and the API key above",
+      "credentialFields": [
+        {
+          "label": "Portal Name",
+          "type": "text",
+          "required": true
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "hexnode_device_inventory",
+      "name": "Device Inventory",
+      "description": "Retrieve and verify all enrolled devices in Hexnode MDM",
+      "defaultSeverity": "info",
+      "enabled": true
+    },
+    {
+      "slug": "hexnode_device_compliance",
+      "name": "Device Compliance",
+      "description": "Check compliance status across all managed devices in Hexnode",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hexnode_policy_enforcement",
+      "name": "Policy Enforcement",
+      "description": "Verify that security policies are configured and applied to devices in Hexnode",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hexnode_user_management",
+      "name": "User Management",
+      "description": "Verify user enrollment status and management in Hexnode",
+      "defaultSeverity": "info",
+      "enabled": true
+    },
+    {
+      "slug": "hexnode_device_activity",
+      "name": "Device Activity Monitoring",
+      "description": "Check for inactive or stale devices that have not reported recently",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hibob.json b/integrations-catalog/integrations/hibob.json
new file mode 100644
index 0000000000..69148676f8
--- /dev/null
+++ b/integrations-catalog/integrations/hibob.json
@@ -0,0 +1,45 @@
+{
+  "slug": "hibob",
+  "name": "HiBob",
+  "description": "Monitor HiBob employee records and job descriptions for HR compliance and employee data completeness",
+  "category": "HR & People",
+  "docsUrl": "https://apidocs.hibob.com/reference",
+  "baseUrl": "https://api.hibob.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to HiBob Admin\n2. Go to Settings > Integrations > Service Users\n3. Create a new service user with People read permissions\n4. Copy and paste the generated token below",
+      "credentialFields": [
+        {
+          "label": "Service User Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a Service User in HiBob > Settings > Integrations > Service Users"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews HiBob employee records for access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_descriptions",
+      "name": "Employee Descriptions",
+      "description": "Verifies that HiBob employees have job titles set for employee descriptions",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/highlight-io.json b/integrations-catalog/integrations/highlight-io.json
new file mode 100644
index 0000000000..1a939e25dc
--- /dev/null
+++ b/integrations-catalog/integrations/highlight-io.json
@@ -0,0 +1,35 @@
+{
+  "slug": "highlight-io",
+  "name": "Highlight",
+  "description": "Full-stack observability platform with session replay and error monitoring.",
+  "category": "Monitoring",
+  "docsUrl": "https://www.highlight.io/docs",
+  "baseUrl": "https://pri.highlight.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "highlight_io_app_availability",
+      "name": "Highlight App Availability",
+      "description": "Checks that the Highlight API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "highlight_io_employee_access",
+      "name": "Highlight Employee Access",
+      "description": "Verifies employee access to Highlight via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hightouch.json b/integrations-catalog/integrations/hightouch.json
new file mode 100644
index 0000000000..f0e84652cb
--- /dev/null
+++ b/integrations-catalog/integrations/hightouch.json
@@ -0,0 +1,44 @@
+{
+  "slug": "hightouch",
+  "name": "Hightouch",
+  "description": "Hightouch reverse ETL platform. Monitor sync health, data pipeline availability, and source/destination configuration.",
+  "category": "Development",
+  "docsUrl": "https://hightouch.com/docs/api-reference",
+  "baseUrl": "https://api.hightouch.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Hightouch at https://app.hightouch.com\n2. Go to Settings > API Keys\n3. Create a new API key\n4. Copy the key and enter it below"
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hightouch_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Hightouch syncs are active, not disabled, and completing successfully.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hightouch_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Hightouch syncs have recent successful runs, indicating active monitoring of data pipelines.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hightouch_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all Hightouch sources and destinations to provide a complete inventory of the data pipeline infrastructure.",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hireright.json b/integrations-catalog/integrations/hireright.json
new file mode 100644
index 0000000000..e0b9e3d62d
--- /dev/null
+++ b/integrations-catalog/integrations/hireright.json
@@ -0,0 +1,55 @@
+{
+  "slug": "hireright",
+  "name": "HireRight",
+  "description": "Monitor background screening status and verify employee background checks through HireRight",
+  "category": "HR & People",
+  "docsUrl": "https://stage-developer.hireright.com/documentation/overview",
+  "baseUrl": "https://api.hireright.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Domain ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your unique API integration domain identifier (hr-domain-id), provided by HireRight"
+        },
+        {
+          "label": "Company Login",
+          "type": "text",
+          "required": true,
+          "helpText": "Your unique company identifier (hr-company-login), provided by HireRight"
+        },
+        {
+          "label": "User Reference ID",
+          "type": "text",
+          "required": true,
+          "helpText": "The unique user identifier (hr-user-ref-id), typically an admin user email address"
+        },
+        {
+          "label": "API Subscription Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Your API subscription key (hr-api-subscription-key), provided by HireRight"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "background_check_status",
+      "name": "Employee Verification",
+      "description": "Verifies that the organization has active background screening capability through HireRight and checks order completion status",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hive.json b/integrations-catalog/integrations/hive.json
new file mode 100644
index 0000000000..cf657a45d7
--- /dev/null
+++ b/integrations-catalog/integrations/hive.json
@@ -0,0 +1,52 @@
+{
+  "slug": "hive",
+  "name": "Hive",
+  "description": "Hive is a project management and collaboration platform used for ticketing and team collaboration. This integration monitors workspace member access and role-based access controls.",
+  "category": "Productivity",
+  "docsUrl": "https://developers.hive.com/reference",
+  "baseUrl": "https://app.hive.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Hive at https://app.hive.com\n2. Click the main menu in the top right corner\n3. Select 'My Profile'\n4. Click the 'API Info' tab\n5. Generate an API key and copy it\n6. Also copy your User ID from the same page\n7. Enter both values below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Hive > Main Menu (top right) > My Profile > API Info tab. Generate a key there."
+        },
+        {
+          "label": "User ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found alongside your API key on the API Info tab in your Hive profile."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "hive_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all users in the Hive workspace to verify employee access to the platform.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hive_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Checks role tags assigned to workspace members in Hive to verify role-based access control configuration.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/honeybadger.json b/integrations-catalog/integrations/honeybadger.json
new file mode 100644
index 0000000000..60d9900b4b
--- /dev/null
+++ b/integrations-catalog/integrations/honeybadger.json
@@ -0,0 +1,45 @@
+{
+  "slug": "honeybadger",
+  "name": "Honeybadger",
+  "description": "Monitor Honeybadger error monitoring for application health and incident response compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.honeybadger.io/api/",
+  "baseUrl": "https://app.honeybadger.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Honeybadger at https://app.honeybadger.io\n2. Go to Profile → Authentication Tokens\n3. Copy your API key\n4. Base64 encode 'api_key:' (with colon, empty password)\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'api_key:' (your API key with a colon and empty password). Command: echo -n 'your_api_key:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "honeybadger_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Honeybadger projects are configured for error monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "honeybadger_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies Honeybadger uptime checks are configured for availability monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/honeycomb.json b/integrations-catalog/integrations/honeycomb.json
new file mode 100644
index 0000000000..37ee20a878
--- /dev/null
+++ b/integrations-catalog/integrations/honeycomb.json
@@ -0,0 +1,35 @@
+{
+  "slug": "honeycomb",
+  "name": "Honeycomb",
+  "description": "Monitor Honeycomb observability configuration — verify datasets and team access for distributed tracing compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.honeycomb.io/api/",
+  "baseUrl": "https://api.honeycomb.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "honeycomb_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Honeycomb datasets are configured for observability and tracing",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "honeycomb_utility_monitoring",
+      "name": "Utility Monitoring",
+      "description": "Verifies Honeycomb queries and SLOs are configured for ongoing observability",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hoxhunt.json b/integrations-catalog/integrations/hoxhunt.json
new file mode 100644
index 0000000000..5d6dabc808
--- /dev/null
+++ b/integrations-catalog/integrations/hoxhunt.json
@@ -0,0 +1,58 @@
+{
+  "slug": "hoxhunt",
+  "name": "Hoxhunt",
+  "description": "Hoxhunt phishing simulation and security awareness training platform for measuring and improving employee security behavior",
+  "category": "Security",
+  "docsUrl": "https://support.hoxhunt.com/hc/en-us/categories/16473071192732-Technical-corner",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Hoxhunt admin dashboard\\n2. Go to Settings > API or contact your Hoxhunt account manager to request an API token\\n3. Copy your API token and enter it above\\n4. More info: https://support.hoxhunt.com/hc/en-us/categories/16473071192732-Technical-corner",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hoxhunt_users_enrolled",
+      "name": "Employee Access",
+      "description": "Verify users are enrolled in Hoxhunt security awareness training",
+      "defaultSeverity": "info",
+      "enabled": true
+    },
+    {
+      "slug": "hoxhunt_incidents",
+      "name": "Incident Response",
+      "description": "Monitor phishing incidents reported through Hoxhunt",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hoxhunt_threats",
+      "name": "Monitoring & Alerting",
+      "description": "Monitor real phishing threats reported and analyzed by Hoxhunt",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hoxhunt_training_active",
+      "name": "Employee Verification",
+      "description": "Verify Hoxhunt security awareness training platform is active and employees are being trained on phishing, social engineering, and credential protection",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hubspot.json b/integrations-catalog/integrations/hubspot.json
new file mode 100644
index 0000000000..096b1d4f18
--- /dev/null
+++ b/integrations-catalog/integrations/hubspot.json
@@ -0,0 +1,45 @@
+{
+  "slug": "hubspot",
+  "name": "HubSpot",
+  "description": "Monitor HubSpot user access and contact owners for CRM compliance and access management",
+  "category": "Productivity",
+  "docsUrl": "https://developers.hubspot.com/docs/api/overview",
+  "baseUrl": "https://api.hubapi.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to HubSpot\n2. Go to Settings > Integrations > Private Apps\n3. Create a new private app\n4. Add scopes: settings.users.read, crm.objects.owners.read\n5. Copy and paste the access token below",
+      "credentialFields": [
+        {
+          "label": "Private App Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a Private App in HubSpot > Settings > Integrations > Private Apps"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews HubSpot users to verify employee access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "contact_owners",
+      "name": "Contact Information",
+      "description": "Lists HubSpot CRM contact owners for contact information compliance",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/huggingface.json b/integrations-catalog/integrations/huggingface.json
new file mode 100644
index 0000000000..581e80b4c2
--- /dev/null
+++ b/integrations-catalog/integrations/huggingface.json
@@ -0,0 +1,35 @@
+{
+  "slug": "huggingface",
+  "name": "Hugging Face",
+  "description": "ML platform for models, datasets, and inference. Monitor access and usage.",
+  "category": "Cloud",
+  "docsUrl": "https://huggingface.co/docs/hub/api",
+  "baseUrl": "https://huggingface.co",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "huggingface_app_availability",
+      "name": "Hugging Face App Availability",
+      "description": "Checks that the Hugging Face API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "huggingface_employee_access",
+      "name": "Hugging Face Employee Access",
+      "description": "Verifies employee access to Hugging Face via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/humaans.json b/integrations-catalog/integrations/humaans.json
new file mode 100644
index 0000000000..f609b17fe4
--- /dev/null
+++ b/integrations-catalog/integrations/humaans.json
@@ -0,0 +1,38 @@
+{
+  "slug": "humaans",
+  "name": "Humaans",
+  "description": "Humaans HR platform for managing employee records and org data",
+  "category": "HR & People",
+  "docsUrl": "https://app.humaans.io/api-docs",
+  "baseUrl": "https://app.humaans.io/api",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Humaans\n2. Go to Settings → API Tokens\n3. Create a new API token\n4. Copy the token and paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate an API token in Humaans → Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "humaans_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Humaans employees to verify HR records are up to date",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hunter.json b/integrations-catalog/integrations/hunter.json
new file mode 100644
index 0000000000..2dcdf0d2ce
--- /dev/null
+++ b/integrations-catalog/integrations/hunter.json
@@ -0,0 +1,45 @@
+{
+  "slug": "hunter",
+  "name": "Hunter",
+  "description": "Hunter email finder and verification platform for outreach and lead generation",
+  "category": "Communication",
+  "docsUrl": "https://hunter.io/api-documentation",
+  "baseUrl": "https://api.hunter.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Hunter.io\n2. Go to Settings → API\n3. Copy your API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Hunter → Settings → API → API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hunter_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Hunter platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hunter_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Hunter account credentials and access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/huntress.json b/integrations-catalog/integrations/huntress.json
new file mode 100644
index 0000000000..54f1840ba4
--- /dev/null
+++ b/integrations-catalog/integrations/huntress.json
@@ -0,0 +1,57 @@
+{
+  "slug": "huntress",
+  "name": "Huntress",
+  "description": "Monitor Huntress managed detection and response (MDR/EDR) platform for incident reports, agent status, and threat detection compliance",
+  "category": "Security",
+  "docsUrl": "https://api.huntress.io/docs",
+  "baseUrl": "https://api.huntress.io/v1/",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "text",
+          "required": true,
+          "helpText": "API Key from Account Settings > API Credentials in Huntress portal"
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Secret Key from Account Settings > API Credentials in Huntress portal"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "incident_reports",
+      "name": "Incident Response",
+      "description": "Verifies active threat detection and incident response capabilities by checking for incident reports in the Huntress platform",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Reviews Huntress agent deployment and device protection status across endpoints",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies threat monitoring and alerting capabilities are active across organizations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/hyperproof.json b/integrations-catalog/integrations/hyperproof.json
new file mode 100644
index 0000000000..2abdabb442
--- /dev/null
+++ b/integrations-catalog/integrations/hyperproof.json
@@ -0,0 +1,35 @@
+{
+  "slug": "hyperproof",
+  "name": "Hyperproof",
+  "description": "Compliance operations platform. Monitor compliance programs and evidence collection.",
+  "category": "Security",
+  "docsUrl": "https://developer.hyperproof.app/",
+  "baseUrl": "https://api.hyperproof.app",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "hyperproof_app_availability",
+      "name": "Hyperproof App Availability",
+      "description": "Checks that the Hyperproof API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "hyperproof_employee_access",
+      "name": "Hyperproof Employee Access",
+      "description": "Verifies access to Hyperproof.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/incident-io.json b/integrations-catalog/integrations/incident-io.json
new file mode 100644
index 0000000000..a398be4dfe
--- /dev/null
+++ b/integrations-catalog/integrations/incident-io.json
@@ -0,0 +1,35 @@
+{
+  "slug": "incident-io",
+  "name": "Incident.io",
+  "description": "Monitor Incident.io for incident response workflows and team access",
+  "category": "Monitoring",
+  "docsUrl": "https://api-docs.incident.io/",
+  "baseUrl": "https://api.incident.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "incidentio_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies incident response workflows are configured with active users and roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "incidentio_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Incident.io alert sources are configured for automated incident detection",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/infisical.json b/integrations-catalog/integrations/infisical.json
new file mode 100644
index 0000000000..f3d17e3260
--- /dev/null
+++ b/integrations-catalog/integrations/infisical.json
@@ -0,0 +1,35 @@
+{
+  "slug": "infisical",
+  "name": "Infisical",
+  "description": "Monitor Infisical secrets management workspaces and member access for secrets hygiene compliance",
+  "category": "Security",
+  "docsUrl": "https://infisical.com/docs/api-reference/overview/introduction",
+  "baseUrl": "https://app.infisical.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "infisical_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Infisical projects are configured for secrets management",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "infisical_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Infisical workspaces have environment separation configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/inngest.json b/integrations-catalog/integrations/inngest.json
new file mode 100644
index 0000000000..69171aeb77
--- /dev/null
+++ b/integrations-catalog/integrations/inngest.json
@@ -0,0 +1,35 @@
+{
+  "slug": "inngest",
+  "name": "Inngest",
+  "description": "Event-driven workflow platform. Monitor function deployment and event access.",
+  "category": "Development",
+  "docsUrl": "https://www.inngest.com/docs/reference/",
+  "baseUrl": "https://api.inngest.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "inngest_app_availability",
+      "name": "Inngest App Availability",
+      "description": "Checks that the Inngest API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "inngest_employee_access",
+      "name": "Inngest Employee Access",
+      "description": "Verifies employee access to Inngest via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/instatus.json b/integrations-catalog/integrations/instatus.json
new file mode 100644
index 0000000000..e580e6d348
--- /dev/null
+++ b/integrations-catalog/integrations/instatus.json
@@ -0,0 +1,45 @@
+{
+  "slug": "instatus",
+  "name": "Instatus",
+  "description": "Instatus status page platform for communicating service incidents",
+  "category": "Monitoring",
+  "docsUrl": "https://instatus.com/api",
+  "baseUrl": "https://api.instatus.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Instatus\n2. Go to Account Settings\n3. Copy your API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Instatus → Account Settings → API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "instatus_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Instatus status page platform is accessible",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "instatus_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Instatus status pages to verify incident communication setup",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/intercom.json b/integrations-catalog/integrations/intercom.json
new file mode 100644
index 0000000000..87882a7bab
--- /dev/null
+++ b/integrations-catalog/integrations/intercom.json
@@ -0,0 +1,51 @@
+{
+  "slug": "intercom",
+  "name": "Intercom",
+  "description": "Monitor Intercom admin access and contact data management for compliance",
+  "category": "Communication",
+  "docsUrl": "https://developers.intercom.com/",
+  "baseUrl": "https://api.intercom.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. In Intercom, go to the Developer Hub\n2. Open your app (or create one)\n3. Go to Configure > Authentication and copy the Access Token\n4. Select your region (check your Intercom URL to determine which region you're on)\n5. Paste the Access Token and select your region below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Intercom Access Token. In Intercom, go to Developer Hub, open your app (or create one), then find the token under Configure > Authentication."
+        },
+        {
+          "label": "Region",
+          "type": "select",
+          "required": true,
+          "helpText": "Select the region where your Intercom workspace is hosted"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "intercom_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Intercom admins and verifies access is appropriate",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "intercom_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Intercom contact data is being maintained",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/intune.json b/integrations-catalog/integrations/intune.json
new file mode 100644
index 0000000000..f018d94362
--- /dev/null
+++ b/integrations-catalog/integrations/intune.json
@@ -0,0 +1,55 @@
+{
+  "slug": "intune",
+  "name": "Microsoft Intune",
+  "description": "Monitor device compliance, enrollment status, and compliance policy coverage across your Intune-managed device fleet",
+  "category": "Security",
+  "docsUrl": "https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview",
+  "baseUrl": "https://graph.microsoft.com/v1.0/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "Register an app in Microsoft Entra ID (Azure Portal > App registrations). Under API permissions, add Microsoft Graph delegated permissions: DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All, ServiceHealth.Read.All. Grant admin consent for the tenant. Requires an active Intune license.",
+      "createAppUrl": "https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+      "scopes": [
+        "DeviceManagementManagedDevices.Read.All",
+        "DeviceManagementConfiguration.Read.All",
+        "ServiceHealth.Read.All",
+        "offline_access",
+        "openid",
+        "profile"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_compliance",
+      "name": "Device Compliance Status",
+      "description": "Checks that all Intune-managed devices are in a compliant state based on assigned compliance policies",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_inventory",
+      "name": "Device Inventory",
+      "description": "Collects an inventory of all enrolled Intune-managed devices as compliance evidence",
+      "defaultSeverity": "info",
+      "enabled": true
+    },
+    {
+      "slug": "compliance_policies",
+      "name": "Compliance Policy Coverage",
+      "description": "Verifies that device compliance policies are defined in Intune to enforce security standards like encryption, passwords, and OS updates",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ionos.json b/integrations-catalog/integrations/ionos.json
new file mode 100644
index 0000000000..b531bf7d63
--- /dev/null
+++ b/integrations-catalog/integrations/ionos.json
@@ -0,0 +1,45 @@
+{
+  "slug": "ionos",
+  "name": "IONOS Cloud",
+  "description": "IONOS Cloud infrastructure and hosting platform",
+  "category": "Cloud",
+  "docsUrl": "https://api.ionos.com/cloudapi/v6/",
+  "baseUrl": "https://api.ionos.com/cloudapi/v6",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to IONOS Cloud\n2. Go to Settings → API Tokens\n3. Create a new token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "IONOS Cloud → Settings → API Tokens → Create token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ionos_infra_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists IONOS Cloud data centers to verify infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ionos_employee_access",
+      "name": "Employee Access",
+      "description": "Lists IONOS Cloud users to verify access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ironclad.json b/integrations-catalog/integrations/ironclad.json
new file mode 100644
index 0000000000..cdb145729c
--- /dev/null
+++ b/integrations-catalog/integrations/ironclad.json
@@ -0,0 +1,45 @@
+{
+  "slug": "ironclad",
+  "name": "Ironclad",
+  "description": "Monitor Ironclad contract lifecycle management platform for document access and legal compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.ironcladapp.com/docs",
+  "baseUrl": "https://ironcladapp.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Ironclad at https://ironcladapp.com\n2. Go to Company Settings → API Tokens\n3. Create a new API token with read access\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Ironclad Company Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ironclad_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Ironclad users with access to contract management workflows",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ironclad_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Ironclad contract management platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/it-glue.json b/integrations-catalog/integrations/it-glue.json
new file mode 100644
index 0000000000..b3aca82a8e
--- /dev/null
+++ b/integrations-catalog/integrations/it-glue.json
@@ -0,0 +1,35 @@
+{
+  "slug": "it-glue",
+  "name": "IT Glue",
+  "description": "IT Glue is a documentation platform designed for managed service providers (MSPs) and IT departments to store and organize IT documentation",
+  "category": "Productivity",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Verify access to users in IT Glue",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Verify access to configurations and assets in IT Glue",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/iterable.json b/integrations-catalog/integrations/iterable.json
new file mode 100644
index 0000000000..27f497ce16
--- /dev/null
+++ b/integrations-catalog/integrations/iterable.json
@@ -0,0 +1,45 @@
+{
+  "slug": "iterable",
+  "name": "Iterable",
+  "description": "Iterable cross-channel growth marketing platform for customer communication",
+  "category": "Communication",
+  "docsUrl": "https://api.iterable.com/api/docs",
+  "baseUrl": "https://api.iterable.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Iterable\n2. Go to Integrations → API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Iterable → Integrations → API Keys → New API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "iterable_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Iterable platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "iterable_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Iterable user fields to verify platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ivanti.json b/integrations-catalog/integrations/ivanti.json
new file mode 100644
index 0000000000..b052841e50
--- /dev/null
+++ b/integrations-catalog/integrations/ivanti.json
@@ -0,0 +1,69 @@
+{
+  "slug": "ivanti",
+  "name": "Ivanti Neurons",
+  "description": "Monitor managed device compliance, device inventory, and user access in Ivanti Neurons platform",
+  "category": "Security",
+  "docsUrl": "https://help.ivanti.com/ht/help/en_US/CLOUD/api/Shared-Content/welcome.htm",
+  "baseUrl": "https://www.ivanticloud.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Neurons Hostname",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Ivanti Neurons hostname from the Auth URL (e.g. nvuprd-sfc.ivanticloud.com). Found in Admin > App Registrations."
+        },
+        {
+          "label": "Tenant ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Ivanti Neurons Tenant ID from the Auth URL. Found in Admin > App Registrations."
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Client ID from your Ivanti Neurons App Registration."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Client Secret from your Ivanti Neurons App Registration. Only shown once during registration."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies that endpoint devices are managed and discovered by Ivanti Neurons",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Retrieves a complete inventory of all endpoint devices discovered by Ivanti Neurons",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all users discovered in Ivanti Neurons and flags disabled accounts",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/jamf.json b/integrations-catalog/integrations/jamf.json
new file mode 100644
index 0000000000..f6ed9adf46
--- /dev/null
+++ b/integrations-catalog/integrations/jamf.json
@@ -0,0 +1,58 @@
+{
+  "slug": "jamf",
+  "name": "Jamf Pro",
+  "description": "Monitor Jamf Pro device management including computer enrollment, MDM compliance, and disk encryption status",
+  "category": "Security",
+  "docsUrl": "https://developer.jamf.com/jamf-pro/docs",
+  "baseUrl": "https://placeholder.jamfcloud.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Jamf Pro as an administrator.\n2. Go to Settings > System > API Roles and Clients.\n3. Create an API Role with 'Read Computers', 'Read Mobile Devices', and 'Read Computer Inventory Collection' permissions.\n4. Create an API Client, assign the role, and copy the Client ID and Client Secret.\n5. Run this command to get your access token:\n   curl -X POST 'https://YOUR_DOMAIN/api/oauth/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET'\n6. Copy the access_token value from the response and paste it below.\nNote: Tokens expire — regenerate if you see authentication errors.",
+      "credentialFields": [
+        {
+          "label": "Jamf Pro URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Jamf Pro server URL, e.g. company.jamfcloud.com (without https://)"
+        },
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Bearer token obtained by exchanging your API client credentials. Run: curl -X POST 'https://YOUR_DOMAIN/api/oauth/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET'"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies that computers are enrolled in Jamf Pro MDM management",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Lists all mobile devices enrolled in Jamf Pro MDM",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Verifies that computers enrolled in Jamf Pro have FileVault/disk encryption enabled",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/jenkins.json b/integrations-catalog/integrations/jenkins.json
new file mode 100644
index 0000000000..d4127cbbe0
--- /dev/null
+++ b/integrations-catalog/integrations/jenkins.json
@@ -0,0 +1,45 @@
+{
+  "slug": "jenkins",
+  "name": "Jenkins",
+  "description": "CI/CD automation server. Monitor build pipelines and deployment compliance.",
+  "category": "Development",
+  "docsUrl": "https://www.jenkins.io/doc/book/using/remote-access-api/",
+  "baseUrl": "https://jenkins.example.com",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "setupInstructions": "1. Log in to your Jenkins server\n2. Click your username (top-right) → Configure\n3. Under API Token, click Add new Token → Generate\n4. Copy the token\n5. Enter your Jenkins URL below\n6. Use your Jenkins username and the API token as the password",
+      "credentialFields": [
+        {
+          "label": "Jenkins URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Jenkins server URL (e.g. https://jenkins.yourcompany.com). No trailing slash."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "jenkins_app_availability",
+      "name": "Jenkins App Availability",
+      "description": "Verifies Jenkins API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "jenkins_code_changes",
+      "name": "Jenkins CI/CD Pipeline",
+      "description": "Verifies CI/CD pipelines are configured in Jenkins.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/jfrog.json b/integrations-catalog/integrations/jfrog.json
new file mode 100644
index 0000000000..258c1462a4
--- /dev/null
+++ b/integrations-catalog/integrations/jfrog.json
@@ -0,0 +1,51 @@
+{
+  "slug": "jfrog",
+  "name": "JFrog Artifactory",
+  "description": "Monitor JFrog Artifactory artifact repository for secure package management and access compliance",
+  "category": "Development",
+  "docsUrl": "https://jfrog.com/help/r/jfrog-rest-apis/jfrog-platform-rest-apis",
+  "baseUrl": "https://yourdomain.jfrog.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your JFrog Platform at your instance URL\n2. Go to Administration → Identity and Access → Access Tokens\n3. Generate a new Access Token with Read scope\n4. Copy the token and your instance URL below",
+      "credentialFields": [
+        {
+          "label": "Artifactory URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your JFrog Artifactory URL (e.g. https://mycompany.jfrog.io)"
+        },
+        {
+          "label": "Access Token or API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate an Access Token in JFrog Platform → Administration → Identity and Access → Access Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "jfrog_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies JFrog Artifactory repositories are configured for secure artifact storage",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "jfrog_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews JFrog Artifactory users and their access permissions",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/jira.json b/integrations-catalog/integrations/jira.json
new file mode 100644
index 0000000000..8a5305d6ce
--- /dev/null
+++ b/integrations-catalog/integrations/jira.json
@@ -0,0 +1,45 @@
+{
+  "slug": "jira",
+  "name": "Jira",
+  "description": "Monitor Jira Cloud project access, user roles, and permission schemes for compliance",
+  "category": "Development",
+  "docsUrl": "https://developer.atlassian.com/cloud/jira/platform/rest/v3/",
+  "baseUrl": "https://api.atlassian.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to https://id.atlassian.com/manage-profile/security/api-tokens\n2. Create an API token\n3. Encode: echo -n your@email.com:YOUR_API_TOKEN | base64\n4. Enter the result and your subdomain below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode your credentials: run echo -n your@email.com:YOUR_API_TOKEN | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Access Review Log",
+      "description": "Reviews active Jira users and their access for compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "project_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that Jira projects have proper type and access configurations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/jotform.json b/integrations-catalog/integrations/jotform.json
new file mode 100644
index 0000000000..27ac790f2c
--- /dev/null
+++ b/integrations-catalog/integrations/jotform.json
@@ -0,0 +1,45 @@
+{
+  "slug": "jotform",
+  "name": "JotForm",
+  "description": "JotForm online form builder for data collection and workflow automation",
+  "category": "Productivity",
+  "docsUrl": "https://api.jotform.com/docs",
+  "baseUrl": "https://api.jotform.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to JotForm\n2. Go to Account Settings → API\n3. Create a new API key with appropriate permissions\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "JotForm → Account Settings → API → Create API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "jotform_app_availability",
+      "name": "App Availability",
+      "description": "Verifies JotForm platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "jotform_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies JotForm account access and user management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/jumpcloud.json b/integrations-catalog/integrations/jumpcloud.json
new file mode 100644
index 0000000000..a975d90206
--- /dev/null
+++ b/integrations-catalog/integrations/jumpcloud.json
@@ -0,0 +1,52 @@
+{
+  "slug": "jumpcloud",
+  "name": "JumpCloud",
+  "description": "Monitor JumpCloud users, MFA enrollment, and managed systems for identity and device compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://docs.jumpcloud.com/api/",
+  "baseUrl": "https://console.jumpcloud.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to JumpCloud Admin Console\n2. Click your user icon > API Settings\n3. Copy your API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in JumpCloud Admin Console > API Settings"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews JumpCloud users for employee access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mfa_enrollment",
+      "name": "2FA",
+      "description": "Verifies that JumpCloud users have TOTP MFA enrolled",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "systems",
+      "name": "Secure Devices",
+      "description": "Lists JumpCloud managed systems for device compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/juro.json b/integrations-catalog/integrations/juro.json
new file mode 100644
index 0000000000..449fa54e0a
--- /dev/null
+++ b/integrations-catalog/integrations/juro.json
@@ -0,0 +1,38 @@
+{
+  "slug": "juro",
+  "name": "Juro",
+  "description": "Juro contract management and automation platform",
+  "category": "Productivity",
+  "docsUrl": "https://developers.juro.com/",
+  "baseUrl": "https://app.juro.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Juro\n2. Go to Settings → Integrations → API\n3. Create an API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Juro → Settings → Integrations → API → Create API key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "juro_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Juro users to verify contract platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/justworks.json b/integrations-catalog/integrations/justworks.json
new file mode 100644
index 0000000000..a32cf3c6ff
--- /dev/null
+++ b/integrations-catalog/integrations/justworks.json
@@ -0,0 +1,43 @@
+{
+  "slug": "justworks",
+  "name": "Justworks",
+  "description": "Monitor employee access and organizational roles in Justworks PEO/HR platform",
+  "category": "HR & People",
+  "docsUrl": "https://public-api.justworks.com/v1/docs",
+  "baseUrl": "https://public-api.justworks.com",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "scopes": [
+        "member.detail:read",
+        "company.basic:read"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all members in Justworks and verifies active employee access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Reviews member types and organizational roles to verify role-based access controls in Justworks",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/kandji.json b/integrations-catalog/integrations/kandji.json
new file mode 100644
index 0000000000..f2b07cc530
--- /dev/null
+++ b/integrations-catalog/integrations/kandji.json
@@ -0,0 +1,35 @@
+{
+  "slug": "kandji",
+  "name": "Kandji",
+  "description": "Monitor Kandji MDM device compliance and management for endpoint security",
+  "category": "Security",
+  "docsUrl": "https://support.kandji.io/support/solutions/articles/72000560541",
+  "baseUrl": "https://yoursubdomain.api.kandji.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "kandji_secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies Kandji-managed devices are compliant and have agents installed",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "kandji_device_list",
+      "name": "Device List",
+      "description": "Lists all Kandji-managed devices for device inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/kaseya-vsa.json b/integrations-catalog/integrations/kaseya-vsa.json
new file mode 100644
index 0000000000..b3552d807d
--- /dev/null
+++ b/integrations-catalog/integrations/kaseya-vsa.json
@@ -0,0 +1,64 @@
+{
+  "slug": "kaseya-vsa",
+  "name": "Kaseya VSA",
+  "description": "Monitor Kaseya VSA managed agents and endpoint compliance for RMM",
+  "category": "Security",
+  "docsUrl": "https://help.vsa10.kaseya.com/help/Content/2-Administration/configuration/api.htm",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Kaseya VSA instance\n2. Go to Configuration > API Access > Third-Party Tokens\n3. Click Create Token\n4. Set appropriate permissions (read access to Assets and System)\n5. Optionally whitelist CompAI's IP: 54.159.77.69\n6. Copy the Token ID and Token Secret\n7. Enter your VSA URL, Token ID, and Token Secret above",
+      "credentialFields": [
+        {
+          "label": "VSA Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Kaseya VSA server URL (e.g., https://yourcompany.vsax.net)"
+        },
+        {
+          "label": "API Token ID",
+          "type": "text",
+          "required": true,
+          "helpText": "The Token ID from VSA > Configuration > API Access > Third-Party Tokens"
+        },
+        {
+          "label": "API Token Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "The Token Secret generated when creating the third-party token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Lists all managed agents enrolled in Kaseya VSA",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Checks agent online status and patch compliance across managed devices",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies monitoring policies and alert configurations in Kaseya VSA",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/keeper-security.json b/integrations-catalog/integrations/keeper-security.json
new file mode 100644
index 0000000000..5f71be9378
--- /dev/null
+++ b/integrations-catalog/integrations/keeper-security.json
@@ -0,0 +1,70 @@
+{
+  "slug": "keeper-security",
+  "name": "Keeper Security",
+  "description": "Monitor Keeper Security enterprise vault users, teams, and access controls via SCIM API",
+  "category": "Security",
+  "docsUrl": "https://docs.keeper.io/en/enterprise-guide/user-and-team-provisioning/automated-provisioning-with-scim/using-scim-api-provisioning",
+  "baseUrl": "https://keepersecurity.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "SCIM Provisioning Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate from Keeper Admin Console > Admin > Node > Provisioning > Add Method > SCIM"
+        },
+        {
+          "label": "SCIM Node ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Numeric Node ID shown on the SCIM setup page in Keeper Admin Console"
+        },
+        {
+          "label": "Data Center Region",
+          "type": "text",
+          "required": true,
+          "helpText": "US, EU, AU, JP, CA, or GOV (e.g. US for keepersecurity.com, EU for keepersecurity.eu)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews Keeper vault users provisioned via SCIM and verifies their active or locked status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mfa_enforcement",
+      "name": "2FA",
+      "description": "Verifies that Keeper enterprise SCIM provisioning is active, confirming centralized identity governance required for 2FA policy enforcement",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that Keeper teams and roles are configured with assigned members for organized vault access control",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies that Keeper vault users are assigned to teams for controlled, team-based access to shared secrets and folders",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/keka.json b/integrations-catalog/integrations/keka.json
new file mode 100644
index 0000000000..7bfd377aa5
--- /dev/null
+++ b/integrations-catalog/integrations/keka.json
@@ -0,0 +1,78 @@
+{
+  "slug": "keka",
+  "name": "Keka",
+  "description": "Keka is a modern HR and payroll platform for employee lifecycle management, including hiring, onboarding, attendance, performance, and offboarding.",
+  "category": "HR & People",
+  "docsUrl": "https://developers.keka.com",
+  "baseUrl": "https://api.keka.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Keka as an admin\n2. Go to Settings > API > Generate API Key\n3. Copy the Client ID, Client Secret, and API Key\n4. Your subdomain is the part before .keka.com in your URL (e.g. for https://acme.keka.com, enter 'acme')\n5. Enter all credentials below",
+      "credentialFields": [
+        {
+          "label": "Company Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Keka company subdomain. For example, if you access Keka at https://acme.keka.com, enter 'acme'."
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "The Client ID from your Keka API application. Go to Settings > API > Generate API Key."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "The Client Secret from your Keka API application."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "The API Key from your Keka API application."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "keka_employee_directory",
+      "name": "Keka Employee Directory",
+      "description": "Verifies that employee records can be accessed through the Keka API and that active employees exist in the system.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "keka_departments",
+      "name": "Keka Organizational Structure",
+      "description": "Verifies that departments are defined in Keka, confirming organizational structure is properly configured for compliance reporting.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "keka_offboarding",
+      "name": "Keka Employee Offboarding Process",
+      "description": "Verifies that exit reasons are configured in Keka, ensuring a proper employee offboarding process is in place for compliance.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "keka_groups",
+      "name": "Keka Role-based Access Controls",
+      "description": "Verifies that groups and group types are configured in Keka, confirming role-based access controls are in place for organizational management.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/kenjo.json b/integrations-catalog/integrations/kenjo.json
new file mode 100644
index 0000000000..d69ca0a399
--- /dev/null
+++ b/integrations-catalog/integrations/kenjo.json
@@ -0,0 +1,36 @@
+{
+  "slug": "kenjo",
+  "name": "Kenjo",
+  "description": "HR software for SMBs. Monitor employee records and people operations.",
+  "category": "HR & People",
+  "docsUrl": "https://kenjo.readme.io/reference",
+  "baseUrl": "https://api.kenjo.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "kenjo_app_availability",
+      "name": "Kenjo App Availability",
+      "description": "Verifies Kenjo API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "kenjo_employee_access",
+      "name": "Kenjo Employee Access",
+      "description": "Verifies employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/keycdn.json b/integrations-catalog/integrations/keycdn.json
new file mode 100644
index 0000000000..236a5e298a
--- /dev/null
+++ b/integrations-catalog/integrations/keycdn.json
@@ -0,0 +1,45 @@
+{
+  "slug": "keycdn",
+  "name": "KeyCDN",
+  "description": "KeyCDN content delivery network for fast and secure asset distribution",
+  "category": "Infrastructure",
+  "docsUrl": "https://www.keycdn.com/api",
+  "baseUrl": "https://api.keycdn.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to KeyCDN\n2. Go to Account → API\n3. Copy your API Key\n4. Paste it below\n\nNote: The API key is used with HTTP Basic Auth (pass 'api_key_here' as both username and empty password)",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "KeyCDN → Account → API → API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "keycdn_app_availability",
+      "name": "App Availability",
+      "description": "Verifies KeyCDN platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "keycdn_employee_access",
+      "name": "Employee Access",
+      "description": "Lists KeyCDN zones to verify CDN access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/klaviyo.json b/integrations-catalog/integrations/klaviyo.json
new file mode 100644
index 0000000000..ae3b97e984
--- /dev/null
+++ b/integrations-catalog/integrations/klaviyo.json
@@ -0,0 +1,35 @@
+{
+  "slug": "klaviyo",
+  "name": "Klaviyo",
+  "description": "Monitor Klaviyo lists and profile data handling for marketing data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.klaviyo.com/en/reference/api_overview",
+  "baseUrl": "https://a.klaviyo.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "klaviyo_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Klaviyo lists are configured for subscriber management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "klaviyo_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Klaviyo profile data is properly managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/knock.json b/integrations-catalog/integrations/knock.json
new file mode 100644
index 0000000000..38d91ef29b
--- /dev/null
+++ b/integrations-catalog/integrations/knock.json
@@ -0,0 +1,45 @@
+{
+  "slug": "knock",
+  "name": "Knock",
+  "description": "Monitor Knock notification infrastructure for workflow access and data handling compliance",
+  "category": "Communication",
+  "docsUrl": "https://docs.knock.app/reference",
+  "baseUrl": "https://api.knock.app/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Knock at https://dashboard.knock.app\n2. Go to Settings → API Keys\n3. Copy your Secret API Key (sk_...)\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Secret API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Knock Settings → API Keys. Use the Secret Key (sk_...)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "knock_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Knock notification platform users and their access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "knock_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Knock notification infrastructure is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/knowbe4.json b/integrations-catalog/integrations/knowbe4.json
new file mode 100644
index 0000000000..d897ad78bf
--- /dev/null
+++ b/integrations-catalog/integrations/knowbe4.json
@@ -0,0 +1,51 @@
+{
+  "slug": "knowbe4",
+  "name": "KnowBe4",
+  "description": "Monitor KnowBe4 security awareness training campaigns and phishing simulation results for compliance.",
+  "category": "Security",
+  "docsUrl": "https://developer.knowbe4.com/rest/reporting",
+  "baseUrl": "https://us.api.knowbe4.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to KnowBe4 KSAT at https://training.knowbe4.com\n2. Go to Account Settings → API\n3. Click 'Generate New API Key' (Reporting API)\n4. Copy the key\n5. Determine your region from your KnowBe4 URL:\n   - US: us\n   - EU: eu\n   - Canada: ca\n   - UK: uk\n   - Germany: de\n6. Enter both values below\n\nNote: The Reporting API requires a Platinum or Diamond subscription. The User Event API key will NOT work.",
+      "credentialFields": [
+        {
+          "label": "Reporting API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in KnowBe4 KSAT console → Account Settings → API → Generate New API Key. Requires Platinum or Diamond subscription."
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Your KnowBe4 region prefix: 'us' for United States, 'eu' for Europe, 'ca' for Canada, 'uk' for United Kingdom, 'de' for Germany. Found in your KnowBe4 login URL."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "knowbe4_app_availability",
+      "name": "KnowBe4 App Availability",
+      "description": "Verifies that the KnowBe4 Reporting API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "knowbe4_employee_access",
+      "name": "KnowBe4 Employee Access",
+      "description": "Verifies employee access to KnowBe4 by checking account info and user count.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/kolide.json b/integrations-catalog/integrations/kolide.json
new file mode 100644
index 0000000000..4f7c84f9ce
--- /dev/null
+++ b/integrations-catalog/integrations/kolide.json
@@ -0,0 +1,45 @@
+{
+  "slug": "kolide",
+  "name": "Kolide",
+  "description": "Kolide device security and compliance for remote teams",
+  "category": "Security",
+  "docsUrl": "https://www.kolide.com/docs/developers/api",
+  "baseUrl": "https://k2.kolide.com/api/v0",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Kolide\n2. Settings → API\n3. Create a new API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Kolide → Settings → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "kolide_secure_devices",
+      "name": "Secure Devices",
+      "description": "Reviews Kolide device compliance status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "kolide_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Kolide users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/kombo.json b/integrations-catalog/integrations/kombo.json
new file mode 100644
index 0000000000..fb667a1f79
--- /dev/null
+++ b/integrations-catalog/integrations/kombo.json
@@ -0,0 +1,45 @@
+{
+  "slug": "kombo",
+  "name": "Kombo",
+  "description": "Kombo unified HRIS and ATS API for seamless HR integrations in Europe",
+  "category": "HR & People",
+  "docsUrl": "https://docs.kombo.dev",
+  "baseUrl": "https://api.kombo.dev",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Kombo\n2. Go to Settings → API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Kombo → Settings → API Keys → Create API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "kombo_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Kombo HR integration platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "kombo_employee_access",
+      "name": "Employee Access",
+      "description": "Lists employees via Kombo HRIS API to verify HR data access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/kong.json b/integrations-catalog/integrations/kong.json
new file mode 100644
index 0000000000..6eca9cdf96
--- /dev/null
+++ b/integrations-catalog/integrations/kong.json
@@ -0,0 +1,45 @@
+{
+  "slug": "kong",
+  "name": "Kong Konnect",
+  "description": "Monitor Kong API gateway for team access and role-based API management compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://docs.konghq.com/konnect/api/",
+  "baseUrl": "https://global.api.konghq.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Kong Konnect at https://cloud.konghq.com\n2. Go to Personal Access Tokens\n3. Generate a new token\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Kong Konnect → Personal Access Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "kong_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Kong Konnect organization members and their roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "kong_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies Kong Konnect API gateway has role-based access configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/koyeb.json b/integrations-catalog/integrations/koyeb.json
new file mode 100644
index 0000000000..9f31bddf87
--- /dev/null
+++ b/integrations-catalog/integrations/koyeb.json
@@ -0,0 +1,35 @@
+{
+  "slug": "koyeb",
+  "name": "Koyeb",
+  "description": "Serverless cloud platform for deploying apps globally. Monitor infrastructure.",
+  "category": "Infrastructure",
+  "docsUrl": "https://www.koyeb.com/docs/api",
+  "baseUrl": "https://app.koyeb.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "koyeb_app_availability",
+      "name": "Koyeb App Availability",
+      "description": "Checks that the Koyeb API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "koyeb_employee_access",
+      "name": "Koyeb Employee Access",
+      "description": "Verifies employee access to Koyeb via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/kustomer.json b/integrations-catalog/integrations/kustomer.json
new file mode 100644
index 0000000000..f840fe138c
--- /dev/null
+++ b/integrations-catalog/integrations/kustomer.json
@@ -0,0 +1,38 @@
+{
+  "slug": "kustomer",
+  "name": "Kustomer",
+  "description": "Kustomer CRM platform for customer service teams",
+  "category": "Communication",
+  "docsUrl": "https://developer.kustomer.com/",
+  "baseUrl": "https://api.kustomerapp.com/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Kustomer\n2. Settings → API Keys\n3. Create a key with read permissions\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Kustomer → Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "kustomer_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Kustomer users to verify support agent access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lacework.json b/integrations-catalog/integrations/lacework.json
new file mode 100644
index 0000000000..389cbfa83e
--- /dev/null
+++ b/integrations-catalog/integrations/lacework.json
@@ -0,0 +1,51 @@
+{
+  "slug": "lacework",
+  "name": "Lacework",
+  "description": "Monitor Lacework cloud security platform for threat detection and compliance posture",
+  "category": "Security",
+  "docsUrl": "https://docs.lacework.net/api/v2/docs/",
+  "baseUrl": "https://api.lacework.net/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Lacework at https://YOUR_ACCOUNT.lacework.net\n2. Go to Settings → API Keys → Create New API Key\n3. Download the JSON with keyId and secret\n4. Generate an access token: POST /api/v2/access/tokens with keyId and secret\n5. Enter your account name and access token below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Access Token generated via Lacework API. Use your keyId and secret to get a token from POST /api/v2/access/tokens"
+        },
+        {
+          "label": "Account Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Lacework account subdomain (e.g. mycompany from mycompany.lacework.net)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lacework_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Lacework is actively monitoring cloud environments for threats",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "lacework_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Lacework users with access to cloud security data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lago.json b/integrations-catalog/integrations/lago.json
new file mode 100644
index 0000000000..e9798c8f78
--- /dev/null
+++ b/integrations-catalog/integrations/lago.json
@@ -0,0 +1,45 @@
+{
+  "slug": "lago",
+  "name": "Lago",
+  "description": "Monitor Lago open source billing platform for access and subscription data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://doc.getlago.com/api-reference/intro",
+  "baseUrl": "https://api.getlago.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Lago at https://app.getlago.com\n2. Go to Settings → API Keys\n3. Copy your API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Lago Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lago_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Lago billing platform access and subscription data exposure",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "lago_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Lago billing platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lambdatest.json b/integrations-catalog/integrations/lambdatest.json
new file mode 100644
index 0000000000..1fc35e4cf9
--- /dev/null
+++ b/integrations-catalog/integrations/lambdatest.json
@@ -0,0 +1,45 @@
+{
+  "slug": "lambdatest",
+  "name": "LambdaTest",
+  "description": "Monitor LambdaTest automated testing platform for cross-browser test coverage compliance",
+  "category": "Development",
+  "docsUrl": "https://www.lambdatest.com/support/api-doc/",
+  "baseUrl": "https://api.lambdatest.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to LambdaTest at https://accounts.lambdatest.com\n2. Go to Profile → Access Key\n3. Note your Username and Access Key\n4. Base64 encode 'username:access_key'\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'username:access_key'. Found in LambdaTest → Profile → Access Key. Command: echo -n 'username:access_key' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lambdatest_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies LambdaTest automated testing is configured for cross-browser validation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "lambdatest_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies LambdaTest builds are running to validate code quality across browsers",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lastpass.json b/integrations-catalog/integrations/lastpass.json
new file mode 100644
index 0000000000..a0b0db51c5
--- /dev/null
+++ b/integrations-catalog/integrations/lastpass.json
@@ -0,0 +1,58 @@
+{
+  "slug": "lastpass",
+  "name": "LastPass Business",
+  "description": "Monitor LastPass Business user access, MFA enrollment, and role-based access controls",
+  "category": "Security",
+  "docsUrl": "https://support.lastpass.com/help/use-the-lastpass-provisioning-api-lp010068",
+  "baseUrl": "https://lastpass.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to the LastPass Admin Console at admin.lastpass.com\n2. Find your Account Number (CID) at the top of the Dashboard page\n3. Go to Advanced > Enterprise API\n4. Click 'Create provisioning hash' (or 'Reset your provisioning hash' if one already exists)\n5. Copy the CID and Provisioning Hash into the fields below",
+      "credentialFields": [
+        {
+          "label": "Company ID (CID)",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in the LastPass Admin Console Dashboard, labeled 'Account number' at the top of the page"
+        },
+        {
+          "label": "Provisioning Hash",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate in LastPass Admin Console: Advanced > Enterprise API > Create provisioning hash"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews all LastPass Business users, their login status, and account activity",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mfa_enrollment",
+      "name": "2FA",
+      "description": "Verifies that all active LastPass Business users have multi-factor authentication enabled",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "rbac",
+      "name": "Role-based Access Controls",
+      "description": "Reviews LastPass Business user groups and admin roles to verify role-based access controls are in place",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lattice.json b/integrations-catalog/integrations/lattice.json
new file mode 100644
index 0000000000..3295d830a0
--- /dev/null
+++ b/integrations-catalog/integrations/lattice.json
@@ -0,0 +1,35 @@
+{
+  "slug": "lattice",
+  "name": "Lattice",
+  "description": "Monitor Lattice users and team structure for HR and people management compliance",
+  "category": "HR & People",
+  "docsUrl": "https://developers.latticehq.com/",
+  "baseUrl": "https://api.latticehq.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lattice_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Lattice users and verifies active employee access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "lattice_employee_descriptions",
+      "name": "Employee Descriptions",
+      "description": "Verifies Lattice employees have job titles and departments defined",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/launchdarkly.json b/integrations-catalog/integrations/launchdarkly.json
new file mode 100644
index 0000000000..e220818a5b
--- /dev/null
+++ b/integrations-catalog/integrations/launchdarkly.json
@@ -0,0 +1,35 @@
+{
+  "slug": "launchdarkly",
+  "name": "LaunchDarkly",
+  "description": "Monitor LaunchDarkly feature flags and team access for release management compliance",
+  "category": "Development",
+  "docsUrl": "https://apidocs.launchdarkly.com/",
+  "baseUrl": "https://app.launchdarkly.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ld_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews LaunchDarkly team members with flag management access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ld_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies LaunchDarkly has multiple environments configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lever.json b/integrations-catalog/integrations/lever.json
new file mode 100644
index 0000000000..12956875e9
--- /dev/null
+++ b/integrations-catalog/integrations/lever.json
@@ -0,0 +1,38 @@
+{
+  "slug": "lever",
+  "name": "Lever",
+  "description": "Lever applicant tracking system for talent acquisition",
+  "category": "HR & People",
+  "docsUrl": "https://hire.lever.co/developer/",
+  "baseUrl": "https://api.lever.co/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Lever\n2. Go to Settings → Integrations → API credentials\n3. Generate an API key\n4. Run: echo -n 'YOUR_API_KEY:' | base64\n5. Paste the output below",
+      "credentialFields": [
+        {
+          "label": "Basic Auth Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64-encode your API key with a colon: echo -n 'your_api_key:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lever_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Lever users to verify ATS access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/linear.json b/integrations-catalog/integrations/linear.json
new file mode 100644
index 0000000000..2e47594e85
--- /dev/null
+++ b/integrations-catalog/integrations/linear.json
@@ -0,0 +1,45 @@
+{
+  "slug": "linear",
+  "name": "Linear",
+  "description": "Linear project and issue tracking for software teams",
+  "category": "Development",
+  "docsUrl": "https://developers.linear.app/docs",
+  "baseUrl": "https://api.linear.app",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Linear\n2. Go to Settings → API\n3. Create a Personal API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Linear → Settings → API → Personal API keys → Create key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "linear_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Linear is connected and lists workspace members",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "linear_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Linear platform is operational",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/linode.json b/integrations-catalog/integrations/linode.json
new file mode 100644
index 0000000000..11265f69c5
--- /dev/null
+++ b/integrations-catalog/integrations/linode.json
@@ -0,0 +1,35 @@
+{
+  "slug": "linode",
+  "name": "Linode",
+  "description": "Monitor Linode cloud instances and user access for infrastructure compliance",
+  "category": "Cloud",
+  "docsUrl": "https://www.linode.com/docs/api/",
+  "baseUrl": "https://api.linode.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "linode_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Linode cloud instances for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "linode_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Linode account users and their access permissions",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/litmos.json b/integrations-catalog/integrations/litmos.json
new file mode 100644
index 0000000000..29daf5056f
--- /dev/null
+++ b/integrations-catalog/integrations/litmos.json
@@ -0,0 +1,58 @@
+{
+  "slug": "litmos",
+  "name": "Litmos",
+  "description": "Monitor SAP Litmos LMS for user access, team-based role controls, and security training compliance",
+  "category": "Productivity",
+  "docsUrl": "https://support.litmos.com/hc/en-us/articles/227734667-Overview-Developer-API",
+  "baseUrl": "https://api.litmos.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Litmos admin account\n2. Go to Account Settings > Manage API Key\n3. Generate or copy your API key\n4. Enter your API key, source name (your Litmos domain), and select the correct regional base URL",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Litmos Admin > Account Settings > Manage API Key. Generate or copy your API key."
+        },
+        {
+          "label": "Source (App Name)",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Litmos company domain or app name, e.g. 'yourcompany.litmos.com'. Used as the 'source' query parameter."
+        },
+        {
+          "label": "API Base URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Litmos API base URL. US: https://api.litmos.com, AU: https://api.litmos.com.au, EU: https://api.litmoseu.com"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "litmos_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Litmos LMS users to verify active accounts and employee access to the learning management platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "litmos_role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Reviews Litmos teams to verify team-based role structure and organizational access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/liveblocks.json b/integrations-catalog/integrations/liveblocks.json
new file mode 100644
index 0000000000..54282d6457
--- /dev/null
+++ b/integrations-catalog/integrations/liveblocks.json
@@ -0,0 +1,45 @@
+{
+  "slug": "liveblocks",
+  "name": "Liveblocks",
+  "description": "Monitor Liveblocks real-time collaboration infrastructure for room access and security compliance",
+  "category": "Development",
+  "docsUrl": "https://liveblocks.io/docs/api-reference/rest-api-endpoints",
+  "baseUrl": "https://api.liveblocks.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Liveblocks at https://liveblocks.io/dashboard\n2. Go to API Keys\n3. Copy your Secret Key (starts with sk_)\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Liveblocks Dashboard → API Keys (Secret Key)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "liveblocks_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Liveblocks rooms to audit active collaboration sessions",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "liveblocks_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Verifies Liveblocks real-time collaboration infrastructure is active",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lob.json b/integrations-catalog/integrations/lob.json
new file mode 100644
index 0000000000..4be1299195
--- /dev/null
+++ b/integrations-catalog/integrations/lob.json
@@ -0,0 +1,45 @@
+{
+  "slug": "lob",
+  "name": "Lob",
+  "description": "Monitor Lob direct mail platform for address verification and postal compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.lob.com/",
+  "baseUrl": "https://api.lob.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Lob at https://dashboard.lob.com\n2. Go to Settings → API Keys\n3. Copy your Live API key\n4. Base64 encode 'live_api_key:' (with trailing colon, no password)\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'live_api_key:' (with trailing colon). Found in Lob Dashboard → Settings → API Keys. Command: echo -n 'live_xxxx:' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lob_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Lob API key access is active for direct mail operations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "lob_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Lob platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/logdna.json b/integrations-catalog/integrations/logdna.json
new file mode 100644
index 0000000000..59d2df355d
--- /dev/null
+++ b/integrations-catalog/integrations/logdna.json
@@ -0,0 +1,35 @@
+{
+  "slug": "logdna",
+  "name": "Mezmo (LogDNA)",
+  "description": "Log management and observability platform.",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.mezmo.com/reference",
+  "baseUrl": "https://api.mezmo.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "logdna_app_availability",
+      "name": "Mezmo (LogDNA) App Availability",
+      "description": "Checks Mezmo (LogDNA) app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "logdna_employee_access",
+      "name": "Mezmo (LogDNA) Employee Access",
+      "description": "Checks Mezmo (LogDNA) employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/logrocket.json b/integrations-catalog/integrations/logrocket.json
new file mode 100644
index 0000000000..59e2538b1c
--- /dev/null
+++ b/integrations-catalog/integrations/logrocket.json
@@ -0,0 +1,45 @@
+{
+  "slug": "logrocket",
+  "name": "LogRocket",
+  "description": "Monitor LogRocket session replay platform for access and data privacy compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.logrocket.com/reference/api-overview",
+  "baseUrl": "https://api.logrocket.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to LogRocket at https://app.logrocket.com\n2. Go to Settings → API Tokens\n3. Generate a new token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in LogRocket Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "logrocket_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews LogRocket organization members with access to session recordings",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "logrocket_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies LogRocket is capturing sessions and monitoring application performance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/logscale.json b/integrations-catalog/integrations/logscale.json
new file mode 100644
index 0000000000..40c4c7c526
--- /dev/null
+++ b/integrations-catalog/integrations/logscale.json
@@ -0,0 +1,51 @@
+{
+  "slug": "logscale",
+  "name": "CrowdStrike LogScale",
+  "description": "Log management and observability platform (formerly Humio). Monitor data repositories and log ingestion.",
+  "category": "Monitoring",
+  "docsUrl": "https://library.humio.com/falcon-logscale/api.html",
+  "baseUrl": "https://cloud.community.humio.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to LogScale (Humio)\n2. Go to Settings → API Tokens\n3. Create a new token with read permissions\n4. Enter your LogScale URL and the token below",
+      "credentialFields": [
+        {
+          "label": "LogScale URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your LogScale instance URL (e.g. https://cloud.community.humio.com or your self-hosted URL). No trailing slash."
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in LogScale → Settings → API Tokens."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "logscale_app_availability",
+      "name": "LogScale App Availability",
+      "description": "Verifies CrowdStrike LogScale API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "logscale_monitoring",
+      "name": "LogScale Monitoring",
+      "description": "Verifies log repositories are configured for monitoring.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/logzio.json b/integrations-catalog/integrations/logzio.json
new file mode 100644
index 0000000000..01e9f34f5a
--- /dev/null
+++ b/integrations-catalog/integrations/logzio.json
@@ -0,0 +1,51 @@
+{
+  "slug": "logzio",
+  "name": "Logz.io",
+  "description": "Monitor Logz.io log management and SIEM for observability and security compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.logz.io/api/",
+  "baseUrl": "https://api.logz.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Logz.io\n2. Go to Settings → Manage tokens → API tokens\n3. Create a new API token\n4. Select your region and enter the token below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Logz.io Settings → Manage tokens → API tokens"
+        },
+        {
+          "label": "Region Base URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Logz.io API base URL: api.logz.io (US), api-eu.logz.io (EU), api-nl.logz.io (EU2), api-ca.logz.io (CA)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "logzio_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Logz.io alerts are configured for log-based monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "logzio_utility_monitoring",
+      "name": "Utility Monitoring",
+      "description": "Verifies Logz.io is actively receiving log data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/loops.json b/integrations-catalog/integrations/loops.json
new file mode 100644
index 0000000000..560090a884
--- /dev/null
+++ b/integrations-catalog/integrations/loops.json
@@ -0,0 +1,45 @@
+{
+  "slug": "loops",
+  "name": "Loops",
+  "description": "Monitor Loops email platform for team access and transactional email compliance",
+  "category": "Communication",
+  "docsUrl": "https://loops.so/docs/api",
+  "baseUrl": "https://app.loops.so/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Loops at https://app.loops.so\n2. Go to Settings → API\n3. Generate an API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Loops Settings → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "loops_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Loops account is active and accessible for email compliance",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "loops_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Loops platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lucid.json b/integrations-catalog/integrations/lucid.json
new file mode 100644
index 0000000000..5538d91847
--- /dev/null
+++ b/integrations-catalog/integrations/lucid.json
@@ -0,0 +1,35 @@
+{
+  "slug": "lucid",
+  "name": "Lucid",
+  "description": "Visual collaboration platform for diagrams and whiteboards.",
+  "category": "Productivity",
+  "docsUrl": "https://developer.lucid.co/",
+  "baseUrl": "https://api.lucid.co",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lucid_app_availability",
+      "name": "Lucid App Availability",
+      "description": "Checks Lucid app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "lucid_employee_access",
+      "name": "Lucid Employee Access",
+      "description": "Checks Lucid employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lucidchart.json b/integrations-catalog/integrations/lucidchart.json
new file mode 100644
index 0000000000..65f95990f4
--- /dev/null
+++ b/integrations-catalog/integrations/lucidchart.json
@@ -0,0 +1,45 @@
+{
+  "slug": "lucidchart",
+  "name": "Lucidchart",
+  "description": "Lucidchart visual collaboration platform for diagrams and flowcharts",
+  "category": "Productivity",
+  "docsUrl": "https://developer.lucid.co",
+  "baseUrl": "https://api.lucid.app",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Lucid\n2. Go to developer.lucid.co\n3. Create an API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Lucid Developer Portal → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lucidchart_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Lucidchart platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "lucidchart_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Lucidchart user identity and access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/lumigo.json b/integrations-catalog/integrations/lumigo.json
new file mode 100644
index 0000000000..9025b62cf9
--- /dev/null
+++ b/integrations-catalog/integrations/lumigo.json
@@ -0,0 +1,38 @@
+{
+  "slug": "lumigo",
+  "name": "Lumigo",
+  "description": "Lumigo serverless and microservices monitoring platform",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.lumigo.io/",
+  "baseUrl": "https://api.lumigo.io/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Lumigo\n2. Go to Settings → Token\n3. Copy your API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Lumigo → Settings → Token → Copy your token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "lumigo_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Lumigo serverless monitoring is active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mabl.json b/integrations-catalog/integrations/mabl.json
new file mode 100644
index 0000000000..bf7c6fe58a
--- /dev/null
+++ b/integrations-catalog/integrations/mabl.json
@@ -0,0 +1,45 @@
+{
+  "slug": "mabl",
+  "name": "Mabl",
+  "description": "Monitor Mabl AI-powered testing for automated test coverage and code quality compliance",
+  "category": "Development",
+  "docsUrl": "https://help.mabl.com/hc/en-us/articles/360017810591-Using-the-Mabl-REST-API",
+  "baseUrl": "https://api.mabl.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Mabl at https://app.mabl.com\n2. Go to Settings → API → API Keys\n3. Generate an API key\n4. Base64 encode 'key:your_api_key' (where 'key' is the literal username)\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'key:your_api_key' (literally 'key' as username). Command: echo -n 'key:your_api_key' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mabl_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Mabl automated tests are running to validate code changes",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mabl_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies Mabl test plans are configured for continuous quality assurance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mailchimp.json b/integrations-catalog/integrations/mailchimp.json
new file mode 100644
index 0000000000..e2e3bdfd29
--- /dev/null
+++ b/integrations-catalog/integrations/mailchimp.json
@@ -0,0 +1,45 @@
+{
+  "slug": "mailchimp",
+  "name": "Mailchimp",
+  "description": "Monitor Mailchimp subscriber lists and data handling for email marketing compliance",
+  "category": "Productivity",
+  "docsUrl": "https://mailchimp.com/developer/marketing/api/",
+  "baseUrl": "https://us1.api.mailchimp.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Mailchimp > Profile > Extras > API keys\n2. Create a new API key\n3. Note your data center suffix from the key (e.g. 'us1' in 'xxx-us1')\n4. Encode: base64('anystring:your_api_key')\n5. Enter encoded value + data center below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'anystring:your_api_key'. Example: base64('user:abc123def456-us1'). Use https://www.base64encode.org/"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mailchimp_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Mailchimp subscriber lists are maintained",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mailchimp_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Mailchimp GDPR data management tools are configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/make.json b/integrations-catalog/integrations/make.json
new file mode 100644
index 0000000000..2d1d5f92e2
--- /dev/null
+++ b/integrations-catalog/integrations/make.json
@@ -0,0 +1,51 @@
+{
+  "slug": "make",
+  "name": "Make",
+  "description": "Monitor Make (formerly Integromat) automation workflows for access and environment separation compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.make.com/en/api-documentation",
+  "baseUrl": "https://eu1.make.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Make at https://make.com\n2. Go to Profile → API\n3. Generate an API key\n4. Find your region in the URL (e.g. eu1.make.com)\n5. Enter both below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Make → Profile → API → API key"
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Make region: eu1 (Europe), us1 (United States), or ap1 (Asia Pacific)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "make_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Make organization members and their automation access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "make_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Make teams are configured for access separation across environments",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/malwarebytes.json b/integrations-catalog/integrations/malwarebytes.json
new file mode 100644
index 0000000000..1c3f60ce59
--- /dev/null
+++ b/integrations-catalog/integrations/malwarebytes.json
@@ -0,0 +1,63 @@
+{
+  "slug": "malwarebytes",
+  "name": "Malwarebytes",
+  "description": "Monitor Malwarebytes ThreatDown endpoint security for device protection, threat detection, and compliance",
+  "category": "Security",
+  "docsUrl": "https://cloud.malwarebytes.com/api/v2/oneview/docs",
+  "baseUrl": "https://cloud.malwarebytes.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Malwarebytes OneView > Settings > API Access"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Malwarebytes OneView > Settings > API Access"
+        },
+        {
+          "label": "Account ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Malwarebytes OneView account ID"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "List managed endpoints from Malwarebytes",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Check endpoint protection status",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Check threat detections and alerts",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/manageengine-endpoint-central.json b/integrations-catalog/integrations/manageengine-endpoint-central.json
new file mode 100644
index 0000000000..5e058e670b
--- /dev/null
+++ b/integrations-catalog/integrations/manageengine-endpoint-central.json
@@ -0,0 +1,58 @@
+{
+  "slug": "manageengine-endpoint-central",
+  "name": "ManageEngine Endpoint Central",
+  "description": "Monitor device compliance, patch management status, and managed endpoint inventory in ManageEngine Endpoint Central Cloud (UEM)",
+  "category": "Security",
+  "docsUrl": "https://www.manageengine.com/products/desktop-central/api/cloud_index.html",
+  "baseUrl": "https://endpointcentral.manageengine.com",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "scopes": [
+        "DesktopCentralCloud.Common.READ",
+        "DesktopCentralCloud.SOM.READ",
+        "DesktopCentralCloud.Inventory.READ",
+        "DesktopCentralCloud.PatchMgmt.READ"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_health",
+      "name": "Secure Devices",
+      "description": "Checks health and patch compliance status of all devices managed by Endpoint Central. Devices are rated Healthy, Vulnerable, or Highly Vulnerable based on missing patches.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "managed_devices",
+      "name": "Device List",
+      "description": "Lists all devices under Endpoint Central management (Scope of Management) with agent installation status, OS info, and network details.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "patch_status",
+      "name": "Monitoring & Alerting",
+      "description": "Monitors missing patches across managed devices, highlighting critical and important severity patches that need deployment.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_users",
+      "name": "Employee Access",
+      "description": "Lists users with active sessions on managed devices, providing evidence of who has access to endpoints managed by Endpoint Central.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/manageengine-log360-cloud.json b/integrations-catalog/integrations/manageengine-log360-cloud.json
new file mode 100644
index 0000000000..0fcdc33e2e
--- /dev/null
+++ b/integrations-catalog/integrations/manageengine-log360-cloud.json
@@ -0,0 +1,52 @@
+{
+  "slug": "manageengine-log360-cloud",
+  "name": "ManageEngine Log360 Cloud",
+  "description": "ManageEngine Log360 Cloud SIEM for centralized log management, threat detection, and compliance monitoring",
+  "category": "Security",
+  "docsUrl": "https://www.manageengine.com/cloud-siem/api/v2/introduction/",
+  "baseUrl": "https://log360cloud.manageengine.com",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Log in to your Log360 Cloud instance\n2. Connect your Zoho account when prompted\n3. Grant read access to accounts, log sources, search, and log fields\n\nNote: If your Log360 Cloud instance is on a non-.com domain (e.g. .eu, .in, .com.au), let us know so we can configure the correct regional endpoint.",
+      "scopes": [
+        "logs360cloud.accounts.READ",
+        "logs360cloud.logsources.READ",
+        "logs360cloud.search.READ",
+        "logs360cloud.logfields.READ"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "log360_cloud_siem_availability",
+      "name": "SIEM Availability",
+      "description": "Verifies Log360 Cloud SIEM is accessible and the connection is valid",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "log360_cloud_log_sources",
+      "name": "Log Source Monitoring",
+      "description": "Verifies that log sources are configured and actively collecting logs in Log360 Cloud",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "log360_cloud_log_source_groups",
+      "name": "Log Source Organization",
+      "description": "Verifies that log sources are organized into groups for structured monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mattermost.json b/integrations-catalog/integrations/mattermost.json
new file mode 100644
index 0000000000..5baaa845c1
--- /dev/null
+++ b/integrations-catalog/integrations/mattermost.json
@@ -0,0 +1,35 @@
+{
+  "slug": "mattermost",
+  "name": "Mattermost",
+  "description": "Monitor Mattermost self-hosted messaging platform for user access and team configuration",
+  "category": "Communication",
+  "docsUrl": "https://api.mattermost.com/",
+  "baseUrl": "https://yourmattermost.example.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mattermost_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Mattermost users and verifies active accounts",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mattermost_access_review",
+      "name": "Access Review Log",
+      "description": "Audits Mattermost teams and their membership for access review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mend-io.json b/integrations-catalog/integrations/mend-io.json
new file mode 100644
index 0000000000..b73cf3bb60
--- /dev/null
+++ b/integrations-catalog/integrations/mend-io.json
@@ -0,0 +1,76 @@
+{
+  "slug": "mend-io",
+  "name": "Mend.io",
+  "description": "Monitor software composition analysis, vulnerability scanning, and security policy enforcement across your organization's projects with Mend.io (formerly WhiteSource)",
+  "category": "Security",
+  "docsUrl": "https://docs.mend.io/platform/latest/getting-started-with-mend-api-3-0",
+  "baseUrl": "https://api-saas.mend.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Base URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Mend API base URL. Find it in Mend App → Integrate → Organization → API Base URL. Examples: https://api-saas.mend.io, https://api-app.mend.io, https://api-saas-eu.mend.io"
+        },
+        {
+          "label": "Email",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Mend account email (Mend Platform → My Profile → General)"
+        },
+        {
+          "label": "User Key",
+          "type": "secret",
+          "required": true,
+          "helpText": "Your Mend user key (Mend Platform → My Profile → User Keys). For production use, create a Service User in Administration → Users."
+        },
+        {
+          "label": "Organization UUID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your organization UUID (Mend Platform → Administration → General Configuration → Organization UUID)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews all users in the Mend.io organization and their account status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "vulnerability_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that vulnerability scanning and monitoring is active across projects in the Mend.io organization",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all projects and applications in the Mend.io organization as infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_code",
+      "name": "Secure Code",
+      "description": "Verifies that security policy enforcement and vulnerability tracking is active in Mend.io",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mercury.json b/integrations-catalog/integrations/mercury.json
new file mode 100644
index 0000000000..87785d04b2
--- /dev/null
+++ b/integrations-catalog/integrations/mercury.json
@@ -0,0 +1,38 @@
+{
+  "slug": "mercury",
+  "name": "Mercury",
+  "description": "Monitor Mercury corporate banking platform for account access and financial data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.mercury.com/reference/introduction",
+  "baseUrl": "https://api.mercury.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Mercury at https://app.mercury.com\n2. Go to Settings → API Tokens\n3. Create a new token with read access\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Mercury Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mercury_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Mercury bank account access and team permissions",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/merge-dev.json b/integrations-catalog/integrations/merge-dev.json
new file mode 100644
index 0000000000..2ab693bd4e
--- /dev/null
+++ b/integrations-catalog/integrations/merge-dev.json
@@ -0,0 +1,45 @@
+{
+  "slug": "merge-dev",
+  "name": "Merge",
+  "description": "Merge unified API platform for HRIS, ATS, CRM, and accounting integrations",
+  "category": "HR & People",
+  "docsUrl": "https://docs.merge.dev",
+  "baseUrl": "https://api.merge.dev",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Merge\n2. Go to Settings → API Keys\n3. Copy your production API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Merge → Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "merge_dev_employee_access",
+      "name": "Employee Access",
+      "description": "Lists employees via Merge HRIS API to verify unified HR data access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "merge_dev_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Merge API platform is accessible",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/messagebird.json b/integrations-catalog/integrations/messagebird.json
new file mode 100644
index 0000000000..71cb5f274a
--- /dev/null
+++ b/integrations-catalog/integrations/messagebird.json
@@ -0,0 +1,45 @@
+{
+  "slug": "messagebird",
+  "name": "MessageBird",
+  "description": "Omnichannel communications platform for SMS, voice, and chat.",
+  "category": "Communication",
+  "docsUrl": "https://developers.messagebird.com/api/",
+  "baseUrl": "https://rest.messagebird.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to MessageBird Dashboard\n2. Go to Developers → API access keys\n3. Copy your live API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in MessageBird Dashboard → Developers → API access keys."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "messagebird_app_availability",
+      "name": "MessageBird App Availability",
+      "description": "Checks MessageBird app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "messagebird_employee_access",
+      "name": "MessageBird Employee Access",
+      "description": "Checks MessageBird employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/metronome.json b/integrations-catalog/integrations/metronome.json
new file mode 100644
index 0000000000..5ed92e015e
--- /dev/null
+++ b/integrations-catalog/integrations/metronome.json
@@ -0,0 +1,45 @@
+{
+  "slug": "metronome",
+  "name": "Metronome",
+  "description": "Monitor Metronome usage-based billing platform for access and revenue data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.metronome.com/api/",
+  "baseUrl": "https://api.metronome.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Metronome at https://metronome.com\n2. Go to Settings → API Keys\n3. Create a new API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Metronome Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "metronome_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Metronome billing platform access and customer data exposure",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "metronome_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Metronome billing platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mezmo.json b/integrations-catalog/integrations/mezmo.json
new file mode 100644
index 0000000000..1f607a97f8
--- /dev/null
+++ b/integrations-catalog/integrations/mezmo.json
@@ -0,0 +1,45 @@
+{
+  "slug": "mezmo",
+  "name": "Mezmo",
+  "description": "Mezmo (formerly LogDNA) log management platform",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.mezmo.com/",
+  "baseUrl": "https://api.mezmo.com/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to app.mezmo.com\n2. Settings → Organization → API Keys\n3. Copy your Service Key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Service Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Mezmo → Settings → Organization → API Keys → Service Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mezmo_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Mezmo has active log alerts configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mezmo_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Mezmo team members",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/microsoft-365.json b/integrations-catalog/integrations/microsoft-365.json
new file mode 100644
index 0000000000..171cd33b3d
--- /dev/null
+++ b/integrations-catalog/integrations/microsoft-365.json
@@ -0,0 +1,55 @@
+{
+  "slug": "microsoft-365",
+  "name": "Microsoft 365",
+  "description": "Monitor Microsoft 365 user access, conditional access policies, and audit log activity for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://learn.microsoft.com/en-us/graph/api/overview",
+  "baseUrl": "https://graph.microsoft.com/v1.0/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Register an app in Azure AD > App registrations\n2. Add Delegated permissions: User.Read.All, AuditLog.Read.All, Policy.Read.All, Directory.Read.All\n3. Grant admin consent for all permissions\n4. Add redirect URI: https://api.trycomp.ai/v1/integrations/oauth/callback\n5. Connect using a Work/School account with Global Administrator or Security Administrator role — personal Microsoft accounts (@hotmail/@outlook) are not supported",
+      "scopes": [
+        "User.Read.All",
+        "AuditLog.Read.All",
+        "Policy.Read.All",
+        "Directory.Read.All",
+        "offline_access",
+        "openid",
+        "profile"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "m365_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews active Microsoft 365 users and verifies account status",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "m365_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies that conditional access policies exist to enforce environment and access separation",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "m365_access_review_log",
+      "name": "Access Review Log",
+      "description": "Verifies that Microsoft 365 directory audit logs are active and contain recent events",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/microsoft-defender.json b/integrations-catalog/integrations/microsoft-defender.json
new file mode 100644
index 0000000000..62cfa3e909
--- /dev/null
+++ b/integrations-catalog/integrations/microsoft-defender.json
@@ -0,0 +1,64 @@
+{
+  "slug": "microsoft-defender",
+  "name": "Microsoft Defender for Endpoint",
+  "description": "Connect Microsoft Defender for Endpoint to monitor device health, security alerts, and vulnerability management across your organization.",
+  "category": "Security",
+  "docsUrl": "https://learn.microsoft.com/en-us/defender-endpoint/api/",
+  "baseUrl": "https://api.security.microsoft.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Azure Portal → Microsoft Entra ID → App registrations\n2. Click 'New registration', name it (e.g. 'CompAI Defender'), register\n3. Note the Application (client) ID and Directory (tenant) ID\n4. Go to 'Certificates & secrets' → 'New client secret', copy the value\n5. Go to 'API permissions' → 'Add a permission' → 'APIs my organization uses'\n6. Search for 'Microsoft Threat Protection' (or 'WindowsDefenderATP')\n7. Select 'Application permissions' and add: Machine.Read.All, Alert.Read.All, Vulnerability.Read.All\n8. Click 'Grant admin consent' for your organization\n9. Paste the Tenant ID, Client ID, and Client Secret below",
+      "credentialFields": [
+        {
+          "label": "Tenant ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Azure AD (Entra ID) tenant ID. Found in Azure Portal → Microsoft Entra ID → Overview."
+        },
+        {
+          "label": "Client ID (Application ID)",
+          "type": "text",
+          "required": true,
+          "helpText": "The Application (client) ID from your Azure AD app registration."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "A client secret generated for your Azure AD app registration."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "microsoft_defender_device_list",
+      "name": "Device List",
+      "description": "Retrieves devices managed by Microsoft Defender for Endpoint and verifies they are active and reporting.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "microsoft_defender_monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Checks for unresolved security alerts in Microsoft Defender for Endpoint and reports severity-based findings.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "microsoft_defender_vulnerability_scanning",
+      "name": "Vulnerability Scanning",
+      "description": "Retrieves vulnerabilities detected by Microsoft Defender for Endpoint and reports critical and high severity findings.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/microsoft-teams.json b/integrations-catalog/integrations/microsoft-teams.json
new file mode 100644
index 0000000000..950f842318
--- /dev/null
+++ b/integrations-catalog/integrations/microsoft-teams.json
@@ -0,0 +1,57 @@
+{
+  "slug": "microsoft-teams",
+  "name": "Microsoft Teams",
+  "description": "Team collaboration and messaging platform. Monitor team access and communication compliance.",
+  "category": "Communication",
+  "docsUrl": "https://learn.microsoft.com/en-us/graph/teams-concept-overview",
+  "baseUrl": "https://graph.microsoft.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Azure Portal → Microsoft Entra ID → App registrations\n2. Use the same app as Entra ID, or create a new one\n3. Add Microsoft Graph (Application) permissions:\n   - Team.ReadBasic.All\n   - Channel.ReadBasic.All\n4. Click 'Grant admin consent'\n5. Enter the Tenant ID, Application ID, and Client Secret below",
+      "credentialFields": [
+        {
+          "label": "Tenant ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Azure Portal → Microsoft Entra ID → Overview → Tenant ID."
+        },
+        {
+          "label": "Application (Client) ID",
+          "type": "text",
+          "required": true,
+          "helpText": "From your Azure AD app registration."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "From your Azure AD app registration → Certificates & secrets."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "microsoft_teams_app_availability",
+      "name": "Microsoft Teams App Availability",
+      "description": "Verifies Microsoft Teams API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "microsoft_teams_employee_access",
+      "name": "Microsoft Teams Employee Access",
+      "description": "Verifies team membership access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mimecast.json b/integrations-catalog/integrations/mimecast.json
new file mode 100644
index 0000000000..1a6c74bf0e
--- /dev/null
+++ b/integrations-catalog/integrations/mimecast.json
@@ -0,0 +1,71 @@
+{
+  "slug": "mimecast",
+  "name": "Mimecast",
+  "description": "Email security platform that protects organizations from email-based threats including phishing, malware, and spam",
+  "category": "Communication",
+  "docsUrl": "https://developer.services.mimecast.com/",
+  "baseUrl": "https://api.services.mimecast.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Mimecast Administration Console\n2. Navigate to Administration > Services > API and Platform Integrations\n3. Create a new API 2.0 Application\n4. Select required scopes: user/read, account/read\n5. Copy Client ID and Client Secret\n6. Enter your region (found in your Admin Console URL, e.g., 'US' for us1.mimecast.com)",
+      "credentialFields": [
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Mimecast region (US, EU, DE, AU, ZA, etc.). Found in your Mimecast Admin Console URL."
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth Application Client ID from Mimecast Administration Console > Services > API and Platform Integrations"
+        },
+        {
+          "label": "Client Secret",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth Application Client Secret from your API application"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "domain_configuration",
+      "name": "Contact Information",
+      "description": "Verifies domain configuration and contact information for email security compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews Mimecast user accounts and access controls for employee verification",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "security_policies",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies anti-malware policies and security monitoring configurations are in place",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "security_awareness",
+      "name": "Employee Verification",
+      "description": "Checks security awareness training data for employee verification compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mintlify.json b/integrations-catalog/integrations/mintlify.json
new file mode 100644
index 0000000000..328f1b76f6
--- /dev/null
+++ b/integrations-catalog/integrations/mintlify.json
@@ -0,0 +1,45 @@
+{
+  "slug": "mintlify",
+  "name": "Mintlify",
+  "description": "Mintlify AI-powered developer documentation platform",
+  "category": "Development",
+  "docsUrl": "https://mintlify.com/docs",
+  "baseUrl": "https://api.mintlify.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Mintlify\n2. Go to Dashboard → Settings → API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Mintlify → Dashboard → Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mintlify_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Mintlify documentation platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mintlify_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Mintlify documentation access and team management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/miro.json b/integrations-catalog/integrations/miro.json
new file mode 100644
index 0000000000..2bfbe2f7d1
--- /dev/null
+++ b/integrations-catalog/integrations/miro.json
@@ -0,0 +1,35 @@
+{
+  "slug": "miro",
+  "name": "Miro",
+  "description": "Monitor Miro team members and board organization for collaboration compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.miro.com/docs/rest-api-reference",
+  "baseUrl": "https://api.miro.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "miro_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Miro team members and their access roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "miro_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Miro boards are organized for team separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mistral.json b/integrations-catalog/integrations/mistral.json
new file mode 100644
index 0000000000..55963e422f
--- /dev/null
+++ b/integrations-catalog/integrations/mistral.json
@@ -0,0 +1,35 @@
+{
+  "slug": "mistral",
+  "name": "Mistral AI",
+  "description": "European AI company building open and commercial LLMs. Monitor API access.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.mistral.ai/api/",
+  "baseUrl": "https://api.mistral.ai",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mistral_app_availability",
+      "name": "Mistral AI App Availability",
+      "description": "Checks that the Mistral AI API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mistral_employee_access",
+      "name": "Mistral AI Employee Access",
+      "description": "Verifies employee access to Mistral AI via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mixpanel.json b/integrations-catalog/integrations/mixpanel.json
new file mode 100644
index 0000000000..5daee3dacb
--- /dev/null
+++ b/integrations-catalog/integrations/mixpanel.json
@@ -0,0 +1,45 @@
+{
+  "slug": "mixpanel",
+  "name": "Mixpanel",
+  "description": "Monitor Mixpanel product analytics for user data access and privacy compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://developer.mixpanel.com/reference/overview",
+  "baseUrl": "https://mixpanel.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Mixpanel at https://mixpanel.com\n2. Go to Organization Settings → Service Accounts\n3. Create a new Service Account\n4. Copy the username and secret\n5. Base64 encode 'username:secret'\n6. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded Service Account",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'username:secret' of your Mixpanel Service Account. Create one in Mixpanel → Organization Settings → Service Accounts. Command: echo -n 'username:secret' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mixpanel_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Mixpanel service account credentials are active for analytics access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mixpanel_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Mixpanel projects handle user data with appropriate privacy controls",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/monday.json b/integrations-catalog/integrations/monday.json
new file mode 100644
index 0000000000..4cf3087378
--- /dev/null
+++ b/integrations-catalog/integrations/monday.json
@@ -0,0 +1,45 @@
+{
+  "slug": "monday",
+  "name": "Monday.com",
+  "description": "Monitor Monday.com project management platform for team access and workspace security compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.monday.com/api-reference/docs",
+  "baseUrl": "https://api.monday.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Monday.com\n2. Click your avatar → Developers\n3. Go to My Access Tokens\n4. Copy your personal API token\n5. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Monday.com → Avatar → Developers → My Access Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "monday_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Monday.com workspace members with access to project management data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monday_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Monday.com project management platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mongodb-atlas.json b/integrations-catalog/integrations/mongodb-atlas.json
new file mode 100644
index 0000000000..0cf786f501
--- /dev/null
+++ b/integrations-catalog/integrations/mongodb-atlas.json
@@ -0,0 +1,77 @@
+{
+  "slug": "mongodb-atlas",
+  "name": "MongoDB Atlas",
+  "description": "Monitor MongoDB Atlas organization user access, team role assignments, infrastructure inventory, and encryption at rest configuration",
+  "category": "Cloud",
+  "docsUrl": "https://www.mongodb.com/docs/atlas/configure-api-access/",
+  "baseUrl": "https://cloud.mongodb.com/api/atlas/v2/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Public API Key",
+          "type": "text",
+          "required": true,
+          "helpText": "Your MongoDB Atlas programmatic API public key. Create one at Organization > Access Manager > API Keys."
+        },
+        {
+          "label": "Private API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Your MongoDB Atlas programmatic API private key. Shown only once at creation time."
+        },
+        {
+          "label": "Organization ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your MongoDB Atlas Organization ID. Found at Organization Settings > General."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all users in the MongoDB Atlas organization with their roles and last authentication time",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Lists all teams in the MongoDB Atlas organization with their members and role assignments",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all projects and clusters in the MongoDB Atlas organization",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Verifies encryption at rest configuration for each project in the MongoDB Atlas organization",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mongodb_separation_of_environments",
+      "name": "Separation of Environments",
+      "description": "Verifies that MongoDB Atlas organization has separate projects for different environments (e.g., development, staging, production), ensuring proper environment segregation.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/monte-carlo.json b/integrations-catalog/integrations/monte-carlo.json
new file mode 100644
index 0000000000..bcc84bc602
--- /dev/null
+++ b/integrations-catalog/integrations/monte-carlo.json
@@ -0,0 +1,51 @@
+{
+  "slug": "monte-carlo",
+  "name": "Monte Carlo",
+  "description": "Monitor Monte Carlo data observability platform for pipeline reliability and data quality compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://apidocs.getmontecarlo.com/",
+  "baseUrl": "https://api.getmontecarlo.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Monte Carlo at https://getmontecarlo.com\n2. Go to Settings → API\n3. Click Create Key\n4. Copy the Key ID and Token\n5. Enter both below",
+      "credentialFields": [
+        {
+          "label": "API Key ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Monte Carlo Settings → API → Create Key"
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Monte Carlo Settings → API → Create Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "montecarlo_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Monte Carlo is monitoring data pipelines for quality issues",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "montecarlo_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Monte Carlo users with access to data observability platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mosyle.json b/integrations-catalog/integrations/mosyle.json
new file mode 100644
index 0000000000..c9f58eb284
--- /dev/null
+++ b/integrations-catalog/integrations/mosyle.json
@@ -0,0 +1,35 @@
+{
+  "slug": "mosyle",
+  "name": "Mosyle",
+  "description": "Apple Mobile Device Management (MDM) solution for managing iPads, iPhones, Macs, and Apple TVs in educational and enterprise environments.",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Retrieve a comprehensive list of all managed devices from Mosyle, including iPads, iPhones, Macs, and Apple TVs with their security status and configuration details.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Identify devices that meet security requirements including supervision status, encryption, and compliance with organizational security policies.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/motherduck.json b/integrations-catalog/integrations/motherduck.json
new file mode 100644
index 0000000000..c0243be093
--- /dev/null
+++ b/integrations-catalog/integrations/motherduck.json
@@ -0,0 +1,35 @@
+{
+  "slug": "motherduck",
+  "name": "MotherDuck",
+  "description": "Serverless analytics platform built on DuckDB. Monitor organization access.",
+  "category": "Cloud",
+  "docsUrl": "https://motherduck.com/docs/",
+  "baseUrl": "https://api.motherduck.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "motherduck_app_availability",
+      "name": "MotherDuck App Availability",
+      "description": "Checks that the MotherDuck API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "motherduck_employee_access",
+      "name": "MotherDuck Employee Access",
+      "description": "Verifies employee access to MotherDuck via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/mural.json b/integrations-catalog/integrations/mural.json
new file mode 100644
index 0000000000..728cb0f026
--- /dev/null
+++ b/integrations-catalog/integrations/mural.json
@@ -0,0 +1,45 @@
+{
+  "slug": "mural",
+  "name": "MURAL",
+  "description": "MURAL digital whiteboard for visual collaboration and brainstorming",
+  "category": "Productivity",
+  "docsUrl": "https://developers.mural.co",
+  "baseUrl": "https://app.mural.co",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to MURAL\n2. Go to My Account → Apps\n3. Create an app and generate an API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "MURAL → My Account → Apps → Create App → Generate API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mural_app_availability",
+      "name": "App Availability",
+      "description": "Verifies MURAL platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mural_employee_access",
+      "name": "Employee Access",
+      "description": "Lists MURAL workspace members",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/n-able-n-sight.json b/integrations-catalog/integrations/n-able-n-sight.json
new file mode 100644
index 0000000000..9d62e9c8c6
--- /dev/null
+++ b/integrations-catalog/integrations/n-able-n-sight.json
@@ -0,0 +1,57 @@
+{
+  "slug": "n-able-n-sight",
+  "name": "N-able N-sight RMM",
+  "description": "Monitor N-able N-sight remote monitoring and management platform for device compliance, monitoring alerts, and endpoint inventory",
+  "category": "Security",
+  "docsUrl": "https://documentation.n-able.com/remote-management/userguide/Content/api_key.htm",
+  "baseUrl": "https://www.systemmonitor.co.uk/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Server URL",
+          "type": "text",
+          "required": false,
+          "helpText": "Your N-sight RMM server URL (varies by region)"
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": false,
+          "helpText": "API key from N-sight RMM Dashboard > Account Settings > API Access"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Inventory of monitored devices and endpoints managed by N-sight RMM",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Validates device security compliance and configuration status",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Monitors system alerts and check failures for proactive issue detection",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/namely.json b/integrations-catalog/integrations/namely.json
new file mode 100644
index 0000000000..a6c27445e9
--- /dev/null
+++ b/integrations-catalog/integrations/namely.json
@@ -0,0 +1,44 @@
+{
+  "slug": "namely",
+  "name": "Namely",
+  "description": "Namely HR, payroll, and benefits platform",
+  "category": "HR & People",
+  "docsUrl": "https://developers.namely.com/",
+  "baseUrl": "https://{{credentials.subdomain}}.namely.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Namely\n2. Go to Settings → API Keys\n3. Create an API access token with read permissions\n4. Enter your subdomain and paste the token below",
+      "credentialFields": [
+        {
+          "label": "Company Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Namely subdomain (e.g. if your URL is acme.namely.com, enter: acme)"
+        },
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate an OAuth access token in Namely → Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "namely_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Namely profiles to verify employee records and access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/navan.json b/integrations-catalog/integrations/navan.json
new file mode 100644
index 0000000000..56561cb189
--- /dev/null
+++ b/integrations-catalog/integrations/navan.json
@@ -0,0 +1,38 @@
+{
+  "slug": "navan",
+  "name": "Navan",
+  "description": "Navan (formerly TripActions) travel and expense management platform",
+  "category": "HR & People",
+  "docsUrl": "https://developer.navan.com/",
+  "baseUrl": "https://app.navan.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Navan\n2. Go to Settings → Integrations → API Tokens\n3. Create a new API token with read access\n4. Copy the token and paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate an API token in Navan → Settings → Integrations → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "navan_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Navan users to verify travel and expense access is properly managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/nectar-hr.json b/integrations-catalog/integrations/nectar-hr.json
new file mode 100644
index 0000000000..e5fdc19a75
--- /dev/null
+++ b/integrations-catalog/integrations/nectar-hr.json
@@ -0,0 +1,38 @@
+{
+  "slug": "nectar-hr",
+  "name": "Nectar",
+  "description": "Nectar employee recognition and rewards platform",
+  "category": "HR & People",
+  "docsUrl": "https://nectarhr.com/",
+  "baseUrl": "https://api.nectarhr.com/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Nectar\n2. Go to Settings → API Tokens\n3. Create a new API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Nectar → Settings → API Tokens → Create token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "nectar_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Nectar users to verify recognition platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/neon.json b/integrations-catalog/integrations/neon.json
new file mode 100644
index 0000000000..27785db6a4
--- /dev/null
+++ b/integrations-catalog/integrations/neon.json
@@ -0,0 +1,35 @@
+{
+  "slug": "neon",
+  "name": "Neon",
+  "description": "Monitor Neon serverless Postgres projects for database infrastructure compliance",
+  "category": "Cloud",
+  "docsUrl": "https://api-docs.neon.tech/reference/getting-started-with-neon-api",
+  "baseUrl": "https://console.neon.tech/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "neon_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Neon projects for database infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "neon_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Neon platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/nessus.json b/integrations-catalog/integrations/nessus.json
new file mode 100644
index 0000000000..040d0b7467
--- /dev/null
+++ b/integrations-catalog/integrations/nessus.json
@@ -0,0 +1,58 @@
+{
+  "slug": "nessus",
+  "name": "Nessus / Tenable Vulnerability Management",
+  "description": "Cloud-based vulnerability scanning platform. Monitor scan status, track asset inventory, and review vulnerabilities by severity.",
+  "category": "Security",
+  "docsUrl": "https://developer.tenable.com/reference/navigate",
+  "baseUrl": "https://cloud.tenable.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Tenable.io at https://cloud.tenable.com\n2. Click your name in the upper-right corner\n3. Go to My Account > API Keys\n4. Click Generate to create a new key pair\n5. Copy the Access Key and Secret Key and paste them below",
+      "credentialFields": [
+        {
+          "label": "Access Key",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Tenable.io API access key. Found in Settings > My Account > API Keys."
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Tenable.io API secret key. Generated alongside the access key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "nessus_scan_monitoring",
+      "name": "Tenable Scan Monitoring",
+      "description": "Verifies vulnerability scans are configured and reports their current status.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "nessus_asset_inventory",
+      "name": "Tenable Asset Inventory",
+      "description": "Verifies assets are tracked and scanned in Tenable Vulnerability Management.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "nessus_vulnerability_status",
+      "name": "Tenable Vulnerability Status",
+      "description": "Lists vulnerabilities by severity and flags critical and high findings.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/netlify.json b/integrations-catalog/integrations/netlify.json
new file mode 100644
index 0000000000..8f3d1a92e4
--- /dev/null
+++ b/integrations-catalog/integrations/netlify.json
@@ -0,0 +1,35 @@
+{
+  "slug": "netlify",
+  "name": "Netlify",
+  "description": "Monitor Netlify site deployments and environment configuration for compliance",
+  "category": "Cloud",
+  "docsUrl": "https://open-api.netlify.com/",
+  "baseUrl": "https://api.netlify.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "netlify_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Netlify sites are published and live",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "netlify_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Netlify sites have proper branch deploy configurations for environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/netskope.json b/integrations-catalog/integrations/netskope.json
new file mode 100644
index 0000000000..b38fa430e9
--- /dev/null
+++ b/integrations-catalog/integrations/netskope.json
@@ -0,0 +1,63 @@
+{
+  "slug": "netskope",
+  "name": "Netskope",
+  "description": "Cloud Access Security Broker (CASB) and Secure Access Service Edge (SASE) platform providing cloud security, data protection, and network security services.",
+  "category": "Security",
+  "docsUrl": "https://docs.netskope.com/en/rest-api-v2-overview-312207/",
+  "baseUrl": "https://{{credentials.tenant_name}}.goskope.com/api/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Netskope admin console at https://<tenant>.goskope.com\n2. Go to Settings > Tools > REST API v2 Token to create a new API token (or Settings > Tools > REST API v1 Token for v1 endpoints)\n3. Copy the generated API token\n4. Enter your tenant name (the subdomain before .goskope.com) and the API token above\n5. More details: https://docs.netskope.com/en/rest-api-v2-overview/",
+      "credentialFields": [
+        {
+          "label": "Tenant Name",
+          "type": "text",
+          "required": true
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "alert_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verify that security alerts are being generated and monitored for threats and policy violations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "netskope_client_management",
+      "name": "Secure Devices",
+      "description": "Verify Netskope client deployment and device security posture",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_management",
+      "name": "Device List",
+      "description": "Verify that connected client devices are being tracked and managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "audit_logging",
+      "name": "Access Review Log",
+      "description": "Verify that audit logs are being generated and retained for compliance and security monitoring",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/netsuite.json b/integrations-catalog/integrations/netsuite.json
new file mode 100644
index 0000000000..af97c110b3
--- /dev/null
+++ b/integrations-catalog/integrations/netsuite.json
@@ -0,0 +1,69 @@
+{
+  "slug": "netsuite",
+  "name": "NetSuite",
+  "description": "Oracle NetSuite ERP - monitors employee access and role-based access controls via SuiteQL REST API with OAuth1 Token-Based Authentication.",
+  "category": "Productivity",
+  "docsUrl": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_1540811039.html",
+  "baseUrl": "https://placeholder.suitetalk.api.netsuite.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Account ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your NetSuite Account ID (e.g., 1234567 or TSTDRV1234567). Found at Setup > Company > Company Information."
+        },
+        {
+          "label": "Consumer Key",
+          "type": "text",
+          "required": true,
+          "helpText": "Integration consumer key. Found at Setup > Integration > Manage Integrations."
+        },
+        {
+          "label": "Consumer Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Integration consumer secret. Displayed only once when creating the integration."
+        },
+        {
+          "label": "Token ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Access token ID. Found at Setup > Users/Roles > Access Tokens."
+        },
+        {
+          "label": "Token Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Access token secret. Displayed only once when creating the token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all employees in NetSuite via SuiteQL to verify employee access records are maintained and accounts have proper status.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access_controls",
+      "name": "Role-based Access Controls",
+      "description": "Lists all roles defined in NetSuite via SuiteQL to verify that role-based access controls are properly configured.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/new-relic.json b/integrations-catalog/integrations/new-relic.json
new file mode 100644
index 0000000000..f8d153a4df
--- /dev/null
+++ b/integrations-catalog/integrations/new-relic.json
@@ -0,0 +1,52 @@
+{
+  "slug": "new-relic",
+  "name": "New Relic",
+  "description": "Monitor New Relic alert policies, APM applications, and notification channels for observability compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.newrelic.com/docs/apis/rest-api-v2/",
+  "baseUrl": "https://api.newrelic.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to New Relic One (one.newrelic.com)\n2. Click your user icon > API keys\n3. Click 'Create a key' and select type 'User'\n4. Copy and paste the key below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a User API Key under your New Relic profile > API keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "alert_policies",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that New Relic alert policies are configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "applications_monitored",
+      "name": "Utility Monitoring",
+      "description": "Verifies that applications are instrumented in New Relic APM",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "alert_channels",
+      "name": "Incident Response",
+      "description": "Verifies that New Relic alert channels are configured for incident notifications",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ngrok.json b/integrations-catalog/integrations/ngrok.json
new file mode 100644
index 0000000000..2adbfb46fa
--- /dev/null
+++ b/integrations-catalog/integrations/ngrok.json
@@ -0,0 +1,35 @@
+{
+  "slug": "ngrok",
+  "name": "ngrok",
+  "description": "Ingress platform for exposing local services. Monitor tunnels and access.",
+  "category": "Infrastructure",
+  "docsUrl": "https://ngrok.com/docs/api/",
+  "baseUrl": "https://api.ngrok.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ngrok_app_availability",
+      "name": "ngrok App Availability",
+      "description": "Checks that the ngrok API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ngrok_employee_access",
+      "name": "ngrok Employee Access",
+      "description": "Verifies employee access to ngrok via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/nightfall-ai.json b/integrations-catalog/integrations/nightfall-ai.json
new file mode 100644
index 0000000000..a74f66aad2
--- /dev/null
+++ b/integrations-catalog/integrations/nightfall-ai.json
@@ -0,0 +1,51 @@
+{
+  "slug": "nightfall-ai",
+  "name": "Nightfall AI",
+  "description": "Monitor Nightfall AI cloud DLP policies, data violations, scan capabilities, and detection rules to ensure sensitive data is identified and protected across Slack, GitHub, Jira, and other SaaS applications.",
+  "category": "Security",
+  "docsUrl": "https://help.nightfall.ai/developer-api/introduction/overview",
+  "baseUrl": "https://api.nightfall.ai",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to the Nightfall Dashboard at https://app.nightfall.ai\n2. Go to Settings (gear icon) > API Keys, or navigate to https://app.nightfall.ai/developer-platform/api-keys\n3. Click 'Create API Key' and give it a descriptive name\n4. Copy the API key (starts with 'NF-')\n5. Paste the API key below\n\nNote: The API key must be kept secret. Do not share it in publicly accessible areas."
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "nightfall_dlp_scan_capability",
+      "name": "Data Masking",
+      "description": "Verifies that the Nightfall AI DLP scan endpoint is accessible and can detect sensitive data types (PII, PCI, secrets) with redaction capabilities configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "nightfall_secret_detection",
+      "name": "Secure Secrets",
+      "description": "Verifies that Nightfall AI can detect exposed secrets such as API keys, cryptographic keys, database connection strings, and passwords in scanned content",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "nightfall_violation_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that the Nightfall violation monitoring API is accessible and checks for active DLP violations across connected SaaS applications (Slack, GitHub, Jira, Google Drive, etc.)",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "nightfall_code_secrets_scanning",
+      "name": "Secure Code",
+      "description": "Verifies that Nightfall can detect secrets and sensitive data patterns commonly found in source code, including API keys, passwords in code, and connection strings",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ninjaone.json b/integrations-catalog/integrations/ninjaone.json
new file mode 100644
index 0000000000..c4ff256366
--- /dev/null
+++ b/integrations-catalog/integrations/ninjaone.json
@@ -0,0 +1,63 @@
+{
+  "slug": "ninjaone",
+  "name": "NinjaOne (NinjaRMM)",
+  "description": "Monitor and manage endpoint devices, security patches, antivirus status, and alerts from your NinjaOne RMM platform",
+  "category": "Security",
+  "docsUrl": "https://app.ninjarmm.com/apidocs-beta/",
+  "baseUrl": "https://app.ninjarmm.com/api/v2",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth2 Client ID from NinjaOne Administration > Apps"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "OAuth2 Client Secret from NinjaOne Administration > Apps"
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Global: app.ninjarmm.com | Europe: eu.ninjarmm.com | Oceania: oc.ninjarmm.com"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_security_status",
+      "name": "Device Security Status",
+      "description": "Verify that all managed devices have up-to-date antivirus and are properly secured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "active_security_alerts",
+      "name": "Active Security Alerts",
+      "description": "Monitor for active security alerts and critical system conditions requiring immediate attention",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "patch_management_status",
+      "name": "Patch Management Status",
+      "description": "Ensure all devices are up-to-date with critical security patches and operating system updates",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/nordpass.json b/integrations-catalog/integrations/nordpass.json
new file mode 100644
index 0000000000..bff0f5ee55
--- /dev/null
+++ b/integrations-catalog/integrations/nordpass.json
@@ -0,0 +1,58 @@
+{
+  "slug": "nordpass",
+  "name": "NordPass",
+  "description": "Monitor NordPass activity logs, admin access, and credential management compliance",
+  "category": "Security",
+  "docsUrl": "https://support.nordpass.com/hc/en-us/articles/23485641117329-Activity-Logs-API",
+  "baseUrl": "https://api-activities.us.nordpass.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "Note: This integration requires a NordPass Enterprise plan.\n\n1. Log in to the NordPass Admin Panel as an Owner or Admin\n2. Go to Settings > Token Management\n3. Generate a new token and copy it\n4. Select your data center region (EU or US)\n5. Paste the token below\n\nIf you don't see Token Management in your settings, you may need to upgrade to the Enterprise plan.",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Your NordPass API token (Enterprise plan required). Go to Admin Panel > Settings > Token Management to generate one."
+        },
+        {
+          "label": "Data Center Region",
+          "type": "select",
+          "required": true,
+          "helpText": "Select the data center where your NordPass organization is located"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "nordpass_app_availability",
+      "name": "App Availability",
+      "description": "Verifies connectivity to the NordPass Activity Logs API",
+      "defaultSeverity": "critical",
+      "enabled": true
+    },
+    {
+      "slug": "nordpass_activity_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Fetches recent NordPass activity logs for compliance monitoring and audit trail evidence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "nordpass_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews NordPass organization member activity to verify active access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/northflank.json b/integrations-catalog/integrations/northflank.json
new file mode 100644
index 0000000000..6ae3941fdf
--- /dev/null
+++ b/integrations-catalog/integrations/northflank.json
@@ -0,0 +1,35 @@
+{
+  "slug": "northflank",
+  "name": "Northflank",
+  "description": "Cloud platform for deploying and managing services. Monitor infrastructure.",
+  "category": "Infrastructure",
+  "docsUrl": "https://northflank.com/docs/v1/api",
+  "baseUrl": "https://api.northflank.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "northflank_app_availability",
+      "name": "Northflank App Availability",
+      "description": "Checks that the Northflank API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "northflank_employee_access",
+      "name": "Northflank Employee Access",
+      "description": "Verifies employee access to Northflank via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/notion.json b/integrations-catalog/integrations/notion.json
new file mode 100644
index 0000000000..79e806664b
--- /dev/null
+++ b/integrations-catalog/integrations/notion.json
@@ -0,0 +1,52 @@
+{
+  "slug": "notion",
+  "name": "Notion",
+  "description": "Monitor Notion workspace members, integration access, and activity for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.notion.com/reference/intro",
+  "baseUrl": "https://api.notion.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Go to notion.so/profile/integrations\n2. Click 'New integration' (or select an existing one)\n3. Give it a name and select the workspace you want to connect\n4. Under Capabilities, make sure 'Read user information including email addresses' is enabled\n5. Copy the Internal Integration Secret and paste it below",
+      "credentialFields": [
+        {
+          "label": "Internal Integration Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Notion internal integration secret. Go to notion.so/profile/integrations, create or select an integration, and copy the Internal Integration Secret."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "notion_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Notion workspace members and verifies active user access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "notion_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies that Notion has dedicated bot integrations for automated processes, separating human from automated access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "notion_access_review",
+      "name": "Access Review Log",
+      "description": "Reviews Notion workspace membership and identifies users without email verification",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/novu.json b/integrations-catalog/integrations/novu.json
new file mode 100644
index 0000000000..37658451c3
--- /dev/null
+++ b/integrations-catalog/integrations/novu.json
@@ -0,0 +1,45 @@
+{
+  "slug": "novu",
+  "name": "Novu",
+  "description": "Monitor Novu notification infrastructure for environment separation and access compliance",
+  "category": "Communication",
+  "docsUrl": "https://docs.novu.co/api-reference/overview",
+  "baseUrl": "https://api.novu.co/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Novu at https://web.novu.co\n2. Go to Settings → API Keys\n3. Copy your API Key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Novu Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "novu_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Novu has separate environments for development and production notifications",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "novu_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Novu team members and their access to notification infrastructure",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ns1.json b/integrations-catalog/integrations/ns1.json
new file mode 100644
index 0000000000..25ad073274
--- /dev/null
+++ b/integrations-catalog/integrations/ns1.json
@@ -0,0 +1,45 @@
+{
+  "slug": "ns1",
+  "name": "NS1",
+  "description": "NS1 (IBM NS1 Connect) managed DNS and traffic management platform",
+  "category": "Infrastructure",
+  "docsUrl": "https://ibm.com/docs/en/ns1-connect",
+  "baseUrl": "https://api.nsone.net/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your NS1 account\n2. Go to Account → Settings → API Keys\n3. Click Add API Key\n4. Grant read-only permissions and copy the key",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Create an API key in NS1 → Account → Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ns1_app_availability",
+      "name": "App Availability",
+      "description": "Verifies NS1 DNS zones are configured and available",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ns1_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews NS1 team members to verify access control",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/okta.json b/integrations-catalog/integrations/okta.json
new file mode 100644
index 0000000000..70d32c8b8d
--- /dev/null
+++ b/integrations-catalog/integrations/okta.json
@@ -0,0 +1,58 @@
+{
+  "slug": "okta",
+  "name": "Okta",
+  "description": "Monitor Okta identity management including user MFA enrollment, access controls, and group-based role assignments",
+  "category": "Identity & Access",
+  "docsUrl": "https://developer.okta.com/docs/api/",
+  "baseUrl": "https://placeholder.okta.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Okta Admin Console (https://YOUR_DOMAIN-admin.okta.com).\n2. Go to Security > API > Tokens.\n3. Click 'Create Token', give it a name (e.g. 'Comp AI'), and copy the token value.\n4. Enter your Okta domain (e.g. company.okta.com) and the API token below.",
+      "credentialFields": [
+        {
+          "label": "Okta Domain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Okta organization domain, e.g. company.okta.com (without https://)"
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Okta Admin Console > Security > API > Tokens > Create Token. Requires Super Admin or Org Admin role."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "mfa_enrollment",
+      "name": "2FA",
+      "description": "Verifies that active Okta users have MFA factors enrolled",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews all Okta users and flags inactive or suspended accounts that should be removed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that Okta groups are configured for role-based access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/omnisend.json b/integrations-catalog/integrations/omnisend.json
new file mode 100644
index 0000000000..4960665ff5
--- /dev/null
+++ b/integrations-catalog/integrations/omnisend.json
@@ -0,0 +1,45 @@
+{
+  "slug": "omnisend",
+  "name": "Omnisend",
+  "description": "Omnisend ecommerce email and SMS marketing automation platform",
+  "category": "Communication",
+  "docsUrl": "https://api-docs.omnisend.com",
+  "baseUrl": "https://api.omnisend.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Omnisend\n2. Go to Store Settings → API Keys\n3. Generate a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Omnisend → Store Settings → API Keys → Generate Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "omnisend_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Omnisend platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "omnisend_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Omnisend contacts to verify marketing platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/onelogin.json b/integrations-catalog/integrations/onelogin.json
new file mode 100644
index 0000000000..50df7df068
--- /dev/null
+++ b/integrations-catalog/integrations/onelogin.json
@@ -0,0 +1,51 @@
+{
+  "slug": "onelogin",
+  "name": "OneLogin",
+  "description": "Monitor OneLogin SSO and identity management platform for user access and MFA compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://developers.onelogin.com/api-docs/2/getting-started/dev-overview",
+  "baseUrl": "https://api.us.onelogin.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to OneLogin Administration\n2. Go to Developers → API Credentials → New Credential\n3. Select 'Read users' scope\n4. Copy Client ID and Client Secret\n5. Base64 encode 'client_id:client_secret': echo -n 'id:secret' | base64\n6. Enter encoded value and your region (us or eu)",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'client_id:client_secret'. Found in OneLogin Administration → API Credentials → New Credential. Command: echo -n 'id:secret' | base64"
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Your OneLogin region: 'us' or 'eu'"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "onelogin_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews OneLogin users with SSO access to connected applications",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "onelogin_2fa",
+      "name": "2FA",
+      "description": "Verifies OneLogin MFA policies are configured for user authentication",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/onetrust.json b/integrations-catalog/integrations/onetrust.json
new file mode 100644
index 0000000000..25f570afd5
--- /dev/null
+++ b/integrations-catalog/integrations/onetrust.json
@@ -0,0 +1,63 @@
+{
+  "slug": "onetrust",
+  "name": "OneTrust",
+  "description": "Monitor OneTrust privacy management and GRC platform for user access, data inventory assets, and assessment status",
+  "category": "Security",
+  "docsUrl": "https://developer.onetrust.com/onetrust/reference/onetrust-api-reference",
+  "baseUrl": "https://app.onetrust.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "OneTrust Hostname",
+          "type": "text",
+          "required": true,
+          "helpText": "Your OneTrust hostname (e.g., app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com)"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth 2.0 Client ID from OneTrust Global Settings > Access Management > Client Credentials"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "OAuth 2.0 Client Secret from OneTrust Global Settings > Access Management > Client Credentials"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Lists all users in OneTrust and reports their active/inactive status for access review evidence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "data_inventory",
+      "name": "Systems Description",
+      "description": "Lists all assets in the OneTrust data inventory to provide evidence of systems tracking and data mapping",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "assessment_status",
+      "name": "Monitoring & Alerting",
+      "description": "Lists all assessments in OneTrust and reports their completion status for audit and monitoring evidence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/openai.json b/integrations-catalog/integrations/openai.json
new file mode 100644
index 0000000000..62b7b187cc
--- /dev/null
+++ b/integrations-catalog/integrations/openai.json
@@ -0,0 +1,45 @@
+{
+  "slug": "openai",
+  "name": "OpenAI",
+  "description": "OpenAI API platform for GPT models, embeddings, and AI capabilities",
+  "category": "Development",
+  "docsUrl": "https://platform.openai.com/docs/api-reference",
+  "baseUrl": "https://api.openai.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to platform.openai.com\n2. Go to API Keys\n3. Create a new secret key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "OpenAI → Platform → API Keys → Create new secret key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "openai_app_availability",
+      "name": "App Availability",
+      "description": "Verifies OpenAI API platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "openai_employee_access",
+      "name": "Employee Access",
+      "description": "Lists OpenAI organization users to verify API access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/openphone.json b/integrations-catalog/integrations/openphone.json
new file mode 100644
index 0000000000..4602f2a27d
--- /dev/null
+++ b/integrations-catalog/integrations/openphone.json
@@ -0,0 +1,35 @@
+{
+  "slug": "openphone",
+  "name": "OpenPhone",
+  "description": "Business phone system. Monitor communication access.",
+  "category": "Communication",
+  "docsUrl": "https://www.openphone.com/docs/api",
+  "baseUrl": "https://api.openphone.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "openphone_app_availability",
+      "name": "OpenPhone App Availability",
+      "description": "Checks OpenPhone app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "openphone_employee_access",
+      "name": "OpenPhone Employee Access",
+      "description": "Checks OpenPhone employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/opsgenie.json b/integrations-catalog/integrations/opsgenie.json
new file mode 100644
index 0000000000..c08f311e10
--- /dev/null
+++ b/integrations-catalog/integrations/opsgenie.json
@@ -0,0 +1,35 @@
+{
+  "slug": "opsgenie",
+  "name": "Opsgenie",
+  "description": "Monitor Opsgenie alerts and on-call schedules for incident response compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.opsgenie.com/docs/api-overview",
+  "baseUrl": "https://api.opsgenie.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "opsgenie_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Checks Opsgenie for open alerts requiring attention",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "opsgenie_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies Opsgenie has on-call schedules configured for incident response",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/optimizely.json b/integrations-catalog/integrations/optimizely.json
new file mode 100644
index 0000000000..b51446ab22
--- /dev/null
+++ b/integrations-catalog/integrations/optimizely.json
@@ -0,0 +1,45 @@
+{
+  "slug": "optimizely",
+  "name": "Optimizely",
+  "description": "Monitor Optimizely experimentation and feature flag platform for access and change management compliance",
+  "category": "Development",
+  "docsUrl": "https://library.optimizely.com/docs/api/app/v2/index.html",
+  "baseUrl": "https://api.optimizely.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Optimizely at https://app.optimizely.com\n2. Go to Account Settings → API Keys\n3. Generate a Personal Access Token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Optimizely Account Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "optimizely_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Optimizely project collaborators with access to experiments and feature flags",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "optimizely_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Optimizely feature flags are used to control code changes safely",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/oracle-cloud.json b/integrations-catalog/integrations/oracle-cloud.json
new file mode 100644
index 0000000000..69927ccd1f
--- /dev/null
+++ b/integrations-catalog/integrations/oracle-cloud.json
@@ -0,0 +1,76 @@
+{
+  "slug": "oracle-cloud",
+  "name": "Oracle Cloud Infrastructure",
+  "description": "Monitor OCI IAM users, compute instances, and encryption keys for cloud compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.oracle.com/en-us/iaas/Content/API/Concepts/usingapi.htm",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "## Setup Instructions\n\n1. Log in to the Oracle Cloud Console\n2. Go to **Identity & Security > Users** and select your user\n3. Under **Resources**, click **API Keys** and then **Add API Key**\n4. Download the private key or upload your own public key\n5. Copy the **Tenancy OCID** from **Administration > Tenancy Details**\n6. Copy the **User OCID** from the user details page\n7. Copy the **Fingerprint** shown after adding the API key\n8. Enter your **Region** identifier (e.g., us-ashburn-1)\n\nThe user needs the following IAM policies:\n- `Allow user to inspect users in tenancy`\n- `Allow user to inspect compartments in tenancy`\n- `Allow user to inspect instances in tenancy`\n- `Allow user to inspect vaults in tenancy`\n- `Allow user to inspect keys in tenancy`",
+      "credentialFields": [
+        {
+          "label": "Tenancy OCID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your tenancy OCID from the OCI Console (Administration > Tenancy Details)"
+        },
+        {
+          "label": "User OCID",
+          "type": "text",
+          "required": true,
+          "helpText": "The OCID of the IAM user whose API key is used for authentication"
+        },
+        {
+          "label": "API Key Fingerprint",
+          "type": "text",
+          "required": true,
+          "helpText": "The fingerprint of the RSA public key uploaded to OCI"
+        },
+        {
+          "label": "Private Key (PEM)",
+          "type": "textarea",
+          "required": true,
+          "helpText": "The RSA private key in PEM format used for API request signing"
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": true,
+          "helpText": "Your OCI region identifier (e.g., us-ashburn-1, eu-frankfurt-1, ap-tokyo-1)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "oci_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all IAM users in the OCI tenancy to verify employee access controls",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "oci_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all compartments and compute instances across the OCI tenancy for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "oci_encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Lists KMS vaults and encryption keys to verify data encryption at rest across the OCI tenancy",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/orca-security.json b/integrations-catalog/integrations/orca-security.json
new file mode 100644
index 0000000000..cee1262037
--- /dev/null
+++ b/integrations-catalog/integrations/orca-security.json
@@ -0,0 +1,45 @@
+{
+  "slug": "orca-security",
+  "name": "Orca Security",
+  "description": "Monitor Orca Security cloud security posture management for vulnerability and compliance findings",
+  "category": "Security",
+  "docsUrl": "https://docs.orcasecurity.io/reference/introduction",
+  "baseUrl": "https://app.us.orcasecurity.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Orca Security at https://app.us.orcasecurity.io\n2. Go to Settings → API Tokens\n3. Create a new token with read access\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Orca Security Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "orca_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Orca Security is actively scanning cloud environments for threats",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "orca_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Orca Security users with access to cloud security findings",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/outreach.json b/integrations-catalog/integrations/outreach.json
new file mode 100644
index 0000000000..fe0fd6de75
--- /dev/null
+++ b/integrations-catalog/integrations/outreach.json
@@ -0,0 +1,45 @@
+{
+  "slug": "outreach",
+  "name": "Outreach",
+  "description": "Monitor Outreach sales engagement platform for team access and communication data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://api.outreach.io/api/v2/docs",
+  "baseUrl": "https://api.outreach.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Outreach at https://app.outreach.io\n2. Go to your Profile → API Tokens\n3. Create a new API token with read access\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Outreach Profile → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "outreach_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Outreach users with access to the sales engagement platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "outreach_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Outreach sales engagement platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/oyster-hr.json b/integrations-catalog/integrations/oyster-hr.json
new file mode 100644
index 0000000000..dfb7514ebe
--- /dev/null
+++ b/integrations-catalog/integrations/oyster-hr.json
@@ -0,0 +1,38 @@
+{
+  "slug": "oyster-hr",
+  "name": "Oyster HR",
+  "description": "Oyster global employment platform for remote teams",
+  "category": "HR & People",
+  "docsUrl": "https://docs.oysterhr.com/",
+  "baseUrl": "https://api.oysterhr.com/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Oyster\n2. Go to Settings → Integrations\n3. Generate an API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Oyster → Settings → Integrations → API Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "oyster_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Oyster employees to verify global hiring compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/paddle.json b/integrations-catalog/integrations/paddle.json
new file mode 100644
index 0000000000..8d6bfbb1ee
--- /dev/null
+++ b/integrations-catalog/integrations/paddle.json
@@ -0,0 +1,45 @@
+{
+  "slug": "paddle",
+  "name": "Paddle",
+  "description": "Monitor Paddle subscription and payment platform for billing access and merchant compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.paddle.com/",
+  "baseUrl": "https://api.paddle.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Paddle at https://vendors.paddle.com\n2. Go to Developer Tools → Authentication → API Keys\n3. Generate a new API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Paddle Developer Tools → Authentication → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "paddle_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Paddle merchant account is active and billing platform is secured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "paddle_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Paddle platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pagerduty.json b/integrations-catalog/integrations/pagerduty.json
new file mode 100644
index 0000000000..1b16542795
--- /dev/null
+++ b/integrations-catalog/integrations/pagerduty.json
@@ -0,0 +1,45 @@
+{
+  "slug": "pagerduty",
+  "name": "PagerDuty",
+  "description": "Monitor PagerDuty incident response configuration including services, escalation policies, and on-call schedules for compliance evidence",
+  "category": "Security",
+  "docsUrl": "https://developer.pagerduty.com/api-reference/",
+  "baseUrl": "https://api.pagerduty.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to PagerDuty.\n2. Go to Integrations > API Access Keys.\n3. Click 'Create New API Key', give it a description (e.g. 'Comp AI'), select Read-Only.\n4. Copy the API key and paste it below.",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in PagerDuty > Integrations > API Access Keys. Create a General Access Key with Read-Only access."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "incident_response",
+      "name": "Incident Response",
+      "description": "Verifies that PagerDuty services have escalation policies configured for incident response",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that PagerDuty escalation policies are configured with escalation rules for alerting",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/palo-alto.json b/integrations-catalog/integrations/palo-alto.json
new file mode 100644
index 0000000000..0015158bd2
--- /dev/null
+++ b/integrations-catalog/integrations/palo-alto.json
@@ -0,0 +1,35 @@
+{
+  "slug": "palo-alto",
+  "name": "Palo Alto Networks SASE",
+  "description": "Secure access service edge platform. Monitor network security policies and access.",
+  "category": "Security",
+  "docsUrl": "https://pan.dev/sase/api/",
+  "baseUrl": "https://api.sase.paloaltonetworks.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "palo_alto_app_availability",
+      "name": "Palo Alto SASE App Availability",
+      "description": "Verifies Palo Alto SASE API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "palo_alto_employee_access",
+      "name": "Palo Alto SASE Employee Access",
+      "description": "Verifies access to Palo Alto SASE management.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pandadoc.json b/integrations-catalog/integrations/pandadoc.json
new file mode 100644
index 0000000000..3c9c18af63
--- /dev/null
+++ b/integrations-catalog/integrations/pandadoc.json
@@ -0,0 +1,45 @@
+{
+  "slug": "pandadoc",
+  "name": "PandaDoc",
+  "description": "PandaDoc document automation and e-signature platform",
+  "category": "Productivity",
+  "docsUrl": "https://developers.pandadoc.com/",
+  "baseUrl": "https://api.pandadoc.com/public/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to PandaDoc\n2. Go to Settings → Integrations → API\n3. Generate an API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "PandaDoc → Settings → Integrations → API → Generate API key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pandadoc_employee_access",
+      "name": "Employee Access",
+      "description": "Lists PandaDoc workspace members to verify access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pandadoc_app_availability",
+      "name": "App Availability",
+      "description": "Verifies PandaDoc is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/papertrail.json b/integrations-catalog/integrations/papertrail.json
new file mode 100644
index 0000000000..078b38e4bb
--- /dev/null
+++ b/integrations-catalog/integrations/papertrail.json
@@ -0,0 +1,45 @@
+{
+  "slug": "papertrail",
+  "name": "Papertrail",
+  "description": "Monitor Papertrail log management for logging infrastructure and monitoring compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://help.papertrailapp.com/kb/how-it-works/http-api/",
+  "baseUrl": "https://papertrailapp.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Papertrail at https://papertrailapp.com\n2. Go to Profile (top right)\n3. Copy your API Token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Papertrail → Profile → API Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "papertrail_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Papertrail saved searches and alerts are configured for log monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "papertrail_utility_monitoring",
+      "name": "Utility Monitoring",
+      "description": "Verifies Papertrail log sources are actively ingesting logs",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pave.json b/integrations-catalog/integrations/pave.json
new file mode 100644
index 0000000000..ee8ec8be8b
--- /dev/null
+++ b/integrations-catalog/integrations/pave.json
@@ -0,0 +1,38 @@
+{
+  "slug": "pave",
+  "name": "Pave",
+  "description": "Pave compensation planning and benchmarking platform",
+  "category": "HR & People",
+  "docsUrl": "https://pave.dev/docs/",
+  "baseUrl": "https://api.pave.dev/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Pave\n2. Go to Settings → API\n3. Generate an API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Pave → Settings → API → Generate API key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pave_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Pave employees to verify compensation platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/paychex.json b/integrations-catalog/integrations/paychex.json
new file mode 100644
index 0000000000..4d235f98bd
--- /dev/null
+++ b/integrations-catalog/integrations/paychex.json
@@ -0,0 +1,45 @@
+{
+  "slug": "paychex",
+  "name": "Paychex",
+  "description": "Monitor Paychex payroll platform for employee data access and HR compliance",
+  "category": "HR & People",
+  "docsUrl": "https://developer.paychex.com/documentation",
+  "baseUrl": "https://api.paychex.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Sign up at https://developer.paychex.com\n2. Go to My Apps → Create App\n3. Copy Client ID and Client Secret\n4. Base64 encode 'client_id:client_secret': echo -n 'id:secret' | base64\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'client_id:client_secret'. Found in Paychex Developer Portal → My Apps. Command: echo -n 'id:secret' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "paychex_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Paychex payroll access and connected employee records",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "paychex_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Paychex payroll platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/paycom.json b/integrations-catalog/integrations/paycom.json
new file mode 100644
index 0000000000..9c34771129
--- /dev/null
+++ b/integrations-catalog/integrations/paycom.json
@@ -0,0 +1,58 @@
+{
+  "slug": "paycom",
+  "name": "Paycom",
+  "description": "Paycom is a cloud-based Human Capital Management (HCM) platform that combines payroll, HR, time tracking, and other key functions",
+  "category": "HR & People",
+  "docsUrl": "https://www.paycom.com",
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Contact your Paycom representative to enable API access\n2. Obtain your API Base URL, Client ID, and Client Secret\n3. Ensure your API user has read access to employee data and user roles\n4. Enter all values below",
+      "credentialFields": [
+        {
+          "label": "API Base URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Paycom API base URL, provided by your Paycom representative (e.g. https://api.paycom.com)"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth Client ID provided by Paycom for API access"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "OAuth Client Secret provided by Paycom for API access"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "paycom_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies that employee records are accessible through the Paycom API",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "paycom_role_based_access_controls",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that user roles and permissions are configured in Paycom",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/paycor.json b/integrations-catalog/integrations/paycor.json
new file mode 100644
index 0000000000..a2e31b2939
--- /dev/null
+++ b/integrations-catalog/integrations/paycor.json
@@ -0,0 +1,43 @@
+{
+  "slug": "paycor",
+  "name": "Paycor",
+  "description": "Monitor employee access, role-based controls, and sync employee data from Paycor HR & Payroll",
+  "category": "HR & People",
+  "docsUrl": "https://developers.paycor.com/",
+  "baseUrl": "https://apis.paycor.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "scopes": [
+        "openid",
+        "offline_access"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all employees in the Paycor legal entity and verifies their employment status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Reviews employee types and department assignments to verify role-based access controls are in place",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/payfit.json b/integrations-catalog/integrations/payfit.json
new file mode 100644
index 0000000000..db6e353b39
--- /dev/null
+++ b/integrations-catalog/integrations/payfit.json
@@ -0,0 +1,38 @@
+{
+  "slug": "payfit",
+  "name": "PayFit",
+  "description": "PayFit payroll and HR management platform for European teams",
+  "category": "HR & People",
+  "docsUrl": "https://developers.payfit.com/",
+  "baseUrl": "https://api.payfit.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to PayFit\n2. Go to Settings → Integrations → API\n3. Generate an API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "PayFit → Settings → Integrations → API → Generate token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "payfit_employee_access",
+      "name": "Employee Access",
+      "description": "Lists PayFit employees to verify payroll access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/payhawk.json b/integrations-catalog/integrations/payhawk.json
new file mode 100644
index 0000000000..34442a177a
--- /dev/null
+++ b/integrations-catalog/integrations/payhawk.json
@@ -0,0 +1,38 @@
+{
+  "slug": "payhawk",
+  "name": "Payhawk",
+  "description": "Payhawk spend management platform for corporate cards and expenses",
+  "category": "HR & People",
+  "docsUrl": "https://developer.payhawk.com",
+  "baseUrl": "https://api.payhawk.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Payhawk\n2. Go to Settings → Integrations → API Keys\n3. Generate a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Payhawk → Settings → Integrations → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "payhawk_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Payhawk connection and confirms spend management access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/paylocity.json b/integrations-catalog/integrations/paylocity.json
new file mode 100644
index 0000000000..ee771e2aca
--- /dev/null
+++ b/integrations-catalog/integrations/paylocity.json
@@ -0,0 +1,58 @@
+{
+  "slug": "paylocity",
+  "name": "Paylocity",
+  "description": "Cloud-based HRIS and payroll platform. Monitor employee records, hiring, and workforce compliance.",
+  "category": "HR & People",
+  "docsUrl": "https://developer.paylocity.com/",
+  "baseUrl": "https://api.paylocity.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Paylocity\n2. Go to Settings → WebLink API\n3. Copy Client ID, Client Secret, and Company ID\n4. Paste all values below",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "From Paylocity WebLink API settings."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "From Paylocity WebLink API settings."
+        },
+        {
+          "label": "Company ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Numeric company ID without 'CS' prefix."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "paylocity_app_availability",
+      "name": "Paylocity App Availability",
+      "description": "Verifies Paylocity API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "paylocity_employee_access",
+      "name": "Paylocity Employee Access",
+      "description": "Verifies employee records are accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pendo.json b/integrations-catalog/integrations/pendo.json
new file mode 100644
index 0000000000..fea0596704
--- /dev/null
+++ b/integrations-catalog/integrations/pendo.json
@@ -0,0 +1,35 @@
+{
+  "slug": "pendo",
+  "name": "Pendo",
+  "description": "Monitor Pendo product analytics configuration for usage tracking compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://engageapi.pendo.io/",
+  "baseUrl": "https://app.pendo.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pendo_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Pendo is configured and tracking application usage",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pendo_utility_monitoring",
+      "name": "Utility Monitoring",
+      "description": "Reviews Pendo pages being tracked for application coverage",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/permit-io.json b/integrations-catalog/integrations/permit-io.json
new file mode 100644
index 0000000000..e46a10131a
--- /dev/null
+++ b/integrations-catalog/integrations/permit-io.json
@@ -0,0 +1,45 @@
+{
+  "slug": "permit-io",
+  "name": "Permit.io",
+  "description": "Permit.io authorization-as-a-service for fine-grained access control",
+  "category": "Identity & Access",
+  "docsUrl": "https://docs.permit.io",
+  "baseUrl": "https://api.permit.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Permit.io\n2. Go to Settings → API Keys\n3. Create or copy your API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Permit.io → Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "permit_io_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Permit.io authorization platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "permit_io_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Permit.io organizations to verify access control is active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/persona.json b/integrations-catalog/integrations/persona.json
new file mode 100644
index 0000000000..7c447b7203
--- /dev/null
+++ b/integrations-catalog/integrations/persona.json
@@ -0,0 +1,35 @@
+{
+  "slug": "persona",
+  "name": "Persona",
+  "description": "Identity verification platform. Monitor verification inquiries and access.",
+  "category": "Identity & Access",
+  "docsUrl": "https://docs.withpersona.com/reference",
+  "baseUrl": "https://withpersona.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "persona_app_availability",
+      "name": "Persona App Availability",
+      "description": "Checks that the Persona API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "persona_employee_access",
+      "name": "Persona Employee Access",
+      "description": "Verifies employee access to Persona via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/personio.json b/integrations-catalog/integrations/personio.json
new file mode 100644
index 0000000000..33f4127070
--- /dev/null
+++ b/integrations-catalog/integrations/personio.json
@@ -0,0 +1,35 @@
+{
+  "slug": "personio",
+  "name": "Personio",
+  "description": "Monitor Personio employee records and status for HR compliance",
+  "category": "HR & People",
+  "docsUrl": "https://developer.personio.de/reference",
+  "baseUrl": "https://api.personio.de/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "personio_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Personio employees and verifies only active employees have access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "personio_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies all Personio employees have work email addresses on file",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ping-identity.json b/integrations-catalog/integrations/ping-identity.json
new file mode 100644
index 0000000000..5ece698c71
--- /dev/null
+++ b/integrations-catalog/integrations/ping-identity.json
@@ -0,0 +1,58 @@
+{
+  "slug": "ping-identity",
+  "name": "Ping Identity",
+  "description": "Identity and access management platform. Monitor user access and authentication.",
+  "category": "Identity & Access",
+  "docsUrl": "https://apidocs.pingidentity.com/pingone/platform/v1/api/",
+  "baseUrl": "https://api.pingone.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to PingOne admin console\n2. Go to Applications → add a Worker application\n3. Enable it and copy the Access Token\n4. Go to Settings → Environment → Properties for your Environment ID\n5. Paste both values below",
+      "credentialFields": [
+        {
+          "label": "Environment ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in PingOne admin → Settings → Environment → Properties."
+        },
+        {
+          "label": "API Key (Worker App Token)",
+          "type": "password",
+          "required": true,
+          "helpText": "From a PingOne Worker application client credentials."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ping_identity_app_availability",
+      "name": "Ping Identity App Availability",
+      "description": "Verifies PingOne API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ping_identity_employee_access",
+      "name": "Ping Identity Employee Access",
+      "description": "Verifies user directory access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ping_identity_mfa",
+      "name": "Ping Identity MFA",
+      "description": "Verifies MFA policies are configured.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pingboard.json b/integrations-catalog/integrations/pingboard.json
new file mode 100644
index 0000000000..6225a3c200
--- /dev/null
+++ b/integrations-catalog/integrations/pingboard.json
@@ -0,0 +1,38 @@
+{
+  "slug": "pingboard",
+  "name": "Pingboard",
+  "description": "Pingboard org chart and people directory platform",
+  "category": "HR & People",
+  "docsUrl": "https://pingboard.com/api",
+  "baseUrl": "https://app.pingboard.com/api/v2",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Register an OAuth application in Pingboard → Settings → API Applications\n2. Use your client_id and client_secret to obtain an access token via OAuth2 client credentials\n3. Paste the access token below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate an OAuth access token via Pingboard's API (client credentials flow)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pingboard_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Pingboard users to verify org directory is up to date",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pipedream.json b/integrations-catalog/integrations/pipedream.json
new file mode 100644
index 0000000000..341524def3
--- /dev/null
+++ b/integrations-catalog/integrations/pipedream.json
@@ -0,0 +1,35 @@
+{
+  "slug": "pipedream",
+  "name": "Pipedream",
+  "description": "Developer workflow automation platform. Monitor connected accounts and workflow access.",
+  "category": "Development",
+  "docsUrl": "https://pipedream.com/docs/api/rest/",
+  "baseUrl": "https://api.pipedream.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pipedream_app_availability",
+      "name": "Pipedream App Availability",
+      "description": "Checks that the Pipedream API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pipedream_employee_access",
+      "name": "Pipedream Employee Access",
+      "description": "Verifies employee access to Pipedream via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pipedrive.json b/integrations-catalog/integrations/pipedrive.json
new file mode 100644
index 0000000000..faa6e187a7
--- /dev/null
+++ b/integrations-catalog/integrations/pipedrive.json
@@ -0,0 +1,35 @@
+{
+  "slug": "pipedrive",
+  "name": "Pipedrive",
+  "description": "Monitor Pipedrive users and contact records for CRM access compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.pipedrive.com/docs/api/v1",
+  "baseUrl": "https://api.pipedrive.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pipedrive_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Pipedrive users and their access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pipedrive_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Pipedrive contact records are being maintained",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/plain.json b/integrations-catalog/integrations/plain.json
new file mode 100644
index 0000000000..bffb5fb01b
--- /dev/null
+++ b/integrations-catalog/integrations/plain.json
@@ -0,0 +1,45 @@
+{
+  "slug": "plain",
+  "name": "Plain",
+  "description": "Monitor Plain customer support platform for team access and communication compliance",
+  "category": "Communication",
+  "docsUrl": "https://www.plain.com/docs/api-reference/graphql",
+  "baseUrl": "https://core-api.uk.plain.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Plain at https://app.plain.com\n2. Go to Settings → API Keys\n3. Create a new API key with read access\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Plain Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "plain_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Plain support platform users with access to customer conversations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "plain_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Plain customer support platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/planetscale.json b/integrations-catalog/integrations/planetscale.json
new file mode 100644
index 0000000000..4dc1688da4
--- /dev/null
+++ b/integrations-catalog/integrations/planetscale.json
@@ -0,0 +1,58 @@
+{
+  "slug": "planetscale",
+  "name": "PlanetScale",
+  "description": "PlanetScale serverless MySQL-compatible database platform",
+  "category": "Infrastructure",
+  "docsUrl": "https://api-docs.planetscale.com/",
+  "baseUrl": "https://api.planetscale.com/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to PlanetScale\n2. Go to Organization Settings → Service Tokens\n3. Create a service token with read_databases and read_organization permissions\n4. Copy the Token ID and Token Value separately\n5. Enter your Organization name (from app.planetscale.com/YOUR-ORG) and the token fields below",
+      "credentialFields": [
+        {
+          "label": "Service Token ID",
+          "type": "text",
+          "required": true,
+          "helpText": "PlanetScale → Settings → Service Tokens → your token → Token ID"
+        },
+        {
+          "label": "Service Token Value",
+          "type": "password",
+          "required": true,
+          "helpText": "PlanetScale → Settings → Service Tokens → your token → Token Value"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "planetscale_app_availability",
+      "name": "App Availability",
+      "description": "Verifies PlanetScale is reachable and the service token is valid",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "planetscale_employee_access",
+      "name": "Employee Access",
+      "description": "Lists PlanetScale organization members to verify database access is managed",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "planetscale_encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Confirms PlanetScale is in use — PlanetScale encrypts all data at rest by default using AES-256",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/planhat.json b/integrations-catalog/integrations/planhat.json
new file mode 100644
index 0000000000..d377c520f0
--- /dev/null
+++ b/integrations-catalog/integrations/planhat.json
@@ -0,0 +1,45 @@
+{
+  "slug": "planhat",
+  "name": "Planhat",
+  "description": "Monitor Planhat customer success platform for user access and account management compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.planhat.com/",
+  "baseUrl": "https://api.planhat.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Planhat at https://app.planhat.com\n2. Go to Settings → Integrations → API\n3. Copy your API access token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Planhat Settings → Integrations → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "planhat_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Planhat team members and their customer success platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "planhat_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Planhat customer accounts are being tracked",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/plausible.json b/integrations-catalog/integrations/plausible.json
new file mode 100644
index 0000000000..c2ca0440eb
--- /dev/null
+++ b/integrations-catalog/integrations/plausible.json
@@ -0,0 +1,45 @@
+{
+  "slug": "plausible",
+  "name": "Plausible Analytics",
+  "description": "Monitor Plausible Analytics sites for privacy-compliant web analytics",
+  "category": "Monitoring",
+  "docsUrl": "https://plausible.io/docs/stats-api",
+  "baseUrl": "https://plausible.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Plausible at https://plausible.io\n2. Go to Account Settings → API Keys\n3. Create a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Plausible → Account Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "plausible_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Plausible Analytics sites and verifies access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "plausible_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Plausible Analytics is actively tracking site availability",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pleo.json b/integrations-catalog/integrations/pleo.json
new file mode 100644
index 0000000000..53215ac887
--- /dev/null
+++ b/integrations-catalog/integrations/pleo.json
@@ -0,0 +1,45 @@
+{
+  "slug": "pleo",
+  "name": "Pleo",
+  "description": "Monitor Pleo expense management for company spending controls and access compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.pleo.io/",
+  "baseUrl": "https://external.pleo.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Pleo at https://app.pleo.io\n2. Go to Settings → Integrations → API\n3. Generate an API token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Pleo Settings → Integrations → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pleo_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Pleo company members and their expense management access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pleo_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Pleo spending controls and expense policies are configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/port-io.json b/integrations-catalog/integrations/port-io.json
new file mode 100644
index 0000000000..0ef9cef89c
--- /dev/null
+++ b/integrations-catalog/integrations/port-io.json
@@ -0,0 +1,35 @@
+{
+  "slug": "port-io",
+  "name": "Port",
+  "description": "Internal developer portal for service catalog and developer self-service.",
+  "category": "Development",
+  "docsUrl": "https://docs.getport.io/api-reference/port-api",
+  "baseUrl": "https://api.getport.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "port_io_app_availability",
+      "name": "Port App Availability",
+      "description": "Checks that the Port API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "port_io_employee_access",
+      "name": "Port Employee Access",
+      "description": "Verifies employee access to Port via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/posthog.json b/integrations-catalog/integrations/posthog.json
new file mode 100644
index 0000000000..cf2a731ffc
--- /dev/null
+++ b/integrations-catalog/integrations/posthog.json
@@ -0,0 +1,45 @@
+{
+  "slug": "posthog",
+  "name": "PostHog",
+  "description": "Monitor PostHog product analytics for user access and project configuration compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://posthog.com/docs/api",
+  "baseUrl": "https://us.posthog.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Go to PostHog → Settings → Personal API Keys\n2. Click + Create personal API key\n3. Select required scopes (organization:read)\n4. Copy the key and enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in PostHog → Settings → Personal API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "posthog_employee_access",
+      "name": "Employee Access",
+      "description": "Lists PostHog organization members and their access roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "posthog_app_availability",
+      "name": "App Availability",
+      "description": "Verifies PostHog projects are configured and active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/postman.json b/integrations-catalog/integrations/postman.json
new file mode 100644
index 0000000000..069502a34c
--- /dev/null
+++ b/integrations-catalog/integrations/postman.json
@@ -0,0 +1,35 @@
+{
+  "slug": "postman",
+  "name": "Postman",
+  "description": "Monitor Postman workspaces and team API collections for development compliance",
+  "category": "Development",
+  "docsUrl": "https://www.postman.com/postman/postman-postman/documentation/",
+  "baseUrl": "https://api.getpostman.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "postman_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Postman workspace members and API access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "postman_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Postman workspaces are organized for environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/postmark.json b/integrations-catalog/integrations/postmark.json
new file mode 100644
index 0000000000..12ea7a0723
--- /dev/null
+++ b/integrations-catalog/integrations/postmark.json
@@ -0,0 +1,45 @@
+{
+  "slug": "postmark",
+  "name": "Postmark",
+  "description": "Monitor Postmark transactional email servers for access and TLS delivery compliance",
+  "category": "Communication",
+  "docsUrl": "https://postmarkapp.com/developer/api/overview",
+  "baseUrl": "https://api.postmarkapp.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Postmark at https://account.postmarkapp.com\n2. Go to Account → API Tokens\n3. Copy your Account API Token (not the Server token)\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Account API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Postmark Account → API Tokens. Use the Account token, not the Server token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "postmark_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Postmark email servers and verifies they are configured correctly",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "postmark_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Postmark platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/prefect.json b/integrations-catalog/integrations/prefect.json
new file mode 100644
index 0000000000..9efea68ad1
--- /dev/null
+++ b/integrations-catalog/integrations/prefect.json
@@ -0,0 +1,45 @@
+{
+  "slug": "prefect",
+  "name": "Prefect",
+  "description": "Monitor Prefect data workflow orchestration for pipeline reliability and access compliance",
+  "category": "Development",
+  "docsUrl": "https://docs.prefect.io/latest/api-ref/rest-api/",
+  "baseUrl": "https://api.prefect.cloud/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Prefect Cloud at https://app.prefect.cloud\n2. Go to Profile → API Keys\n3. Create a new API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Prefect Cloud Profile → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "prefect_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Prefect Cloud accounts and workspaces for data pipeline access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "prefect_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Prefect data workflows are running and monitored",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/prisma-cloud.json b/integrations-catalog/integrations/prisma-cloud.json
new file mode 100644
index 0000000000..bd30ee3740
--- /dev/null
+++ b/integrations-catalog/integrations/prisma-cloud.json
@@ -0,0 +1,57 @@
+{
+  "slug": "prisma-cloud",
+  "name": "Prisma Cloud",
+  "description": "Cloud-native security platform. Monitor cloud workloads, compliance, and vulnerabilities.",
+  "category": "Security",
+  "docsUrl": "https://pan.dev/prisma-cloud/api/cspm/",
+  "baseUrl": "https://api.prismacloud.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Prisma Cloud\n2. Go to Settings → Access Keys\n3. Add Access Key, copy ID and Secret\n4. Note your API URL\n5. Paste all values below",
+      "credentialFields": [
+        {
+          "label": "Prisma Cloud API URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Prisma Cloud API URL (e.g. https://api.prismacloud.io)."
+        },
+        {
+          "label": "Access Key ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Settings → Access Keys."
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Shown once when creating."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "prisma_cloud_app_availability",
+      "name": "Prisma Cloud App Availability",
+      "description": "Verifies Prisma Cloud API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "prisma_cloud_employee_access",
+      "name": "Prisma Cloud Employee Access",
+      "description": "Verifies user access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/probely.json b/integrations-catalog/integrations/probely.json
new file mode 100644
index 0000000000..a623165216
--- /dev/null
+++ b/integrations-catalog/integrations/probely.json
@@ -0,0 +1,35 @@
+{
+  "slug": "probely",
+  "name": "Probely",
+  "description": "Web application security scanner. Monitor scan targets and vulnerability assessments.",
+  "category": "Security",
+  "docsUrl": "https://developers.probely.com",
+  "baseUrl": "https://api.probely.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "probely_app_availability",
+      "name": "Probely App Availability",
+      "description": "Checks that the Probely API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "probely_employee_access",
+      "name": "Probely Employee Access",
+      "description": "Verifies employee access to Probely via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/productboard.json b/integrations-catalog/integrations/productboard.json
new file mode 100644
index 0000000000..52d5e813d1
--- /dev/null
+++ b/integrations-catalog/integrations/productboard.json
@@ -0,0 +1,45 @@
+{
+  "slug": "productboard",
+  "name": "Productboard",
+  "description": "Monitor Productboard product management for team access and feature prioritization compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.productboard.com/",
+  "baseUrl": "https://api.productboard.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Productboard at https://app.productboard.com\n2. Go to Profile → Integrations → API Access\n3. Generate an API token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Productboard Profile → Integrations → API Access"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "productboard_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Productboard features to confirm team members have appropriate access",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "productboard_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Productboard is accessible and product management is active",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/proofpoint-tap.json b/integrations-catalog/integrations/proofpoint-tap.json
new file mode 100644
index 0000000000..48e448554c
--- /dev/null
+++ b/integrations-catalog/integrations/proofpoint-tap.json
@@ -0,0 +1,46 @@
+{
+  "slug": "proofpoint-tap",
+  "name": "Proofpoint TAP",
+  "description": "Proofpoint Targeted Attack Protection - monitor email threats, targeted attacks, and user click behavior for security compliance",
+  "category": "Security",
+  "docsUrl": "https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation",
+  "baseUrl": "https://tap-api-v2.proofpoint.com",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "setupInstructions": "1. Log in to Proofpoint TAP at https://threatinsight.proofpoint.com\n2. Go to Settings > Connected Applications\n3. Create a new Service Principal (or use an existing one)\n4. Copy the Service Principal (username) and Secret (password)\n5. Enter them below",
+      "usernameField": "service_principal",
+      "passwordField": "service_secret"
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "proofpoint_tap_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Retrieves all threat events from the past 24 hours via the SIEM endpoint. Reports blocked vs delivered threats. Emits findings for any messages that were delivered despite being threats.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "proofpoint_tap_security_awareness",
+      "name": "Security Awareness",
+      "description": "Retrieves the Very Attacked People (VAP) list from Proofpoint TAP. Reports on the most targeted users in the organization over a 30-day window.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "proofpoint_tap_incident_response",
+      "name": "Incident Response",
+      "description": "Retrieves the top clickers list from Proofpoint TAP. Identifies users who clicked on malicious URLs, enabling incident response and targeted remediation.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/proofpoint.json b/integrations-catalog/integrations/proofpoint.json
new file mode 100644
index 0000000000..d5f9838fde
--- /dev/null
+++ b/integrations-catalog/integrations/proofpoint.json
@@ -0,0 +1,45 @@
+{
+  "slug": "proofpoint",
+  "name": "Proofpoint",
+  "description": "Monitor Proofpoint email security platform for threat detection and phishing protection compliance",
+  "category": "Security",
+  "docsUrl": "https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Threat_API",
+  "baseUrl": "https://tap-api-v2.proofpoint.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Proofpoint TAP at https://threatinsight.proofpoint.com\n2. Go to Settings → Connected Applications\n3. Create a new Service Principal\n4. Base64 encode 'service_principal:secret': echo -n 'principal:secret' | base64\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'service_principal:secret'. Found in Proofpoint TAP dashboard → Settings → Connected Applications. Command: echo -n 'principal:secret' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "proofpoint_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Proofpoint email security is active and detecting threats",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "proofpoint_incident_response",
+      "name": "Incident Response",
+      "description": "Reviews Proofpoint threat detections for incident response readiness",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pulumi-cloud.json b/integrations-catalog/integrations/pulumi-cloud.json
new file mode 100644
index 0000000000..5e7368f1ba
--- /dev/null
+++ b/integrations-catalog/integrations/pulumi-cloud.json
@@ -0,0 +1,35 @@
+{
+  "slug": "pulumi-cloud",
+  "name": "Pulumi Cloud",
+  "description": "Infrastructure as code platform. Monitor stacks and deployments.",
+  "category": "Infrastructure",
+  "docsUrl": "https://www.pulumi.com/docs/pulumi-cloud/reference/",
+  "baseUrl": "https://api.pulumi.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pulumi_cloud_app_availability",
+      "name": "Pulumi Cloud App Availability",
+      "description": "Checks Pulumi Cloud app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pulumi_cloud_employee_access",
+      "name": "Pulumi Cloud Employee Access",
+      "description": "Checks Pulumi Cloud employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pulumi.json b/integrations-catalog/integrations/pulumi.json
new file mode 100644
index 0000000000..07e183df8f
--- /dev/null
+++ b/integrations-catalog/integrations/pulumi.json
@@ -0,0 +1,35 @@
+{
+  "slug": "pulumi",
+  "name": "Pulumi",
+  "description": "Monitor Pulumi infrastructure-as-code stacks for cloud infrastructure compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://www.pulumi.com/docs/reference/service-rest-api/",
+  "baseUrl": "https://api.pulumi.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pulumi_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Pulumi stacks for IaC infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pulumi_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Pulumi has separate stacks for different environments",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/pylon.json b/integrations-catalog/integrations/pylon.json
new file mode 100644
index 0000000000..1c1ebfc2ed
--- /dev/null
+++ b/integrations-catalog/integrations/pylon.json
@@ -0,0 +1,45 @@
+{
+  "slug": "pylon",
+  "name": "Pylon",
+  "description": "Monitor Pylon customer operations platform for support access and B2B communication compliance",
+  "category": "Communication",
+  "docsUrl": "https://docs.usepylon.com/api-reference",
+  "baseUrl": "https://api.usepylon.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Pylon at https://app.usepylon.com\n2. Go to Settings → API\n3. Generate a new API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Pylon Settings → API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "pylon_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Pylon users with access to customer operations data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "pylon_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Pylon customer operations platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/qase.json b/integrations-catalog/integrations/qase.json
new file mode 100644
index 0000000000..2b0eb43c98
--- /dev/null
+++ b/integrations-catalog/integrations/qase.json
@@ -0,0 +1,35 @@
+{
+  "slug": "qase",
+  "name": "Qase",
+  "description": "Monitor Qase test management — verify test cases and QA coverage for software quality compliance",
+  "category": "Development",
+  "docsUrl": "https://developers.qase.io/reference/",
+  "baseUrl": "https://api.qase.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "qase_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Qase test projects are configured with test suites documenting software changes",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "qase_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies Qase test runs are executed regularly to validate code quality",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/qonto.json b/integrations-catalog/integrations/qonto.json
new file mode 100644
index 0000000000..e497709aaf
--- /dev/null
+++ b/integrations-catalog/integrations/qonto.json
@@ -0,0 +1,38 @@
+{
+  "slug": "qonto",
+  "name": "Qonto",
+  "description": "Qonto business finance platform for European companies",
+  "category": "HR & People",
+  "docsUrl": "https://api-doc.qonto.com",
+  "baseUrl": "https://thirdparty.qonto.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Qonto\n2. Go to Settings → Integrations\n3. Copy your API key (format: login:secret_key)\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Qonto → Settings → Integrations → API Key (format: login:secret_key)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "qonto_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Qonto organization members to verify financial access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/qovery.json b/integrations-catalog/integrations/qovery.json
new file mode 100644
index 0000000000..9059c82f2d
--- /dev/null
+++ b/integrations-catalog/integrations/qovery.json
@@ -0,0 +1,35 @@
+{
+  "slug": "qovery",
+  "name": "Qovery",
+  "description": "Cloud deployment platform for developers. Monitor organizations and environments.",
+  "category": "Infrastructure",
+  "docsUrl": "https://api-doc.qovery.com",
+  "baseUrl": "https://api.qovery.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "qovery_app_availability",
+      "name": "Qovery App Availability",
+      "description": "Checks that the Qovery API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "qovery_employee_access",
+      "name": "Qovery Employee Access",
+      "description": "Verifies employee access to Qovery via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/qualtrics.json b/integrations-catalog/integrations/qualtrics.json
new file mode 100644
index 0000000000..0b5099c650
--- /dev/null
+++ b/integrations-catalog/integrations/qualtrics.json
@@ -0,0 +1,44 @@
+{
+  "slug": "qualtrics",
+  "name": "Qualtrics",
+  "description": "Qualtrics experience management platform for employee and customer surveys",
+  "category": "HR & People",
+  "docsUrl": "https://api.qualtrics.com/",
+  "baseUrl": "https://{{credentials.datacenter_id}}.qualtrics.com/API/v3",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Qualtrics\n2. Go to Account Settings → Qualtrics IDs\n3. Copy your API Token\n4. Your datacenter ID is in your account URL (e.g. iad1.qualtrics.com → iad1)\n5. Enter both values below",
+      "credentialFields": [
+        {
+          "label": "Datacenter ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Qualtrics datacenter ID (e.g. iad1, fra1, syd1). Found in your account URL."
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate an API token in Qualtrics → Account Settings → Qualtrics IDs → API Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "qualtrics_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Qualtrics users to verify access is properly managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/qualys.json b/integrations-catalog/integrations/qualys.json
new file mode 100644
index 0000000000..c6f84362aa
--- /dev/null
+++ b/integrations-catalog/integrations/qualys.json
@@ -0,0 +1,70 @@
+{
+  "slug": "qualys",
+  "name": "Qualys VMDR",
+  "description": "Vulnerability management, detection, and response platform. Monitor vulnerability scans, asset inventory, and security compliance.",
+  "category": "Security",
+  "docsUrl": "https://docs.qualys.com/en/vm/api/index.htm",
+  "baseUrl": "https://{{credentials.region}}/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Qualys account username"
+        },
+        {
+          "label": "Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Qualys account password"
+        },
+        {
+          "label": "API URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your service region (e.g., us, eu, ap)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vulnerability_scan_coverage",
+      "name": "Vulnerability Scan Coverage",
+      "description": "Verify that vulnerability scans are being performed regularly on all assets",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "asset_inventory_completeness",
+      "name": "Asset Inventory Completeness",
+      "description": "Ensure all network assets are properly inventoried and tracked in Qualys",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "critical_vulnerability_response",
+      "name": "Critical Vulnerability Response",
+      "description": "Monitor response time and remediation status for critical vulnerabilities",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "security_audit_logging",
+      "name": "Security Audit Logging",
+      "description": "Ensure security events and administrative actions are properly logged and audited",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/quave-cloud.json b/integrations-catalog/integrations/quave-cloud.json
new file mode 100644
index 0000000000..c95c4ea891
--- /dev/null
+++ b/integrations-catalog/integrations/quave-cloud.json
@@ -0,0 +1,70 @@
+{
+  "slug": "quave-cloud",
+  "name": "Quave Cloud",
+  "description": "Monitor security settings and app environments in Quave Cloud",
+  "category": "Cloud",
+  "docsUrl": "https://docs.quave.cloud/public-api/get-started",
+  "baseUrl": "https://api.quave.cloud/api/public/v1/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Your user token from Quave Cloud Profile page."
+        },
+        {
+          "label": "Account ID (leave blank to check all accounts)",
+          "type": "text",
+          "required": false,
+          "helpText": "To scope checks to a single account, paste your Account ID here. Find it in Quave Cloud dashboard. Leave blank to scan all accounts."
+        },
+        {
+          "label": "App IDs (optional - comma-separated)",
+          "type": "text",
+          "required": false,
+          "helpText": "To check only specific apps or environments, enter their App IDs or App Env IDs separated by commas. Leave blank to check all."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "quave_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Quave Cloud accounts accessible with the provided token",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "quave_app_availability",
+      "name": "App Availability",
+      "description": "Checks SSL, firewall, and security settings for all app environments",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "quave_tls_https",
+      "name": "TLS / HTTPS",
+      "description": "Verifies SSL/TLS is enabled on all app environments",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "quave_firewall",
+      "name": "Production Firewall",
+      "description": "Verifies restricted network policy is enabled on all app environments",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/quickbooks-online.json b/integrations-catalog/integrations/quickbooks-online.json
new file mode 100644
index 0000000000..bce0470769
--- /dev/null
+++ b/integrations-catalog/integrations/quickbooks-online.json
@@ -0,0 +1,35 @@
+{
+  "slug": "quickbooks-online",
+  "name": "QuickBooks Online",
+  "description": "Monitor QuickBooks Online employee records and access for HR compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.intuit.com/app/developer/qbo/docs/api/accounting/all-entities/employee",
+  "baseUrl": "https://quickbooks.api.intuit.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Create an app at https://developer.intuit.com\n2. Set environment to Production\n3. Add redirect URI: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Copy Client ID and Client Secret to Comp AI admin panel\n5. After connecting, enter your QuickBooks Company ID (found in the URL when logged into QuickBooks Online)",
+      "scopes": [
+        "com.intuit.quickbooks.accounting"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "qbo_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews QuickBooks Online employee records and verifies active vs terminated status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/railway.json b/integrations-catalog/integrations/railway.json
new file mode 100644
index 0000000000..72d6c4de2d
--- /dev/null
+++ b/integrations-catalog/integrations/railway.json
@@ -0,0 +1,45 @@
+{
+  "slug": "railway",
+  "name": "Railway",
+  "description": "Railway cloud deployment platform for apps and databases",
+  "category": "Infrastructure",
+  "docsUrl": "https://docs.railway.com/integrations/api",
+  "baseUrl": "https://backboard.railway.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Railway\n2. Go to Account Settings → Tokens\n3. Create a new token (choose Account token for full access)\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Railway → Account Settings → Tokens → Create a new token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "railway_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Railway is connected and confirms the authenticated user identity",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "railway_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Railway platform is accessible and lists projects",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ramp.json b/integrations-catalog/integrations/ramp.json
new file mode 100644
index 0000000000..8ce9220534
--- /dev/null
+++ b/integrations-catalog/integrations/ramp.json
@@ -0,0 +1,34 @@
+{
+  "slug": "ramp",
+  "name": "Ramp",
+  "description": "Monitor Ramp user access and employee listing",
+  "category": "Productivity",
+  "docsUrl": "https://docs.ramp.com/developer-api",
+  "baseUrl": "https://api.ramp.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "scopes": [
+        "users:read"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ramp_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all active Ramp users with their roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/rapid7.json b/integrations-catalog/integrations/rapid7.json
new file mode 100644
index 0000000000..b80b62786b
--- /dev/null
+++ b/integrations-catalog/integrations/rapid7.json
@@ -0,0 +1,51 @@
+{
+  "slug": "rapid7",
+  "name": "Rapid7",
+  "description": "Rapid7 InsightVM vulnerability management",
+  "category": "Security",
+  "docsUrl": "https://docs.rapid7.com/insight/",
+  "baseUrl": "https://us.api.insight.rapid7.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to insight.rapid7.com\n2. Manage Platform → API Keys\n3. Create a new API key\n4. Enter your region (us, eu, ca, etc.)",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "insight.rapid7.com → Manage Platform → API Keys"
+        },
+        {
+          "label": "Region",
+          "type": "text",
+          "required": false,
+          "helpText": "Your Insight Platform region: us, us2, us3, eu, ca, au, ap (default: us)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "rapid7_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Rapid7 platform users to verify access is properly managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rapid7_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Rapid7 InsightVM has active vulnerability scans configured",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/readme.json b/integrations-catalog/integrations/readme.json
new file mode 100644
index 0000000000..855ffe0ec3
--- /dev/null
+++ b/integrations-catalog/integrations/readme.json
@@ -0,0 +1,45 @@
+{
+  "slug": "readme",
+  "name": "ReadMe",
+  "description": "ReadMe developer hub and API documentation platform",
+  "category": "Development",
+  "docsUrl": "https://docs.readme.com/main/reference",
+  "baseUrl": "https://dash.readme.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to ReadMe\n2. Go to Configuration → API Key\n3. Copy your API key\n4. Paste it below as Basic Auth: run echo -n 'YOUR_API_KEY:' | base64 (or just paste the key — ReadMe supports it as Basic username)",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "ReadMe → Configuration → API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "readme_app_availability",
+      "name": "App Availability",
+      "description": "Verifies ReadMe documentation hub is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "readme_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies ReadMe project access and team management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/recurly.json b/integrations-catalog/integrations/recurly.json
new file mode 100644
index 0000000000..ad1be80d72
--- /dev/null
+++ b/integrations-catalog/integrations/recurly.json
@@ -0,0 +1,51 @@
+{
+  "slug": "recurly",
+  "name": "Recurly",
+  "description": "Monitor Recurly subscription billing platform for account access and payment data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.recurly.com/api/v2021-02-25/",
+  "baseUrl": "https://v3.recurly.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Recurly at https://app.recurly.com\n2. Go to Admin → Integrations → API Credentials\n3. Copy your Private API Key\n4. Base64 encode 'api_key:' (with trailing colon): echo -n 'apikey:' | base64\n5. Enter your subdomain and encoded key below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'your_api_key:' (with trailing colon). Found in Recurly Admin → Integrations → API Credentials. Command: echo -n 'apikey:' | base64"
+        },
+        {
+          "label": "Site Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Recurly site subdomain (e.g. mycompany)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "recurly_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Recurly users with access to subscription billing data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "recurly_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Recurly platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/redis-cloud.json b/integrations-catalog/integrations/redis-cloud.json
new file mode 100644
index 0000000000..8452ccb704
--- /dev/null
+++ b/integrations-catalog/integrations/redis-cloud.json
@@ -0,0 +1,51 @@
+{
+  "slug": "redis-cloud",
+  "name": "Redis Cloud",
+  "description": "Managed Redis database service. Monitor subscriptions and database instances.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.redis.com/latest/rc/api/",
+  "baseUrl": "https://api.redislabs.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Redis Cloud at https://app.redislabs.com\n2. Go to Access Management → API Keys\n3. Copy your Account Key and Secret Key\n4. Paste both below",
+      "credentialFields": [
+        {
+          "label": "Account Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Redis Cloud console → Access Management → API Keys → Account Key"
+        },
+        {
+          "label": "User Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "The secret key associated with your account key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "redis_cloud_app_availability",
+      "name": "Redis Cloud App Availability",
+      "description": "Checks that the Redis Cloud API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "redis_cloud_employee_access",
+      "name": "Redis Cloud Employee Access",
+      "description": "Verifies employee access to Redis Cloud.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/remote.json b/integrations-catalog/integrations/remote.json
new file mode 100644
index 0000000000..b186ed1d78
--- /dev/null
+++ b/integrations-catalog/integrations/remote.json
@@ -0,0 +1,35 @@
+{
+  "slug": "remote",
+  "name": "Remote",
+  "description": "Global HR platform for distributed teams. Monitor employee records.",
+  "category": "HR & People",
+  "docsUrl": "https://gateway.remote.com/v1/docs",
+  "baseUrl": "https://gateway.remote.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "remote_app_availability",
+      "name": "Remote App Availability",
+      "description": "Checks Remote app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "remote_employee_access",
+      "name": "Remote Employee Access",
+      "description": "Checks Remote employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/render.json b/integrations-catalog/integrations/render.json
new file mode 100644
index 0000000000..fbb6da44ff
--- /dev/null
+++ b/integrations-catalog/integrations/render.json
@@ -0,0 +1,35 @@
+{
+  "slug": "render",
+  "name": "Render",
+  "description": "Monitor Render services and environment groups for cloud infrastructure compliance",
+  "category": "Cloud",
+  "docsUrl": "https://api-docs.render.com/reference/introduction",
+  "baseUrl": "https://api.render.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "render_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Render services are running and not suspended",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "render_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Render has environment groups configured for secret management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/replicate.json b/integrations-catalog/integrations/replicate.json
new file mode 100644
index 0000000000..f220501057
--- /dev/null
+++ b/integrations-catalog/integrations/replicate.json
@@ -0,0 +1,45 @@
+{
+  "slug": "replicate",
+  "name": "Replicate",
+  "description": "Replicate cloud platform for running and deploying AI models",
+  "category": "Development",
+  "docsUrl": "https://replicate.com/docs/reference/http",
+  "baseUrl": "https://api.replicate.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Replicate\n2. Go to Account Settings → API Tokens\n3. Create or copy your API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Replicate → Account Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "replicate_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Replicate AI platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "replicate_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Replicate deployments to verify AI access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/resend.json b/integrations-catalog/integrations/resend.json
new file mode 100644
index 0000000000..ed1b4b1546
--- /dev/null
+++ b/integrations-catalog/integrations/resend.json
@@ -0,0 +1,45 @@
+{
+  "slug": "resend",
+  "name": "Resend",
+  "description": "Monitor Resend email infrastructure for domain authentication and TLS compliance",
+  "category": "Communication",
+  "docsUrl": "https://resend.com/docs/api-reference/introduction",
+  "baseUrl": "https://api.resend.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Resend at https://resend.com\n2. Go to API Keys\n3. Create a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Resend Dashboard → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "resend_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Resend platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "resend_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Resend API keys for proper access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/retool.json b/integrations-catalog/integrations/retool.json
new file mode 100644
index 0000000000..93d99f77e5
--- /dev/null
+++ b/integrations-catalog/integrations/retool.json
@@ -0,0 +1,45 @@
+{
+  "slug": "retool",
+  "name": "Retool",
+  "description": "Monitor Retool internal tools for user access and role-based permissions compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.retool.com/reference/api",
+  "baseUrl": "https://api.retool.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Retool at https://retool.com\n2. Go to Settings → API\n3. Create an API token (requires Business or Enterprise plan)\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Retool Settings → API. Requires Business or Enterprise plan."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "retool_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Retool users and their access to internal tools",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "retool_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies Retool groups are configured for role-based access to internal tools",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ringcentral.json b/integrations-catalog/integrations/ringcentral.json
new file mode 100644
index 0000000000..750b45d670
--- /dev/null
+++ b/integrations-catalog/integrations/ringcentral.json
@@ -0,0 +1,42 @@
+{
+  "slug": "ringcentral",
+  "name": "RingCentral",
+  "description": "Monitor RingCentral user access, roles, and employee directory for compliance",
+  "category": "Communication",
+  "docsUrl": "https://developers.ringcentral.com/api-reference",
+  "baseUrl": "https://platform.ringcentral.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "scopes": [
+        "ReadAccounts"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all RingCentral user extensions and their access status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Lists all RingCentral user roles including custom roles and their permissions",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/rippling.json b/integrations-catalog/integrations/rippling.json
new file mode 100644
index 0000000000..945e9946c9
--- /dev/null
+++ b/integrations-catalog/integrations/rippling.json
@@ -0,0 +1,35 @@
+{
+  "slug": "rippling",
+  "name": "Rippling",
+  "description": "Monitor Rippling employee records and workforce data for HR compliance",
+  "category": "HR & People",
+  "docsUrl": "https://developer.rippling.com/docs",
+  "baseUrl": "https://api.rippling.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "rippling_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Rippling employees and verifies active workforce records",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rippling_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies Rippling employee records are complete",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/roboflow.json b/integrations-catalog/integrations/roboflow.json
new file mode 100644
index 0000000000..8bee103fd5
--- /dev/null
+++ b/integrations-catalog/integrations/roboflow.json
@@ -0,0 +1,35 @@
+{
+  "slug": "roboflow",
+  "name": "Roboflow",
+  "description": "Computer vision AI platform for building and deploying models. Monitor workspace access.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.roboflow.com",
+  "baseUrl": "https://api.roboflow.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "roboflow_app_availability",
+      "name": "Roboflow App Availability",
+      "description": "Checks that the Roboflow API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "roboflow_employee_access",
+      "name": "Roboflow Employee Access",
+      "description": "Verifies employee access to Roboflow via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/rollbar.json b/integrations-catalog/integrations/rollbar.json
new file mode 100644
index 0000000000..c73eae5083
--- /dev/null
+++ b/integrations-catalog/integrations/rollbar.json
@@ -0,0 +1,35 @@
+{
+  "slug": "rollbar",
+  "name": "Rollbar",
+  "description": "Monitor Rollbar error tracking and alert configuration for incident response compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://explorer.docs.rollbar.com",
+  "baseUrl": "https://api.rollbar.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "rollbar_app_availability",
+      "name": "App Availability",
+      "description": "Checks Rollbar for critical active errors indicating availability issues",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "rollbar_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies Rollbar has notifications configured for incident response",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/rootly.json b/integrations-catalog/integrations/rootly.json
new file mode 100644
index 0000000000..859dfe5df2
--- /dev/null
+++ b/integrations-catalog/integrations/rootly.json
@@ -0,0 +1,45 @@
+{
+  "slug": "rootly",
+  "name": "Rootly",
+  "description": "Monitor Rootly incident management for incident response workflows and on-call coverage",
+  "category": "Monitoring",
+  "docsUrl": "https://rootly.com/api",
+  "baseUrl": "https://api.rootly.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Rootly at https://rootly.com\n2. Go to Settings → API Keys\n3. Generate a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Rootly Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "rootly_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies Rootly incident workflows are configured for structured response procedures",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rootly_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Reviews Rootly incidents to verify active monitoring and alerting is in place",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/rubrik.json b/integrations-catalog/integrations/rubrik.json
new file mode 100644
index 0000000000..3f0d29b0ce
--- /dev/null
+++ b/integrations-catalog/integrations/rubrik.json
@@ -0,0 +1,63 @@
+{
+  "slug": "rubrik",
+  "name": "Rubrik",
+  "description": "Monitor Rubrik Security Cloud backup policies, protected infrastructure, and security events for compliance evidence",
+  "category": "Security",
+  "docsUrl": "https://developer.rubrik.com/Rubrik-Security-Cloud-API/",
+  "baseUrl": "https://example.my.rubrik.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "RSC URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Rubrik Security Cloud URL, e.g. mycompany.my.rubrik.com (without https://)"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Service account Client ID from RSC Settings > Service Accounts"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Service account Client Secret from RSC Settings > Service Accounts"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "backup_policies",
+      "name": "Backup Logs",
+      "description": "Verifies SLA Domain backup policies are configured with snapshot schedules in Rubrik Security Cloud",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists protected objects and workloads managed by Rubrik Security Cloud for infrastructure inventory evidence",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Checks for critical and warning events and alerts in Rubrik Security Cloud",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/rudderstack.json b/integrations-catalog/integrations/rudderstack.json
new file mode 100644
index 0000000000..67e5bd9b3e
--- /dev/null
+++ b/integrations-catalog/integrations/rudderstack.json
@@ -0,0 +1,35 @@
+{
+  "slug": "rudderstack",
+  "name": "RudderStack",
+  "description": "Customer data platform for event streaming and data routing. Monitor data sources.",
+  "category": "Monitoring",
+  "docsUrl": "https://www.rudderstack.com/docs/api/",
+  "baseUrl": "https://api.rudderstack.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "rudderstack_app_availability",
+      "name": "RudderStack App Availability",
+      "description": "Checks that the RudderStack API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rudderstack_employee_access",
+      "name": "RudderStack Employee Access",
+      "description": "Verifies employee access to RudderStack via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sage-accounting.json b/integrations-catalog/integrations/sage-accounting.json
new file mode 100644
index 0000000000..4e155f99e2
--- /dev/null
+++ b/integrations-catalog/integrations/sage-accounting.json
@@ -0,0 +1,45 @@
+{
+  "slug": "sage-accounting",
+  "name": "Sage Accounting",
+  "description": "Sage Business Cloud Accounting for financial management and reporting",
+  "category": "Productivity",
+  "docsUrl": "https://developer.sage.com/accounting",
+  "baseUrl": "https://api.accounting.sage.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Register your app at developer.sage.com\n2. Complete the OAuth2 authorization flow\n3. Paste the access token below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Sage Developer Portal → My Apps → OAuth Access Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sage_accounting_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Sage Accounting is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sage_accounting_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Sage Accounting contacts and users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sage-hr.json b/integrations-catalog/integrations/sage-hr.json
new file mode 100644
index 0000000000..eba8534bdb
--- /dev/null
+++ b/integrations-catalog/integrations/sage-hr.json
@@ -0,0 +1,52 @@
+{
+  "slug": "sage-hr",
+  "name": "Sage HR",
+  "description": "HR management platform (formerly CakeHR) for employee records, leave management, and team organization.",
+  "category": "HR & People",
+  "docsUrl": "https://sagehr.docs.apiary.io/",
+  "baseUrl": "https://example.sage.hr",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Sage HR\n2. Go to Settings > Integrations > API\n3. Click 'Enable API Access' to generate your API key\n4. Enter your subdomain (from your Sage HR URL) and API key below",
+      "credentialFields": [
+        {
+          "label": "Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Sage HR subdomain. If your URL is https://acme.sage.hr, enter 'acme'."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Sage HR > Settings > Integrations > API > Enable API Access."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "sage_hr_employee_access",
+      "name": "Sage HR Employee Access",
+      "description": "Verifies that employee records can be accessed via the Sage HR API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sage_hr_role_based_access",
+      "name": "Sage HR Role-based Access Controls",
+      "description": "Verifies that teams and positions are assigned to employees for role-based access controls.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sailpoint.json b/integrations-catalog/integrations/sailpoint.json
new file mode 100644
index 0000000000..aeab2a4806
--- /dev/null
+++ b/integrations-catalog/integrations/sailpoint.json
@@ -0,0 +1,58 @@
+{
+  "slug": "sailpoint",
+  "name": "SailPoint IdentityNow",
+  "description": "Identity governance and administration platform. Monitor user access, roles, and compliance.",
+  "category": "Identity & Access",
+  "docsUrl": "https://developer.sailpoint.com/docs/api/",
+  "baseUrl": "https://tenant.api.identitynow.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to SailPoint IdentityNow\n2. Go to Preferences → Personal Access Tokens\n3. Create a new token with appropriate scope (sp:scopes:all for full access)\n4. Copy the Client ID and Client Secret\n5. Enter your tenant name from your URL\n6. Paste all values below",
+      "credentialFields": [
+        {
+          "label": "Tenant Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your SailPoint tenant name from your URL: https://{tenant}.identitynow.com"
+        },
+        {
+          "label": "PAT Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "From a Personal Access Token in SailPoint → Preferences → Personal Access Tokens."
+        },
+        {
+          "label": "PAT Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Shown once when creating the Personal Access Token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "sailpoint_app_availability",
+      "name": "SailPoint App Availability",
+      "description": "Verifies SailPoint IdentityNow API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sailpoint_employee_access",
+      "name": "SailPoint Identity Access",
+      "description": "Verifies identity directory access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/salesforce.json b/integrations-catalog/integrations/salesforce.json
new file mode 100644
index 0000000000..24fe4f99c9
--- /dev/null
+++ b/integrations-catalog/integrations/salesforce.json
@@ -0,0 +1,44 @@
+{
+  "slug": "salesforce",
+  "name": "Salesforce",
+  "description": "Monitor Salesforce user access and contact data management for CRM compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.salesforce.com/docs/apis",
+  "baseUrl": "https://login.salesforce.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to Salesforce > Setup > App Manager > New Connected App\n2. Enable OAuth Settings\n3. Set callback URL to: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Add scopes: Access (api), ID (id), Offline (offline_access)\n5. Copy Consumer Key (Client ID) and Secret\n6. After connecting, enter your Salesforce instance URL (e.g. https://yourorg.my.salesforce.com)",
+      "scopes": [
+        "id",
+        "api",
+        "offline_access"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "salesforce_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Salesforce users and verifies only active users have access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "salesforce_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Salesforce contact records are maintained",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/salesloft.json b/integrations-catalog/integrations/salesloft.json
new file mode 100644
index 0000000000..1678e0905e
--- /dev/null
+++ b/integrations-catalog/integrations/salesloft.json
@@ -0,0 +1,45 @@
+{
+  "slug": "salesloft",
+  "name": "Salesloft",
+  "description": "Monitor Salesloft sales engagement platform for team access and communication compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.salesloft.com/api.html",
+  "baseUrl": "https://api.salesloft.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Salesloft at https://app.salesloft.com\n2. Go to your Profile → API Keys\n3. Create a new API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Salesloft Profile → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "salesloft_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Salesloft users with access to the sales platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "salesloft_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Salesloft cadence activity is tracked for compliance",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sanity.json b/integrations-catalog/integrations/sanity.json
new file mode 100644
index 0000000000..c6a6e318a6
--- /dev/null
+++ b/integrations-catalog/integrations/sanity.json
@@ -0,0 +1,45 @@
+{
+  "slug": "sanity",
+  "name": "Sanity",
+  "description": "Monitor Sanity headless CMS projects for team access and content infrastructure compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.sanity.io/docs/http-api",
+  "baseUrl": "https://api.sanity.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Sanity at https://manage.sanity.io\n2. Go to API → Tokens\n3. Create a token with Viewer or higher permissions\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Sanity manage.sanity.io → API → Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sanity_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Sanity projects for content infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sanity_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Sanity project members and their content management access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sap-concur.json b/integrations-catalog/integrations/sap-concur.json
new file mode 100644
index 0000000000..00cebcafde
--- /dev/null
+++ b/integrations-catalog/integrations/sap-concur.json
@@ -0,0 +1,57 @@
+{
+  "slug": "sap-concur",
+  "name": "SAP Concur",
+  "description": "Monitor employee access and sync users from SAP Concur expense management platform",
+  "category": "Productivity",
+  "docsUrl": "https://developer.concur.com/api-reference/profile/v4.identity.html",
+  "baseUrl": "https://us2.api.concursolutions.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Sign in to SAP Concur at https://www.concursolutions.com\n2. Go to Administration > Company > Authentication Admin\n3. Click 'Manage Apps' to create or manage OAuth2 applications\n4. Create a new app with scopes: user.provision.read, identity.user.core.read, identity.user.enterprise.read\n5. Copy the Client ID and Client Secret\n6. Enter your datacenter prefix (found in your Concur URL, e.g. us2 for US, eu2 for EU, apj1 for Asia-Pacific)\n7. Optionally enter your Company UUID from Administration > Company > Company Profile\n8. Paste all values below",
+      "credentialFields": [
+        {
+          "label": "Datacenter",
+          "type": "text",
+          "required": true,
+          "helpText": "Your SAP Concur datacenter prefix. Common values: us2 (US), eu2 (EU), apj1 (Asia-Pacific), usg (Government). Found in your Concur URL or the geolocation field from your OAuth token response."
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in SAP Concur Administration > Company > Authentication Admin > Manage Apps. Create an OAuth2 app or use an existing Client ID."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "The Client Secret from your registered OAuth2 application in SAP Concur."
+        },
+        {
+          "label": "Company UUID",
+          "type": "text",
+          "required": false,
+          "helpText": "Your SAP Concur company UUID. Found in Administration > Company > Company Profile, or from the companyId field in the SCIM user enterprise extension."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all SAP Concur users and verifies active account status for compliance evidence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sap-successfactors.json b/integrations-catalog/integrations/sap-successfactors.json
new file mode 100644
index 0000000000..14d9fb7f4d
--- /dev/null
+++ b/integrations-catalog/integrations/sap-successfactors.json
@@ -0,0 +1,64 @@
+{
+  "slug": "sap-successfactors",
+  "name": "SAP SuccessFactors",
+  "description": "Monitor employee access, role-based permissions, and sync employee records from SAP SuccessFactors HCM platform",
+  "category": "HR & People",
+  "docsUrl": "https://help.sap.com/docs/successfactors-platform/sap-successfactors-api-reference-guide-odata-v2",
+  "baseUrl": "https://api.successfactors.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. In Admin Center, go to Manage OAuth2 Client Applications or ensure OData API Basic Authentication is enabled for your company\n2. Create or identify a technical API user\n3. Grant the user Role-Based Permissions: View Users, Employee Central HRIS OData API, Manage Permission Roles (read)\n4. Find your Company ID from the login page (the company field)\n5. Find your API URL based on your data center:\n   - US DC4: https://api4.successfactors.com\n   - EU DC2: https://api2.successfactors.eu\n   - DC8: https://api8.successfactors.com\n   - DC10: https://api10.successfactors.com\n   - See SAP Note 2215682 for all data center URLs",
+      "credentialFields": [
+        {
+          "label": "API Base URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your SuccessFactors API URL for your data center. Examples: US DC4 = https://api4.successfactors.com, EU DC2 = https://api2.successfactors.eu, DC8 = https://api8.successfactors.com. Find in Admin Center > Company Settings."
+        },
+        {
+          "label": "Company ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your SuccessFactors Company ID (visible on the login page or in Admin Center)."
+        },
+        {
+          "label": "API Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Technical user with OData API access and RBP permissions for User entity and RBP roles."
+        },
+        {
+          "label": "Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Password for the API user."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Verifies active employees in SAP SuccessFactors have complete profiles with email and name fields",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access_controls",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that Role-Based Permission (RBP) roles are configured in SAP SuccessFactors to enforce least-privilege access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/saviynt.json b/integrations-catalog/integrations/saviynt.json
new file mode 100644
index 0000000000..d8bad814c4
--- /dev/null
+++ b/integrations-catalog/integrations/saviynt.json
@@ -0,0 +1,65 @@
+{
+  "slug": "saviynt",
+  "name": "Saviynt",
+  "description": "Identity governance and administration (IGA) platform. Monitor employee access, role-based access controls, and access review campaigns.",
+  "category": "Identity & Access",
+  "docsUrl": "https://developers.saviynt.com/apis/rest/",
+  "baseUrl": "https://example.saviyntcloud.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Saviynt EIC instance as an admin\n2. Create or identify a service account with API access\n3. Navigate to Admin > Settings > Webservice Auth Configuration\n4. Ensure the service account has read permissions for Users, Roles, and Campaigns APIs\n5. Enter your instance URL (e.g. https://yourcompany.saviyntcloud.com), username, and password below",
+      "credentialFields": [
+        {
+          "label": "Instance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Saviynt instance URL, e.g. https://yourcompany.saviyntcloud.com (no trailing slash)"
+        },
+        {
+          "label": "Service Account Username",
+          "type": "text",
+          "required": true,
+          "helpText": "API service account username with webservice access permissions."
+        },
+        {
+          "label": "Service Account Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Password for the API service account."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "saviynt_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies that employee user accounts can be retrieved from Saviynt, confirming identity directory access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "saviynt_role_based_access_controls",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that roles are configured in Saviynt for role-based access governance.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "saviynt_access_review_log",
+      "name": "Access Review Log",
+      "description": "Verifies that access review campaigns exist in Saviynt, confirming periodic access certifications are performed.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/scalefusion.json b/integrations-catalog/integrations/scalefusion.json
new file mode 100644
index 0000000000..1a431bbd24
--- /dev/null
+++ b/integrations-catalog/integrations/scalefusion.json
@@ -0,0 +1,35 @@
+{
+  "slug": "scalefusion",
+  "name": "Scalefusion",
+  "description": "Unified endpoint management and MDM platform. Monitor managed devices and compliance.",
+  "category": "Security",
+  "docsUrl": "https://docs.scalefusion.com/",
+  "baseUrl": "https://api.scalefusion.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "scalefusion_app_availability",
+      "name": "Scalefusion App Availability",
+      "description": "Verifies Scalefusion API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "scalefusion_employee_access",
+      "name": "Scalefusion Device Access",
+      "description": "Verifies device management access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/scaleway.json b/integrations-catalog/integrations/scaleway.json
new file mode 100644
index 0000000000..54f9c50fb2
--- /dev/null
+++ b/integrations-catalog/integrations/scaleway.json
@@ -0,0 +1,51 @@
+{
+  "slug": "scaleway",
+  "name": "Scaleway",
+  "description": "Monitor Scaleway EU cloud infrastructure and user access for compliance",
+  "category": "Cloud",
+  "docsUrl": "https://www.scaleway.com/en/developers/api/",
+  "baseUrl": "https://api.scaleway.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Scaleway Console at https://console.scaleway.com\n2. Go to IAM → API Keys\n3. Generate an API key with Read access\n4. Copy the Secret Key and enter it below",
+      "credentialFields": [
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "The Secret Key from your Scaleway IAM API Key (not the Access Key ID)."
+        },
+        {
+          "label": "Organization ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Scaleway Console → Organization → Settings → Organization ID"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "scaleway_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Scaleway projects for cloud infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "scaleway_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Scaleway IAM users and their access to infrastructure",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/secureframe.json b/integrations-catalog/integrations/secureframe.json
new file mode 100644
index 0000000000..03806eeb44
--- /dev/null
+++ b/integrations-catalog/integrations/secureframe.json
@@ -0,0 +1,35 @@
+{
+  "slug": "secureframe",
+  "name": "Secureframe",
+  "description": "Security compliance automation platform. Monitor compliance posture and controls.",
+  "category": "Security",
+  "docsUrl": "https://developers.secureframe.com/",
+  "baseUrl": "https://api.secureframe.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secureframe_app_availability",
+      "name": "Secureframe App Availability",
+      "description": "Checks that the Secureframe API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secureframe_employee_access",
+      "name": "Secureframe Employee Access",
+      "description": "Verifies access to Secureframe.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/securityscorecard.json b/integrations-catalog/integrations/securityscorecard.json
new file mode 100644
index 0000000000..be50367ac9
--- /dev/null
+++ b/integrations-catalog/integrations/securityscorecard.json
@@ -0,0 +1,72 @@
+{
+  "slug": "securityscorecard",
+  "name": "SecurityScorecard",
+  "description": "Monitor vendor risk scores, security factors, portfolio health, and breach events via SecurityScorecard's security ratings platform",
+  "category": "Security",
+  "docsUrl": "https://securityscorecard.readme.io/reference",
+  "baseUrl": "https://api.securityscorecard.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to SecurityScorecard at platform.securityscorecard.io\n2. Click your profile avatar and select My Settings\n3. On the People Management tab under Admin Settings, click Invite People\n4. Toggle the user to a bot user and set Access Level (Read Only is sufficient)\n5. Click Add User\n6. Click Create API token for the new bot user, confirm, and copy the token\n7. Enter your company primary domain (the one tracked in SecurityScorecard)",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Bot User API token from SecurityScorecard. Go to My Settings > Users > Add User (bot user) > Create Token."
+        },
+        {
+          "label": "Your Company Domain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your company's primary domain in SecurityScorecard (e.g., trycomp.ai). Used for self-assessment checks."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "securityscorecard_app_availability",
+      "name": "App Availability",
+      "description": "Verifies connectivity to the SecurityScorecard API by fetching the company scorecard for your domain",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "securityscorecard_vendor_risk_score",
+      "name": "Vendor Risk Score",
+      "description": "Retrieves the overall security scorecard grade and score for your company's domain",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "securityscorecard_portfolio_monitoring",
+      "name": "Vendor Portfolio Monitoring",
+      "description": "Lists all portfolios and their vendors, flagging any vendor with a grade below C (score below 70)",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "securityscorecard_factor_analysis",
+      "name": "Security Factor Analysis",
+      "description": "Analyzes individual security factor scores for your domain and flags any factor with a grade below C",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "securityscorecard_breach_monitoring",
+      "name": "Breach Monitoring",
+      "description": "Checks for recent breach events reported against your company's domain in the last 90 days",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/segment.json b/integrations-catalog/integrations/segment.json
new file mode 100644
index 0000000000..fa5f70e835
--- /dev/null
+++ b/integrations-catalog/integrations/segment.json
@@ -0,0 +1,35 @@
+{
+  "slug": "segment",
+  "name": "Segment",
+  "description": "Monitor Segment data sources and workspace configuration for data compliance",
+  "category": "Cloud",
+  "docsUrl": "https://api.segmentapis.com/docs/",
+  "baseUrl": "https://api.segmentapis.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "segment_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Segment data sources for infrastructure and data flow inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "segment_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Segment platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/semgrep.json b/integrations-catalog/integrations/semgrep.json
new file mode 100644
index 0000000000..5f1d815c70
--- /dev/null
+++ b/integrations-catalog/integrations/semgrep.json
@@ -0,0 +1,35 @@
+{
+  "slug": "semgrep",
+  "name": "Semgrep",
+  "description": "Monitor Semgrep SAST findings and deployment security scans for secure code compliance",
+  "category": "Security",
+  "docsUrl": "https://semgrep.dev/api/v1/docs/",
+  "baseUrl": "https://semgrep.dev/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "semgrep_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies Semgrep SAST scanning is configured and active",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "semgrep_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Semgrep is scanning code changes for security issues in CI/CD",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sendgrid.json b/integrations-catalog/integrations/sendgrid.json
new file mode 100644
index 0000000000..57cb0daadf
--- /dev/null
+++ b/integrations-catalog/integrations/sendgrid.json
@@ -0,0 +1,35 @@
+{
+  "slug": "sendgrid",
+  "name": "SendGrid",
+  "description": "Monitor SendGrid teammates and API key access for email infrastructure compliance",
+  "category": "Communication",
+  "docsUrl": "https://docs.sendgrid.com/api-reference",
+  "baseUrl": "https://api.sendgrid.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sendgrid_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews SendGrid teammates with account access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sendgrid_secure_secrets",
+      "name": "Secure Secrets",
+      "description": "Audits SendGrid API keys to ensure least-privilege access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sentinelone.json b/integrations-catalog/integrations/sentinelone.json
new file mode 100644
index 0000000000..4825c6a351
--- /dev/null
+++ b/integrations-catalog/integrations/sentinelone.json
@@ -0,0 +1,35 @@
+{
+  "slug": "sentinelone",
+  "name": "SentinelOne",
+  "description": "Monitor SentinelOne endpoint agents and threat status for device security compliance",
+  "category": "Security",
+  "docsUrl": "https://usea1.sentinelone.net/api-doc/overview",
+  "baseUrl": "https://usea1.sentinelone.net/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "s1_secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies SentinelOne agents are healthy and not infected",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "s1_device_list",
+      "name": "Device List",
+      "description": "Lists all endpoints managed by SentinelOne for device inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sentry.json b/integrations-catalog/integrations/sentry.json
new file mode 100644
index 0000000000..c4f7301686
--- /dev/null
+++ b/integrations-catalog/integrations/sentry.json
@@ -0,0 +1,45 @@
+{
+  "slug": "sentry",
+  "name": "Sentry",
+  "description": "Monitor Sentry projects and alert rules for application error tracking and incident response compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.sentry.io/api/",
+  "baseUrl": "https://sentry.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Sentry\n2. Go to Settings > Developer Settings > Internal Integrations\n3. Create a new internal integration\n4. Set permissions: Organization: Read, Project: Read, and Alert Rule: Read\n5. Click Save, then copy the generated token",
+      "credentialFields": [
+        {
+          "label": "Auth Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create an Internal Integration token in Sentry > Settings > Developer Settings"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "projects_active",
+      "name": "App Availability",
+      "description": "Verifies that Sentry projects exist and are actively monitoring errors",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "alert_rules",
+      "name": "Incident Response",
+      "description": "Verifies that Sentry alert rules are configured for incident response",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/servicenow.json b/integrations-catalog/integrations/servicenow.json
new file mode 100644
index 0000000000..676693ca6c
--- /dev/null
+++ b/integrations-catalog/integrations/servicenow.json
@@ -0,0 +1,45 @@
+{
+  "slug": "servicenow",
+  "name": "ServiceNow",
+  "description": "Monitor ServiceNow users and incident tickets for ITSM compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.servicenow.com/dev.do#!/reference/api/utah/rest/",
+  "baseUrl": "https://yourinstance.service-now.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Use a service account with REST API access in ServiceNow\n2. Encode credentials: base64('username:password')\n3. Enter the encoded value below along with your instance name",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode your username:password. Example: base64('admin:yourpassword'). Use https://www.base64encode.org/"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "servicenow_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews ServiceNow users with active system access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "servicenow_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies ServiceNow has an active incident management process",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/shopify.json b/integrations-catalog/integrations/shopify.json
new file mode 100644
index 0000000000..58e2aeade8
--- /dev/null
+++ b/integrations-catalog/integrations/shopify.json
@@ -0,0 +1,51 @@
+{
+  "slug": "shopify",
+  "name": "Shopify",
+  "description": "Monitor Shopify e-commerce platform for store security, staff access, and payment compliance",
+  "category": "Productivity",
+  "docsUrl": "https://shopify.dev/docs/api/admin-rest",
+  "baseUrl": "https://myshopify.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Shopify Admin at https://yourstore.myshopify.com/admin\n2. Go to Settings → Apps → Develop apps\n3. Create a custom app and enable required Admin API scopes\n4. Install the app to reveal the access token\n5. Enter your store URL and access token below",
+      "credentialFields": [
+        {
+          "label": "Store URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Shopify store URL (e.g. mystore.myshopify.com)"
+        },
+        {
+          "label": "Admin API Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a Custom App in Shopify Admin → Settings → Apps → Develop Apps, then install it to get the token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "shopify_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Shopify staff accounts and their store access permissions",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "shopify_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Shopify platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/shortcut.json b/integrations-catalog/integrations/shortcut.json
new file mode 100644
index 0000000000..f73f638f92
--- /dev/null
+++ b/integrations-catalog/integrations/shortcut.json
@@ -0,0 +1,35 @@
+{
+  "slug": "shortcut",
+  "name": "Shortcut",
+  "description": "Monitor Shortcut team members and project organization for engineering workflow compliance",
+  "category": "Development",
+  "docsUrl": "https://developer.shortcut.com/api/rest/v3",
+  "baseUrl": "https://api.app.shortcut.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "shortcut_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Shortcut workspace members and their roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "shortcut_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Shortcut projects are organized for workflow separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sigma-computing.json b/integrations-catalog/integrations/sigma-computing.json
new file mode 100644
index 0000000000..c2741e9c39
--- /dev/null
+++ b/integrations-catalog/integrations/sigma-computing.json
@@ -0,0 +1,45 @@
+{
+  "slug": "sigma-computing",
+  "name": "Sigma Computing",
+  "description": "Monitor Sigma Computing business intelligence platform for user access and data governance compliance",
+  "category": "Productivity",
+  "docsUrl": "https://help.sigmacomputing.com/reference/overview-1",
+  "baseUrl": "https://api.sigmacomputing.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Sigma at https://app.sigmacomputing.com\n2. Go to Administration → Developer Access → API Tokens\n3. Create a new API token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Sigma Administration → Developer Access → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sigma_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Sigma Computing workspace members with access to BI data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sigma_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Sigma Computing BI platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/signnow.json b/integrations-catalog/integrations/signnow.json
new file mode 100644
index 0000000000..97cfcf218b
--- /dev/null
+++ b/integrations-catalog/integrations/signnow.json
@@ -0,0 +1,38 @@
+{
+  "slug": "signnow",
+  "name": "SignNow",
+  "description": "SignNow e-signature and document management platform",
+  "category": "Productivity",
+  "docsUrl": "https://docs.signnow.com/",
+  "baseUrl": "https://api.signnow.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to SignNow\n2. Go to Profile → API\n3. Generate an access token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "SignNow → Profile → API → Generate access token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "signnow_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies SignNow is connected and retrieves user info",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/signoz.json b/integrations-catalog/integrations/signoz.json
new file mode 100644
index 0000000000..d054e5039e
--- /dev/null
+++ b/integrations-catalog/integrations/signoz.json
@@ -0,0 +1,51 @@
+{
+  "slug": "signoz",
+  "name": "SigNoz",
+  "description": "Open-source observability platform with metrics, traces, and logs. Monitor infrastructure alerting.",
+  "category": "Monitoring",
+  "docsUrl": "https://signoz.io/docs/",
+  "baseUrl": "https://signoz.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your SigNoz instance\n2. Go to Settings → API Keys (or Organization Settings for Cloud)\n3. Create a new API key\n4. Enter your SigNoz URL and the API key below",
+      "credentialFields": [
+        {
+          "label": "SigNoz URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your SigNoz instance URL (e.g. https://yourcompany.signoz.cloud or self-hosted URL). No trailing slash."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in SigNoz → Settings → API Keys. Create a key with read permissions."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "signoz_app_availability",
+      "name": "SigNoz App Availability",
+      "description": "Verifies SigNoz API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "signoz_monitoring",
+      "name": "SigNoz Monitoring",
+      "description": "Verifies monitoring alerts are configured in SigNoz.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/slack.json b/integrations-catalog/integrations/slack.json
new file mode 100644
index 0000000000..1ac2ee1660
--- /dev/null
+++ b/integrations-catalog/integrations/slack.json
@@ -0,0 +1,45 @@
+{
+  "slug": "slack",
+  "name": "Slack",
+  "description": "Monitor Slack workspace members and admin access for communication security compliance",
+  "category": "Communication",
+  "docsUrl": "https://api.slack.com/methods",
+  "baseUrl": "https://slack.com/api/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to https://api.slack.com/apps and create a new Slack app\n2. Under 'OAuth & Permissions', add Bot Token Scopes: users:read, users:read.email, team:read\n3. Install the app to your workspace\n4. Set redirect URI to https://api.trycomp.ai/v1/integrations/oauth/callback\n5. Enter Client ID and Client Secret below",
+      "createAppUrl": "https://api.slack.com/apps",
+      "scopes": [
+        "users:read",
+        "users:read.email",
+        "team:read"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": false
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "slack_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews all active Slack workspace members and flags deactivated accounts that retain workspace access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "slack_access_review",
+      "name": "Access Review Log",
+      "description": "Audits Slack workspace admin and owner accounts to ensure privileged access is limited and accounted for",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/smartsheet.json b/integrations-catalog/integrations/smartsheet.json
new file mode 100644
index 0000000000..03f69d4984
--- /dev/null
+++ b/integrations-catalog/integrations/smartsheet.json
@@ -0,0 +1,35 @@
+{
+  "slug": "smartsheet",
+  "name": "Smartsheet",
+  "description": "Monitor Smartsheet users and project sheets for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://smartsheet.com/developers/api-docs",
+  "baseUrl": "https://api.smartsheet.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "smartsheet_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Smartsheet users and their access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "smartsheet_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Smartsheet sheets and workspaces are organized",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/snipeit.json b/integrations-catalog/integrations/snipeit.json
new file mode 100644
index 0000000000..59ceda670d
--- /dev/null
+++ b/integrations-catalog/integrations/snipeit.json
@@ -0,0 +1,58 @@
+{
+  "slug": "snipeit",
+  "name": "Snipe-IT",
+  "description": "Open-source IT asset management platform. Monitor hardware assets, users, and licenses for compliance.",
+  "category": "Infrastructure",
+  "docsUrl": "https://snipe-it.readme.io/reference",
+  "baseUrl": "https://develop.snipeitapp.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Snipe-IT instance\n2. Click your name (top-right) → Manage API Keys\n3. Create a new Personal Access Token\n4. Copy the token\n5. Enter your Snipe-IT URL (e.g. https://yourcompany.snipeitapp.com) and the token below",
+      "credentialFields": [
+        {
+          "label": "Snipe-IT Instance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Snipe-IT URL (e.g. 'https://yourcompany.snipeitapp.com' or your self-hosted URL). No trailing slash."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Snipe-IT → Admin → User Profile → Manage API Keys → Create New Token."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "snipeit_app_availability",
+      "name": "Snipe-IT App Availability",
+      "description": "Checks that the Snipe-IT API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "snipeit_employee_access",
+      "name": "Snipe-IT Employee Access",
+      "description": "Verifies employee access by listing Snipe-IT users.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "snipeit_asset_inventory",
+      "name": "Snipe-IT Asset Inventory",
+      "description": "Verifies hardware asset inventory is maintained in Snipe-IT.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/snowflake.json b/integrations-catalog/integrations/snowflake.json
new file mode 100644
index 0000000000..5955079ece
--- /dev/null
+++ b/integrations-catalog/integrations/snowflake.json
@@ -0,0 +1,51 @@
+{
+  "slug": "snowflake",
+  "name": "Snowflake",
+  "description": "Cloud data platform for data warehousing and analytics. Monitor database access and user accounts.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.snowflake.com/en/developer-guide/snowflake-rest-api",
+  "baseUrl": "https://app.snowflake.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Find your Account Identifier from your Snowflake URL:\n   https://<account_identifier>.snowflakecomputing.com\n   Example: 'myorg-myaccount'\n\n2. Set up a Network Policy:\n   Snowflake requires a network policy to use Programmatic Access Tokens.\n   In your Snowflake account, create a network policy that includes CompAI's IP address: 54.159.77.69\n   Then assign that network policy to the user who will generate the token.\n\n3. Generate a Programmatic Access Token (PAT):\n   Option A - In Snowsight, go to Admin > Users & Roles > select your user > Generate Token\n   Option B - Use SQL to create a token for your user\n\n   Note: The user's authentication policy must allow PATs. If you're having trouble generating a token, check your authentication policy settings.\n\n4. Copy the token and paste both values below.",
+      "credentialFields": [
+        {
+          "label": "Account Identifier",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Snowflake account identifier from your URL: https://<account_identifier>.snowflakecomputing.com (e.g. 'myorg-myaccount')."
+        },
+        {
+          "label": "Programmatic Access Token (PAT)",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate via Snowsight: Admin → Users → select user → Generate Token. Or SQL: ALTER USER <user> ADD PROGRAMMATIC ACCESS TOKEN <name> DAYS_TO_EXPIRY = 30."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "snowflake_app_availability",
+      "name": "Snowflake App Availability",
+      "description": "Checks that the Snowflake API is accessible by listing databases.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "snowflake_employee_access",
+      "name": "Snowflake Employee Access",
+      "description": "Verifies employee access by listing Snowflake user accounts.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/snyk.json b/integrations-catalog/integrations/snyk.json
new file mode 100644
index 0000000000..3b91c92fb4
--- /dev/null
+++ b/integrations-catalog/integrations/snyk.json
@@ -0,0 +1,45 @@
+{
+  "slug": "snyk",
+  "name": "Snyk",
+  "description": "Monitor Snyk security findings including open source vulnerabilities, code issues, and project security posture",
+  "category": "Security",
+  "docsUrl": "https://snyk.docs.apiary.io/",
+  "baseUrl": "https://api.snyk.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Snyk at https://app.snyk.io.\n2. Go to Account Settings (top right menu) > General.\n3. Under 'Auth Token', click 'click to show' and copy your token.\n4. Paste the token below.",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Snyk Account Settings > General > Auth Token. Requires read access to your organization."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_code",
+      "name": "Secure Code",
+      "description": "Verifies that Snyk projects are actively monitored for vulnerabilities",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "sanitized_inputs",
+      "name": "Sanitized Inputs",
+      "description": "Checks for critical and high severity open source vulnerabilities across monitored projects",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/socket-dev.json b/integrations-catalog/integrations/socket-dev.json
new file mode 100644
index 0000000000..c161805853
--- /dev/null
+++ b/integrations-catalog/integrations/socket-dev.json
@@ -0,0 +1,35 @@
+{
+  "slug": "socket-dev",
+  "name": "Socket",
+  "description": "Supply chain security platform for open source dependencies. Monitor organizations and alerts.",
+  "category": "Security",
+  "docsUrl": "https://docs.socket.dev",
+  "baseUrl": "https://api.socket.dev",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "socket_dev_app_availability",
+      "name": "Socket App Availability",
+      "description": "Checks that the Socket API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "socket_dev_employee_access",
+      "name": "Socket Employee Access",
+      "description": "Verifies employee access to Socket via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/socket.json b/integrations-catalog/integrations/socket.json
new file mode 100644
index 0000000000..63417562f0
--- /dev/null
+++ b/integrations-catalog/integrations/socket.json
@@ -0,0 +1,51 @@
+{
+  "slug": "socket",
+  "name": "Socket Security",
+  "description": "Monitor Socket supply chain security scanning for npm package vulnerability compliance",
+  "category": "Security",
+  "docsUrl": "https://docs.socket.dev/reference/authentication",
+  "baseUrl": "https://api.socket.dev/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Socket at https://socket.dev\n2. Go to Settings → API Keys to generate a key\n3. Base64 encode 'api_key:' (with colon, empty password)\n4. Find your org slug in the dashboard URL\n5. Enter both below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'api_key:' (api_key with empty password). Command: echo -n 'your_api_key:' | base64"
+        },
+        {
+          "label": "Organization Slug",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Socket organization slug (from the dashboard URL)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "socket_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies Socket is scanning npm packages for supply chain vulnerabilities",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "socket_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Socket monitors code changes for newly introduced vulnerable packages",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sonarcloud.json b/integrations-catalog/integrations/sonarcloud.json
new file mode 100644
index 0000000000..8c9697e129
--- /dev/null
+++ b/integrations-catalog/integrations/sonarcloud.json
@@ -0,0 +1,45 @@
+{
+  "slug": "sonarcloud",
+  "name": "SonarCloud",
+  "description": "Monitor SonarCloud for critical vulnerabilities and security hotspots in code for security compliance",
+  "category": "Security",
+  "docsUrl": "https://sonarcloud.io/web_api",
+  "baseUrl": "https://sonarcloud.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to SonarCloud\n2. Go to My Account > Security\n3. Generate a new token\n4. Base64-encode 'your_token:' (token followed by a colon)\n5. Paste the encoded string below",
+      "credentialFields": [
+        {
+          "label": "Base64 Encoded Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64-encode 'your_token:' (with trailing colon). Create a token in SonarCloud > My Account > Security"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vulnerabilities",
+      "name": "Secure Code",
+      "description": "Checks for critical and blocker vulnerabilities in SonarCloud",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "security_hotspots",
+      "name": "Sanitized Inputs",
+      "description": "Checks for unreviewed security hotspots in SonarCloud",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sonarqube-cloud.json b/integrations-catalog/integrations/sonarqube-cloud.json
new file mode 100644
index 0000000000..73c2e1c0ea
--- /dev/null
+++ b/integrations-catalog/integrations/sonarqube-cloud.json
@@ -0,0 +1,35 @@
+{
+  "slug": "sonarqube-cloud",
+  "name": "SonarCloud",
+  "description": "Cloud-based code quality and security analysis. Monitor project scans and code coverage.",
+  "category": "Development",
+  "docsUrl": "https://sonarcloud.io/web_api",
+  "baseUrl": "https://sonarcloud.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sonarqube_cloud_app_availability",
+      "name": "SonarCloud App Availability",
+      "description": "Verifies SonarCloud API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sonarqube_cloud_code_quality",
+      "name": "SonarCloud Code Quality",
+      "description": "Verifies code quality scanning is active.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sonarqube-server.json b/integrations-catalog/integrations/sonarqube-server.json
new file mode 100644
index 0000000000..40228618b4
--- /dev/null
+++ b/integrations-catalog/integrations/sonarqube-server.json
@@ -0,0 +1,58 @@
+{
+  "slug": "sonarqube-server",
+  "name": "SonarQube Server",
+  "description": "Monitor SonarQube Server (on-prem/self-hosted) for code vulnerabilities, security hotspots, and code quality across all projects.",
+  "category": "Development",
+  "docsUrl": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api",
+  "baseUrl": "https://sonarqube.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your SonarQube Server instance\n2. Go to My Account > Security\n3. Generate a new User token\n4. Enter your server URL and token below",
+      "credentialFields": [
+        {
+          "label": "SonarQube Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your SonarQube Server base URL (e.g. https://sonar.yourcompany.com)"
+        },
+        {
+          "label": "User Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate in SonarQube > My Account > Security > Generate Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sonarqube_server_vulnerabilities",
+      "name": "Secure Code",
+      "description": "Checks for critical and blocker vulnerabilities across all projects in SonarQube Server",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "sonarqube_server_security_hotspots",
+      "name": "Sanitized Inputs",
+      "description": "Checks for unreviewed security hotspots across all projects in SonarQube Server",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sonarqube_server_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies that SonarQube Server projects have recent analysis activity, indicating code is being scanned regularly.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sonatype-nexus.json b/integrations-catalog/integrations/sonatype-nexus.json
new file mode 100644
index 0000000000..a9d6eee1f6
--- /dev/null
+++ b/integrations-catalog/integrations/sonatype-nexus.json
@@ -0,0 +1,70 @@
+{
+  "slug": "sonatype-nexus",
+  "name": "Sonatype Nexus Repository",
+  "description": "Monitor user access, role-based access controls, repository inventory, and security scanning configuration in Sonatype Nexus Repository Manager",
+  "category": "Development",
+  "docsUrl": "https://help.sonatype.com/en/automation.html",
+  "baseUrl": "https://nexus.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Full URL to your Nexus Repository instance (e.g., https://nexus.example.com)"
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Username with admin or nx-admin role for read access to security and repository APIs"
+        },
+        {
+          "label": "Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Password or user token for the above username"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Lists all users in Nexus Repository and verifies each active user has roles assigned for proper access control",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "rbac",
+      "name": "Role-based Access Controls",
+      "description": "Reviews all roles configured in Nexus Repository and verifies each role has privileges or nested roles defined",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "repository_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all repositories configured in Nexus Repository Manager to provide a complete inventory of artifact stores",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "secure_code",
+      "name": "Secure Code",
+      "description": "Checks whether Sonatype IQ Server (Repository Firewall) is configured and enabled for vulnerability scanning of components, and verifies audit status on proxy repositories",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sonicwall.json b/integrations-catalog/integrations/sonicwall.json
new file mode 100644
index 0000000000..8ffc5fedc9
--- /dev/null
+++ b/integrations-catalog/integrations/sonicwall.json
@@ -0,0 +1,56 @@
+{
+  "slug": "sonicwall",
+  "name": "SonicWall",
+  "description": "Monitor SonicWall firewall for security policies, rules, and network protection compliance",
+  "category": "Security",
+  "docsUrl": "https://www.sonicwall.com/support/knowledge-base/introduction-to-sonicos-api/200818060121313",
+  "baseUrl": "https://example.sonicwall.local",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Firewall URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your SonicWall firewall URL (e.g., https://192.168.1.1)"
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Admin username for SonicWall firewall"
+        },
+        {
+          "label": "Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Admin password for SonicWall firewall"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "production_firewall",
+      "name": "Production Firewall",
+      "description": "Check firewall rules and security policies",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Check security services and system status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sophos-central.json b/integrations-catalog/integrations/sophos-central.json
new file mode 100644
index 0000000000..b5af5d2312
--- /dev/null
+++ b/integrations-catalog/integrations/sophos-central.json
@@ -0,0 +1,72 @@
+{
+  "slug": "sophos-central",
+  "name": "Sophos Central",
+  "description": "Endpoint protection, EDR, and email security platform. Monitor endpoints, alerts, and security posture.",
+  "category": "Security",
+  "docsUrl": "https://developer.sophos.com",
+  "baseUrl": "https://api.central.sophos.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Sign in to Sophos Central at https://central.sophos.com\n2. Go to Settings (gear icon) → API Credentials Management\n3. Click 'Add Credential'\n4. Enter a name (e.g. 'CompAI Integration')\n5. For Role, select 'Service Principal ReadOnly'\n6. Click Add — copy the Client ID and Client Secret immediately\n7. Paste both values below\n\nNote: You must copy the Client Secret right away — it cannot be retrieved later.",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Sophos Central → Settings → API Credentials Management. Create a credential with 'Service Principal ReadOnly' role."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Shown once when you create the API credential. Copy it immediately."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sophos_central_app_availability",
+      "name": "Sophos Central App Availability",
+      "description": "Verifies connectivity to Sophos Central API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sophos_central_endpoint_protection",
+      "name": "Sophos Central Endpoint Protection",
+      "description": "Verifies endpoint protection is deployed with no unhealthy devices.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sophos_central_asset_inventory",
+      "name": "Sophos Central Asset Inventory",
+      "description": "Verifies device inventory is maintained via Sophos endpoint management.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sophos_central_email_security",
+      "name": "Sophos Central Email Security",
+      "description": "Verifies email security policies are configured in Sophos Central.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sophos_central_employee_access",
+      "name": "Sophos Central Employee Access",
+      "description": "Verifies access to Sophos Central endpoint inventory.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/speakeasy.json b/integrations-catalog/integrations/speakeasy.json
new file mode 100644
index 0000000000..e7769e0c1a
--- /dev/null
+++ b/integrations-catalog/integrations/speakeasy.json
@@ -0,0 +1,35 @@
+{
+  "slug": "speakeasy",
+  "name": "Speakeasy",
+  "description": "API developer experience platform. Monitor API access and workspace.",
+  "category": "Development",
+  "docsUrl": "https://docs.speakeasyapi.dev/",
+  "baseUrl": "https://api.speakeasyapi.dev",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "speakeasy_app_availability",
+      "name": "Speakeasy App Availability",
+      "description": "Checks Speakeasy app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "speakeasy_employee_access",
+      "name": "Speakeasy Employee Access",
+      "description": "Checks Speakeasy employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/split.json b/integrations-catalog/integrations/split.json
new file mode 100644
index 0000000000..8b06be579e
--- /dev/null
+++ b/integrations-catalog/integrations/split.json
@@ -0,0 +1,45 @@
+{
+  "slug": "split",
+  "name": "Split",
+  "description": "Monitor Split feature flag platform for deployment control and access compliance",
+  "category": "Development",
+  "docsUrl": "https://docs.split.io/reference/introduction",
+  "baseUrl": "https://api.split.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Split at https://app.split.io\n2. Go to Admin Settings → API Keys\n3. Create a new Admin API key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Admin API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Split Admin Settings → API Keys (Admin key type)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "split_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Split feature flags are configured to safely manage code changes",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "split_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Split workspace members with access to feature flag management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/splunk.json b/integrations-catalog/integrations/splunk.json
new file mode 100644
index 0000000000..9f455fb64e
--- /dev/null
+++ b/integrations-catalog/integrations/splunk.json
@@ -0,0 +1,45 @@
+{
+  "slug": "splunk",
+  "name": "Splunk",
+  "description": "Monitor Splunk saved searches and user accounts for monitoring and access review compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTprolog",
+  "baseUrl": "https://splunkcloud.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Splunk\n2. Go to Settings > Tokens\n3. Enable token authentication if not enabled\n4. Click New Token and create a token with appropriate permissions\n5. Copy and paste the token below",
+      "credentialFields": [
+        {
+          "label": "Bearer Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create an authentication token in Splunk > Settings > Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "saved_searches",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that Splunk saved searches are configured for monitoring and alerting",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "users",
+      "name": "Access Review Log",
+      "description": "Reviews Splunk users for access review log compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sprig.json b/integrations-catalog/integrations/sprig.json
new file mode 100644
index 0000000000..405ecd5cfe
--- /dev/null
+++ b/integrations-catalog/integrations/sprig.json
@@ -0,0 +1,45 @@
+{
+  "slug": "sprig",
+  "name": "Sprig",
+  "description": "Sprig in-product microsurveys and session replays for user research",
+  "category": "Productivity",
+  "docsUrl": "https://docs.sprig.com/reference",
+  "baseUrl": "https://api.sprig.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Sprig\n2. Go to Settings → API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Sprig → Settings → API Keys → Create API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sprig_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Sprig user research platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sprig_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Sprig surveys to verify user research platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/square.json b/integrations-catalog/integrations/square.json
new file mode 100644
index 0000000000..817ede3812
--- /dev/null
+++ b/integrations-catalog/integrations/square.json
@@ -0,0 +1,35 @@
+{
+  "slug": "square",
+  "name": "Square",
+  "description": "Payment processing and business tools. Monitor merchant access and employee accounts.",
+  "category": "Productivity",
+  "docsUrl": "https://developer.squareup.com/reference/square",
+  "baseUrl": "https://connect.squareup.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "square_app_availability",
+      "name": "Square App Availability",
+      "description": "Checks that the Square API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "square_employee_access",
+      "name": "Square Employee Access",
+      "description": "Verifies employee access to Square via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/stackhawk.json b/integrations-catalog/integrations/stackhawk.json
new file mode 100644
index 0000000000..38ebc15d0f
--- /dev/null
+++ b/integrations-catalog/integrations/stackhawk.json
@@ -0,0 +1,38 @@
+{
+  "slug": "stackhawk",
+  "name": "StackHawk",
+  "description": "StackHawk DAST application security testing platform",
+  "category": "Security",
+  "docsUrl": "https://docs.stackhawk.com/",
+  "baseUrl": "https://api.stackhawk.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to StackHawk\n2. Go to Settings → API Keys\n3. Generate a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "StackHawk → Settings → API Keys → Generate key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "stackhawk_code_security",
+      "name": "Code Changes",
+      "description": "Verifies StackHawk has applications configured for security scanning",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/statsig.json b/integrations-catalog/integrations/statsig.json
new file mode 100644
index 0000000000..e4ef7e97f8
--- /dev/null
+++ b/integrations-catalog/integrations/statsig.json
@@ -0,0 +1,45 @@
+{
+  "slug": "statsig",
+  "name": "Statsig",
+  "description": "Feature flags and experimentation platform. Monitor feature gates and experiments.",
+  "category": "Monitoring",
+  "docsUrl": "https://docs.statsig.com/console-api/introduction",
+  "baseUrl": "https://statsigapi.net",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Statsig at https://console.statsig.com\n2. Go to Project Settings → API Keys\n3. Create or copy a Console API Key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Console API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Project Settings → API Keys → Console API Key on console.statsig.com"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "statsig_app_availability",
+      "name": "Statsig App Availability",
+      "description": "Checks that the Statsig Console API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "statsig_employee_access",
+      "name": "Statsig Employee Access",
+      "description": "Verifies employee access to Statsig.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/statuscake.json b/integrations-catalog/integrations/statuscake.json
new file mode 100644
index 0000000000..fcc3bf0573
--- /dev/null
+++ b/integrations-catalog/integrations/statuscake.json
@@ -0,0 +1,58 @@
+{
+  "slug": "statuscake",
+  "name": "StatusCake",
+  "description": "Monitor StatusCake uptime checks, SSL monitoring, and alert contact group configurations for compliance evidence.",
+  "category": "Monitoring",
+  "docsUrl": "https://developers.statuscake.com/api/",
+  "baseUrl": "https://api.statuscake.com/v1/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in StatusCake dashboard under Integrations & API > API."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "statuscake_monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that StatusCake has active uptime monitoring checks configured and running.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "statuscake_tls_https",
+      "name": "TLS / HTTPS",
+      "description": "Verifies that SSL monitoring checks are configured in StatusCake to track certificate validity.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "statuscake_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies that alert contact groups are configured in StatusCake so monitoring alerts reach the right people.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "statuscake_app_availability",
+      "name": "App Availability",
+      "description": "Verifies overall uptime performance across all StatusCake uptime checks.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/statuspage.json b/integrations-catalog/integrations/statuspage.json
new file mode 100644
index 0000000000..ab02897fa4
--- /dev/null
+++ b/integrations-catalog/integrations/statuspage.json
@@ -0,0 +1,35 @@
+{
+  "slug": "statuspage",
+  "name": "Statuspage",
+  "description": "Monitor Atlassian Statuspage incidents and uptime for service availability compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://developer.statuspage.io/",
+  "baseUrl": "https://api.statuspage.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "statuspage_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Statuspage pages are configured and monitoring service availability",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "statuspage_incident_response",
+      "name": "Incident Response",
+      "description": "Checks for open incidents on Statuspage requiring resolution",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sterling.json b/integrations-catalog/integrations/sterling.json
new file mode 100644
index 0000000000..90792484d0
--- /dev/null
+++ b/integrations-catalog/integrations/sterling.json
@@ -0,0 +1,43 @@
+{
+  "slug": "sterling",
+  "name": "Sterling",
+  "description": "Monitor Sterling background check screenings for HR verification compliance",
+  "category": "HR & People",
+  "docsUrl": "https://apidocs.sterlingcheck.app/",
+  "baseUrl": "https://api.kennect.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Sterling API Client ID, provided by Sterling"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Your Sterling API Client Secret, provided by Sterling"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sterling_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies Sterling is being used for background check screenings by checking for active candidates and packages",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/stitch.json b/integrations-catalog/integrations/stitch.json
new file mode 100644
index 0000000000..0691387733
--- /dev/null
+++ b/integrations-catalog/integrations/stitch.json
@@ -0,0 +1,45 @@
+{
+  "slug": "stitch",
+  "name": "Stitch",
+  "description": "Monitor Stitch ETL data pipelines for data source connectivity and compliance",
+  "category": "Development",
+  "docsUrl": "https://www.stitchdata.com/docs/developers/import-api/",
+  "baseUrl": "https://api.stitchdata.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Stitch at https://app.stitchdata.com\n2. Go to Account Settings → API Keys\n3. Generate an access token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Stitch Account Settings → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "stitch_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Stitch ETL data sources are configured for structured data pipeline management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "stitch_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Stitch destinations are configured to receive ETL data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/stoplight.json b/integrations-catalog/integrations/stoplight.json
new file mode 100644
index 0000000000..ccd4b47799
--- /dev/null
+++ b/integrations-catalog/integrations/stoplight.json
@@ -0,0 +1,45 @@
+{
+  "slug": "stoplight",
+  "name": "Stoplight",
+  "description": "Stoplight API design, documentation, and governance platform",
+  "category": "Development",
+  "docsUrl": "https://stoplight.io/api/v1",
+  "baseUrl": "https://stoplight.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Stoplight\n2. Go to Account → API Tokens\n3. Create a new token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Stoplight → Account → API Tokens → Create Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "stoplight_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Stoplight API governance platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "stoplight_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Stoplight projects to verify API governance access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/storyblok.json b/integrations-catalog/integrations/storyblok.json
new file mode 100644
index 0000000000..eb4b7f385b
--- /dev/null
+++ b/integrations-catalog/integrations/storyblok.json
@@ -0,0 +1,45 @@
+{
+  "slug": "storyblok",
+  "name": "Storyblok",
+  "description": "Monitor Storyblok headless CMS spaces for content management and team access compliance",
+  "category": "Productivity",
+  "docsUrl": "https://www.storyblok.com/docs/api/management",
+  "baseUrl": "https://mapi.storyblok.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Storyblok at https://app.storyblok.com\n2. Click your avatar → My Account\n3. Go to Personal Access Tokens\n4. Generate a new token and enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Storyblok → My Account → Personal Access Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "storyblok_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Storyblok spaces for content infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "storyblok_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Storyblok space collaborators and their content access roles",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/stripe.json b/integrations-catalog/integrations/stripe.json
new file mode 100644
index 0000000000..07ba518d57
--- /dev/null
+++ b/integrations-catalog/integrations/stripe.json
@@ -0,0 +1,38 @@
+{
+  "slug": "stripe",
+  "name": "Stripe",
+  "description": "Verify Stripe payment data masking and PCI compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.stripe.com/api",
+  "baseUrl": "https://api.stripe.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Stripe at https://dashboard.stripe.com\n2. Go to Developers > API keys\n3. Click '+ Create restricted key'\n4. Under 'All core resources', set Charges to 'Read'\n5. Save and copy the key (rk_live_...)\n6. Paste the key below",
+      "credentialFields": [
+        {
+          "label": "Secret or Restricted API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Stripe Dashboard > Developers > API keys. Create a Restricted Key with Charges > Read permission."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "stripe_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Stripe payment data is properly masked and not exposing raw card data",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/strongdm.json b/integrations-catalog/integrations/strongdm.json
new file mode 100644
index 0000000000..e350bac995
--- /dev/null
+++ b/integrations-catalog/integrations/strongdm.json
@@ -0,0 +1,35 @@
+{
+  "slug": "strongdm",
+  "name": "StrongDM",
+  "description": "Infrastructure access management platform. Monitor resource access and audit logs.",
+  "category": "Security",
+  "docsUrl": "https://www.strongdm.com/docs/api/",
+  "baseUrl": "https://api.strongdm.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "strongdm_app_availability",
+      "name": "StrongDM App Availability",
+      "description": "Checks that the StrongDM API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "strongdm_employee_access",
+      "name": "StrongDM Employee Access",
+      "description": "Verifies access to StrongDM.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/stytch.json b/integrations-catalog/integrations/stytch.json
new file mode 100644
index 0000000000..9996cf9133
--- /dev/null
+++ b/integrations-catalog/integrations/stytch.json
@@ -0,0 +1,45 @@
+{
+  "slug": "stytch",
+  "name": "Stytch",
+  "description": "Monitor Stytch authentication platform for user management and passwordless auth compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://stytch.com/docs/api",
+  "baseUrl": "https://api.stytch.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Stytch at https://stytch.com/dashboard/api-keys\n2. Copy your Project ID and Secret (use Live keys for production)\n3. Base64 encode 'project_id:secret'\n4. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'project_id:secret'. Found in Stytch Dashboard → API Keys. Command: echo -n 'project-live-xxxxx:secret-live-xxxxx' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "stytch_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Stytch authenticated users to audit authentication platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "stytch_mfa",
+      "name": "2FA",
+      "description": "Verifies Stytch MFA methods are configured for enhanced authentication security",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sumo-logic.json b/integrations-catalog/integrations/sumo-logic.json
new file mode 100644
index 0000000000..80569f4c6a
--- /dev/null
+++ b/integrations-catalog/integrations/sumo-logic.json
@@ -0,0 +1,45 @@
+{
+  "slug": "sumo-logic",
+  "name": "Sumo Logic",
+  "description": "Cloud-native SIEM and log analytics platform. Monitor collectors and data ingestion.",
+  "category": "Monitoring",
+  "docsUrl": "https://help.sumologic.com/docs/api/",
+  "baseUrl": "https://api.us2.sumologic.com",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "setupInstructions": "1. Log in to Sumo Logic\n2. Go to Administration → Security → Access Keys\n3. Click + Add Access Key\n4. Copy the Access ID and Access Key\n5. Use Access ID as username and Access Key as password\n6. Determine your API URL from your login URL region\n7. Paste all values below",
+      "credentialFields": [
+        {
+          "label": "API Endpoint URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Sumo Logic API URL based on region (e.g. https://api.us2.sumologic.com, https://api.eu.sumologic.com)."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sumo_logic_app_availability",
+      "name": "Sumo Logic App Availability",
+      "description": "Verifies Sumo Logic API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sumo_logic_monitoring",
+      "name": "Sumo Logic Monitoring",
+      "description": "Verifies log collection is active.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sumologic.json b/integrations-catalog/integrations/sumologic.json
new file mode 100644
index 0000000000..ef5a3681ac
--- /dev/null
+++ b/integrations-catalog/integrations/sumologic.json
@@ -0,0 +1,51 @@
+{
+  "slug": "sumologic",
+  "name": "Sumo Logic",
+  "description": "Monitor Sumo Logic log management and analytics platform for user access and monitoring compliance",
+  "category": "Monitoring",
+  "docsUrl": "https://api.sumologic.com/docs/",
+  "baseUrl": "https://api.sumologic.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Sumo Logic\n2. Go to your name → Preferences → Access Keys\n3. Create a new access key — copy the Access ID and Access Key\n4. Base64 encode 'accessId:accessKey': echo -n 'id:key' | base64\n5. Find your API endpoint at https://help.sumologic.com/docs/api/getting-started/#sumo-logic-endpoints\n6. Enter both below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'accessId:accessKey'. Found in Sumo Logic Preferences → Access Keys. Command: echo -n 'accessId:accessKey' | base64"
+        },
+        {
+          "label": "API Endpoint",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Sumo Logic API endpoint based on your deployment (e.g. api.us2.sumologic.com, api.eu.sumologic.com). See https://help.sumologic.com/docs/api/getting-started/#sumo-logic-endpoints"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sumologic_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Sumo Logic users with access to log analytics",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sumologic_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Sumo Logic monitors are configured for log-based alerting",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/supabase.json b/integrations-catalog/integrations/supabase.json
new file mode 100644
index 0000000000..40e8124542
--- /dev/null
+++ b/integrations-catalog/integrations/supabase.json
@@ -0,0 +1,93 @@
+{
+  "slug": "supabase",
+  "name": "Supabase",
+  "description": "Monitor Supabase projects for security configuration, MFA, secrets, edge functions, SSL enforcement, backups, and compliance advisories. Requires a Management API access token (not your project anon or service key). Generate at supabase.com/dashboard/account/tokens.",
+  "category": "Cloud",
+  "docsUrl": "https://supabase.com/docs/reference/api/introduction",
+  "baseUrl": "https://api.supabase.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Go to https://supabase.com/dashboard/account/tokens\n2. Click Generate New Token\n3. Give it a name (e.g. CompAI)\n4. Copy the token and paste it below\n\nImportant: Use a Management API access token, not your project anon or service key."
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "supabase_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all Supabase projects and verifies they are in a healthy active state",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_tls",
+      "name": "TLS / HTTPS",
+      "description": "Verifies SSL is enforced on the Supabase database connection, requiring TLS for all client connections",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_mfa",
+      "name": "2FA",
+      "description": "Verifies multi-factor authentication (TOTP) is enabled for user enrollment and verification in Supabase Auth",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_auth_policy",
+      "name": "Role-based Access Controls",
+      "description": "Audits Supabase Auth configuration: JWT expiry, auto-confirm, password policy, and HaveIBeenPwned protection",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_edge_functions",
+      "name": "Separation of Environments",
+      "description": "Audits Edge Function security configuration — verifies JWT verification is enabled and all functions are in active state",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_secrets",
+      "name": "Secure Secrets",
+      "description": "Verifies Edge Function secrets are configured. Only secret names are surfaced — values are never stored or displayed.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_function_logs",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Edge Function execution logging is accessible and active via the Supabase Analytics API",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_backups",
+      "name": "Backup Logs",
+      "description": "Verifies database backups are configured and recent successful backups exist. Checks for Point-in-Time Recovery (PITR) enablement.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_security_advisors",
+      "name": "Internal Security Audit",
+      "description": "Surfaces Supabase's built-in security advisor results — automated lint checks for RLS, leaked keys, network restrictions, SSL, and 28 other security rules",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "supabase_encryption",
+      "name": "Encryption at Rest",
+      "description": "Verifies that Supabase projects use encryption at rest (enabled by default on all Supabase databases)",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 10,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/surveymonkey.json b/integrations-catalog/integrations/surveymonkey.json
new file mode 100644
index 0000000000..3ea2f70487
--- /dev/null
+++ b/integrations-catalog/integrations/surveymonkey.json
@@ -0,0 +1,45 @@
+{
+  "slug": "surveymonkey",
+  "name": "SurveyMonkey",
+  "description": "SurveyMonkey online survey platform for employee and customer feedback",
+  "category": "HR & People",
+  "docsUrl": "https://developer.surveymonkey.com",
+  "baseUrl": "https://api.surveymonkey.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to SurveyMonkey\n2. Go to My Account → Developer Apps\n3. Create an app and complete the OAuth flow\n4. Paste your access token below",
+      "credentialFields": [
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "SurveyMonkey → My Account → Developer Apps → OAuth Access Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "surveymonkey_app_availability",
+      "name": "App Availability",
+      "description": "Verifies SurveyMonkey platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "surveymonkey_employee_access",
+      "name": "Employee Access",
+      "description": "Lists SurveyMonkey surveys to verify employee feedback platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/surveysparrow.json b/integrations-catalog/integrations/surveysparrow.json
new file mode 100644
index 0000000000..77f05b9ec2
--- /dev/null
+++ b/integrations-catalog/integrations/surveysparrow.json
@@ -0,0 +1,45 @@
+{
+  "slug": "surveysparrow",
+  "name": "SurveySparrow",
+  "description": "SurveySparrow conversational survey platform for employee and customer experience",
+  "category": "HR & People",
+  "docsUrl": "https://developers.surveysparrow.com",
+  "baseUrl": "https://api.surveysparrow.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to SurveySparrow\n2. Go to Settings → Apps & Integrations → API Token\n3. Generate or copy your API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "SurveySparrow → Settings → Apps & Integrations → API Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "surveysparrow_app_availability",
+      "name": "App Availability",
+      "description": "Verifies SurveySparrow platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "surveysparrow_employee_access",
+      "name": "Employee Access",
+      "description": "Lists SurveySparrow contacts to verify employee survey access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/sysdig.json b/integrations-catalog/integrations/sysdig.json
new file mode 100644
index 0000000000..a605e43423
--- /dev/null
+++ b/integrations-catalog/integrations/sysdig.json
@@ -0,0 +1,51 @@
+{
+  "slug": "sysdig",
+  "name": "Sysdig",
+  "description": "Monitor Sysdig cloud security platform for container and cloud workload security compliance",
+  "category": "Security",
+  "docsUrl": "https://docs.sysdig.com/en/docs/developer-tools/rest-api/",
+  "baseUrl": "https://app.sysdigcloud.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Sysdig\n2. Go to Settings → User Profile\n3. Copy your Sysdig API Token\n4. Find your region URL from the Sysdig docs\n5. Enter both below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Sysdig → Settings → User Profile → Sysdig API Token"
+        },
+        {
+          "label": "API URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Sysdig regional API URL. US East: https://us2.app.sysdig.com, US West: https://app.sysdigcloud.com, EU: https://eu1.app.sysdig.com"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "sysdig_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Sysdig account is active for cloud security monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "sysdig_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Sysdig alert policies are configured for cloud security events",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/tailscale.json b/integrations-catalog/integrations/tailscale.json
new file mode 100644
index 0000000000..50ab7d42d2
--- /dev/null
+++ b/integrations-catalog/integrations/tailscale.json
@@ -0,0 +1,35 @@
+{
+  "slug": "tailscale",
+  "name": "Tailscale",
+  "description": "Monitor Tailscale network devices and ACL configuration for zero-trust network compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://tailscale.com/api",
+  "baseUrl": "https://api.tailscale.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "tailscale_secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies Tailscale network devices are authorized and recently seen",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "tailscale_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all Tailscale network nodes for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/talent-lms.json b/integrations-catalog/integrations/talent-lms.json
new file mode 100644
index 0000000000..d04f79dc52
--- /dev/null
+++ b/integrations-catalog/integrations/talent-lms.json
@@ -0,0 +1,44 @@
+{
+  "slug": "talent-lms",
+  "name": "TalentLMS",
+  "description": "TalentLMS learning management system for employee training and compliance",
+  "category": "HR & People",
+  "docsUrl": "https://www.talentlms.com/pages/docs/TalentLMS-API-Documentation.pdf",
+  "baseUrl": "https://{{credentials.subdomain}}.talentlms.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to TalentLMS as admin\n2. Go to Account & Settings → Basic Settings\n3. Copy the API Key shown on the page\n4. Enter your subdomain and paste the API key below",
+      "credentialFields": [
+        {
+          "label": "Company Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your TalentLMS subdomain (e.g. if your URL is acme.talentlms.com, enter: acme)"
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Get your API key from TalentLMS → Account & Settings → Basic Settings → API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "talentlms_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies employee training and course completion status in TalentLMS",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/tanium.json b/integrations-catalog/integrations/tanium.json
new file mode 100644
index 0000000000..7509c43cea
--- /dev/null
+++ b/integrations-catalog/integrations/tanium.json
@@ -0,0 +1,65 @@
+{
+  "slug": "tanium",
+  "name": "Tanium",
+  "description": "Endpoint management and security platform providing real-time visibility, control, and compliance across organizational infrastructure",
+  "category": "Security",
+  "docsUrl": "https://developer.tanium.com/",
+  "baseUrl": "https://example.cloud.tanium.com/api/v2/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log into Tanium Console as Administrator\n2. Navigate to Administration > Permissions > API Tokens\n3. Click 'Create API Token'\n4. Set appropriate scopes and expiration\n5. Copy the generated token (shown only once)",
+      "credentialFields": [
+        {
+          "label": "Tanium Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "For Tanium Cloud: https://{tenant}.cloud.tanium.com (without /api). For on-premises: provide your full Tanium server URL"
+        },
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate API tokens in Administration > Permissions > API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "device_inventory",
+      "name": "Device List",
+      "description": "Verifies endpoint devices are properly managed and inventoried in Tanium",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Checks that endpoints managed by Tanium are secure and compliant with organizational policies",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies monitoring capabilities and alerting configuration for security and compliance events",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews user accounts and access permissions in Tanium for proper role-based access control",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/teamcity.json b/integrations-catalog/integrations/teamcity.json
new file mode 100644
index 0000000000..c9a4517e05
--- /dev/null
+++ b/integrations-catalog/integrations/teamcity.json
@@ -0,0 +1,58 @@
+{
+  "slug": "teamcity",
+  "name": "TeamCity",
+  "description": "Monitor JetBrains TeamCity CI/CD server for user access, role-based permissions, and build activity",
+  "category": "Development",
+  "docsUrl": "https://www.jetbrains.com/help/teamcity/rest/teamcity-rest-api-documentation.html",
+  "baseUrl": "https://teamcity.example.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your TeamCity server as an administrator\n2. Click your username (top-right) > Profile\n3. Go to Access Tokens\n4. Click Create access token\n5. Give it a name and set the permissions (admin recommended for full visibility)\n6. Copy the generated token\n7. Enter your TeamCity server URL and token below",
+      "credentialFields": [
+        {
+          "label": "TeamCity Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your TeamCity server URL (e.g., https://teamcity.example.com). Do not include a trailing slash."
+        },
+        {
+          "label": "Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate in TeamCity: My Settings & Tools > Access Tokens. The token user should have admin-level permissions to list users and builds."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all TeamCity users and verifies each has roles assigned, providing evidence of who has access to the CI/CD server",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Verifies TeamCity users have scoped role assignments following least-privilege principles, flagging system administrators for review",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "code_changes",
+      "name": "Code Changes",
+      "description": "Verifies TeamCity build configurations are actively running builds, providing evidence of continuous integration and code change tracking",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/teamsupport.json b/integrations-catalog/integrations/teamsupport.json
new file mode 100644
index 0000000000..c3576a5896
--- /dev/null
+++ b/integrations-catalog/integrations/teamsupport.json
@@ -0,0 +1,45 @@
+{
+  "slug": "teamsupport",
+  "name": "TeamSupport",
+  "description": "Monitor TeamSupport B2B customer support platform for team access and ticket management compliance",
+  "category": "Communication",
+  "docsUrl": "https://developer.teamsupport.com/",
+  "baseUrl": "https://app.teamsupport.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to TeamSupport at https://app.teamsupport.com\n2. Go to Admin → Settings → API\n3. Copy your Organization ID and API Token\n4. Base64 encode them: echo -n 'OrganizationID:APIToken' | base64\n5. Enter the encoded value below",
+      "credentialFields": [
+        {
+          "label": "Encoded API Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'OrganizationID:APIToken'. Found in TeamSupport Admin → Settings → API. Command: echo -n 'orgid:apitoken' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "teamsupport_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews TeamSupport agent accounts with access to the customer support platform",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "teamsupport_app_availability",
+      "name": "App Availability",
+      "description": "Verifies TeamSupport customer support platform is operational",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/teamwork.json b/integrations-catalog/integrations/teamwork.json
new file mode 100644
index 0000000000..676219aa4a
--- /dev/null
+++ b/integrations-catalog/integrations/teamwork.json
@@ -0,0 +1,35 @@
+{
+  "slug": "teamwork",
+  "name": "Teamwork",
+  "description": "Project management and team collaboration platform.",
+  "category": "Productivity",
+  "docsUrl": "https://developer.teamwork.com/",
+  "baseUrl": "https://api.teamwork.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "teamwork_app_availability",
+      "name": "Teamwork App Availability",
+      "description": "Checks Teamwork app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "teamwork_employee_access",
+      "name": "Teamwork Employee Access",
+      "description": "Checks Teamwork employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/teleport.json b/integrations-catalog/integrations/teleport.json
new file mode 100644
index 0000000000..4aa8be80cf
--- /dev/null
+++ b/integrations-catalog/integrations/teleport.json
@@ -0,0 +1,35 @@
+{
+  "slug": "teleport",
+  "name": "Teleport",
+  "description": "Monitor Teleport privileged access management — audit users, roles, and server access for zero-trust compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://goteleport.com/docs/api/",
+  "baseUrl": "https://yourteleport.example.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "teleport_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Teleport users with privileged infrastructure access",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "teleport_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Audits Teleport roles to ensure least-privilege access to infrastructure",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/telnyx.json b/integrations-catalog/integrations/telnyx.json
new file mode 100644
index 0000000000..7ad202db65
--- /dev/null
+++ b/integrations-catalog/integrations/telnyx.json
@@ -0,0 +1,45 @@
+{
+  "slug": "telnyx",
+  "name": "Telnyx",
+  "description": "Telnyx cloud communications platform for voice, SMS, and fax",
+  "category": "Communication",
+  "docsUrl": "https://developers.telnyx.com",
+  "baseUrl": "https://api.telnyx.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Telnyx Mission Control Portal\n2. Go to API Keys\n3. Create a new API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Telnyx → API Keys → Create API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "telnyx_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Telnyx platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "telnyx_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Telnyx organization users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/tenable-cloud.json b/integrations-catalog/integrations/tenable-cloud.json
new file mode 100644
index 0000000000..e4552fcfdb
--- /dev/null
+++ b/integrations-catalog/integrations/tenable-cloud.json
@@ -0,0 +1,51 @@
+{
+  "slug": "tenable-cloud",
+  "name": "Tenable Cloud",
+  "description": "Vulnerability management and scanning platform. Monitor scan results and security posture.",
+  "category": "Security",
+  "docsUrl": "https://developer.tenable.com/",
+  "baseUrl": "https://cloud.tenable.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Tenable.io\n2. Go to Settings → My Account → API Keys\n3. Click Generate to create a new key pair\n4. Copy the Access Key and Secret Key\n5. Paste both values below",
+      "credentialFields": [
+        {
+          "label": "Access Key",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Tenable.io → Settings → My Account → API Keys."
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Shown once when generating API keys."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "tenable_cloud_app_availability",
+      "name": "Tenable Cloud App Availability",
+      "description": "Verifies Tenable.io API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "tenable_cloud_vulnerability_scanning",
+      "name": "Tenable Cloud Vulnerability Scanning",
+      "description": "Verifies vulnerability scans are configured.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/tenable.json b/integrations-catalog/integrations/tenable.json
new file mode 100644
index 0000000000..8761ed5d6b
--- /dev/null
+++ b/integrations-catalog/integrations/tenable.json
@@ -0,0 +1,51 @@
+{
+  "slug": "tenable",
+  "name": "Tenable.io",
+  "description": "Monitor Tenable.io vulnerability scans and asset inventory for security compliance",
+  "category": "Security",
+  "docsUrl": "https://developer.tenable.com/reference",
+  "baseUrl": "https://cloud.tenable.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Tenable.io\n2. Go to Settings > My Account > API Keys\n3. Generate a new API key pair\n4. Copy both the Access Key and Secret Key and paste them below",
+      "credentialFields": [
+        {
+          "label": "Access Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Tenable.io > Settings > My Account > API Keys"
+        },
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Tenable.io > Settings > My Account > API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vulnerability_scans",
+      "name": "Secure Code",
+      "description": "Verifies that Tenable.io vulnerability scans are configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "asset_inventory",
+      "name": "Secure Devices",
+      "description": "Verifies that device assets are tracked in Tenable.io",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/terraform-cloud.json b/integrations-catalog/integrations/terraform-cloud.json
new file mode 100644
index 0000000000..471eba97fc
--- /dev/null
+++ b/integrations-catalog/integrations/terraform-cloud.json
@@ -0,0 +1,45 @@
+{
+  "slug": "terraform-cloud",
+  "name": "Terraform Cloud",
+  "description": "Monitor Terraform Cloud workspaces for infrastructure environment separation and inventory compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://developer.hashicorp.com/terraform/cloud-docs/api-docs",
+  "baseUrl": "https://app.terraform.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Terraform Cloud (app.terraform.io)\n2. Go to User Settings > Tokens\n3. Create an API token\n4. Paste the token below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Create a user or team API token in Terraform Cloud > User Settings > Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "workspaces_sep",
+      "name": "Separation of Environments",
+      "description": "Lists Terraform Cloud workspaces to verify environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "workspaces_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Retrieves Terraform Cloud workspace inventory for infrastructure tracking",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/testrail.json b/integrations-catalog/integrations/testrail.json
new file mode 100644
index 0000000000..f3b04d781f
--- /dev/null
+++ b/integrations-catalog/integrations/testrail.json
@@ -0,0 +1,51 @@
+{
+  "slug": "testrail",
+  "name": "TestRail",
+  "description": "Monitor TestRail test management for QA coverage and code quality compliance",
+  "category": "Development",
+  "docsUrl": "https://support.testrail.com/hc/en-us/articles/7077418013844-Introduction",
+  "baseUrl": "https://yourdomain.testrail.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to TestRail\n2. Go to your Profile → API Keys and generate a key\n3. Base64 encode 'your_email:api_key'\n4. Enter your TestRail URL and encoded credentials below",
+      "credentialFields": [
+        {
+          "label": "TestRail URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your TestRail instance URL (e.g. https://mycompany.testrail.io)"
+        },
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode 'email:api_key'. Enable API key in TestRail: Profile → API Keys. Command: echo -n 'user@email.com:api_key' | base64"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "testrail_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies TestRail test projects and suites are configured to track code changes",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "testrail_secure_code",
+      "name": "Secure Code",
+      "description": "Verifies TestRail test runs are being executed to validate code quality",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/threatdown.json b/integrations-catalog/integrations/threatdown.json
new file mode 100644
index 0000000000..eb4b874c19
--- /dev/null
+++ b/integrations-catalog/integrations/threatdown.json
@@ -0,0 +1,77 @@
+{
+  "slug": "threatdown",
+  "name": "ThreatDown (Malwarebytes)",
+  "description": "Endpoint security platform providing malware detection, ransomware protection, and device management capabilities",
+  "category": "Security",
+  "docsUrl": "https://api.malwarebytes.com/nebula/v1/docs",
+  "baseUrl": "https://api.malwarebytes.com/nebula/v1/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your ThreatDown OAuth2 application client ID from the Integrate page in Nebula console"
+        },
+        {
+          "label": "Client Secret",
+          "type": "secret",
+          "required": true,
+          "helpText": "Your ThreatDown OAuth2 application client secret"
+        },
+        {
+          "label": "Account ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Nebula account ID (UUID format)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies that all endpoints have security agents installed and are reporting status",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Maintains an inventory of all managed endpoints",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies that threat detection monitoring is active and recent detections are being tracked",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "encryption_at_rest",
+      "name": "Encryption at Rest",
+      "description": "Verifies device encryption policies are configured and enforced",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "incident_response",
+      "name": "Incident Response",
+      "description": "Verifies that security incidents are being detected and properly responded to",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 5,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/tines.json b/integrations-catalog/integrations/tines.json
new file mode 100644
index 0000000000..1fa3171078
--- /dev/null
+++ b/integrations-catalog/integrations/tines.json
@@ -0,0 +1,51 @@
+{
+  "slug": "tines",
+  "name": "Tines",
+  "description": "Monitor Tines security automation workflows for incident response and security operations compliance",
+  "category": "Security",
+  "docsUrl": "https://www.tines.com/api",
+  "baseUrl": "https://app.tines.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Tines\n2. Go to Settings → API Tokens\n3. Generate a new API token\n4. Enter your tenant URL and token below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Tines → Settings → API Tokens"
+        },
+        {
+          "label": "Tenant URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Tines tenant URL (e.g. https://mycompany.tines.com or https://app.tines.com)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "tines_incident_response",
+      "name": "Incident Response",
+      "description": "Verifies Tines security automation stories are configured for incident response",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "tines_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Tines team members with access to security automation workflows",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/together-ai.json b/integrations-catalog/integrations/together-ai.json
new file mode 100644
index 0000000000..d2d0e4fb7a
--- /dev/null
+++ b/integrations-catalog/integrations/together-ai.json
@@ -0,0 +1,35 @@
+{
+  "slug": "together-ai",
+  "name": "Together AI",
+  "description": "AI inference and training platform. Monitor API access and usage.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.together.ai/reference/",
+  "baseUrl": "https://api.together.xyz",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "together_ai_app_availability",
+      "name": "Together AI App Availability",
+      "description": "Checks that the Together AI API is accessible with the provided credentials.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "together_ai_employee_access",
+      "name": "Together AI Employee Access",
+      "description": "Verifies employee access to Together AI via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/toggl.json b/integrations-catalog/integrations/toggl.json
new file mode 100644
index 0000000000..b00dfdea9d
--- /dev/null
+++ b/integrations-catalog/integrations/toggl.json
@@ -0,0 +1,37 @@
+{
+  "slug": "toggl",
+  "name": "Toggl Track",
+  "description": "Time tracking and productivity platform.",
+  "category": "Productivity",
+  "docsUrl": "https://engineering.toggl.com/docs/",
+  "baseUrl": "https://api.track.toggl.com",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "setupInstructions": "1. Log in to Toggl Track\n2. Go to Profile Settings → API Token\n3. Copy your API token\n4. Use the token as username and 'api_token' as password"
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "toggl_app_availability",
+      "name": "Toggl Track App Availability",
+      "description": "Checks Toggl Track app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "toggl_employee_access",
+      "name": "Toggl Track Employee Access",
+      "description": "Checks Toggl Track employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/torq.json b/integrations-catalog/integrations/torq.json
new file mode 100644
index 0000000000..79468279f4
--- /dev/null
+++ b/integrations-catalog/integrations/torq.json
@@ -0,0 +1,45 @@
+{
+  "slug": "torq",
+  "name": "Torq",
+  "description": "Torq security hyperautomation platform",
+  "category": "Security",
+  "docsUrl": "https://docs.torq.io/docs/torq-api",
+  "baseUrl": "https://api.torq.io/public/v2alpha1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Torq\n2. Settings → API Tokens\n3. Create a token with read access\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Torq → Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "torq_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Torq security automation workflows are active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "torq_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Torq users",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/totango.json b/integrations-catalog/integrations/totango.json
new file mode 100644
index 0000000000..eb10e1761d
--- /dev/null
+++ b/integrations-catalog/integrations/totango.json
@@ -0,0 +1,45 @@
+{
+  "slug": "totango",
+  "name": "Totango",
+  "description": "Monitor Totango customer success platform for account health and team access compliance",
+  "category": "Productivity",
+  "docsUrl": "https://support.totango.com/hc/en-us/articles/204163305",
+  "baseUrl": "https://app.totango.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Totango at https://app.totango.com\n2. Go to Settings → Integrations\n3. Copy your Service ID (App Token)\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Service ID (App Token)",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Totango Settings → Integrations → Service ID (also called App Token)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "totango_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Totango users with access to customer success data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "totango_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Totango customer success platform is active",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/transcend.json b/integrations-catalog/integrations/transcend.json
new file mode 100644
index 0000000000..8b521df863
--- /dev/null
+++ b/integrations-catalog/integrations/transcend.json
@@ -0,0 +1,35 @@
+{
+  "slug": "transcend",
+  "name": "Transcend",
+  "description": "Data privacy infrastructure platform. Monitor data mapping and privacy compliance.",
+  "category": "Security",
+  "docsUrl": "https://docs.transcend.io/docs",
+  "baseUrl": "https://api.transcend.io",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "transcend_app_availability",
+      "name": "Transcend App Availability",
+      "description": "Checks that the Transcend API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "transcend_employee_access",
+      "name": "Transcend Employee Access",
+      "description": "Verifies access to Transcend.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/travis-ci.json b/integrations-catalog/integrations/travis-ci.json
new file mode 100644
index 0000000000..080d718f67
--- /dev/null
+++ b/integrations-catalog/integrations/travis-ci.json
@@ -0,0 +1,45 @@
+{
+  "slug": "travis-ci",
+  "name": "Travis CI",
+  "description": "Monitor Travis CI pipelines for automated build and deployment compliance",
+  "category": "Development",
+  "docsUrl": "https://developer.travis-ci.com/",
+  "baseUrl": "https://api.travis-ci.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Travis CI at https://app.travis-ci.com\n2. Click your profile icon → Settings\n3. Copy your API Token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Travis CI → Profile → API Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "travisci_code_changes",
+      "name": "Code Changes",
+      "description": "Verifies Travis CI organizations are configured for automated build pipelines",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "travisci_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Travis CI pipelines manage deployments across environments",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/trellix.json b/integrations-catalog/integrations/trellix.json
new file mode 100644
index 0000000000..db9a24e924
--- /dev/null
+++ b/integrations-catalog/integrations/trellix.json
@@ -0,0 +1,63 @@
+{
+  "slug": "trellix",
+  "name": "Trellix",
+  "description": "Monitor Trellix ePO Cloud managed endpoints, security events, and device inventory",
+  "category": "Security",
+  "docsUrl": "https://developer.manage.trellix.com/mvision/apis/home",
+  "baseUrl": "https://api.manage.trellix.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Go to Trellix Developer Portal > Self Service > API Access Management. Request API access and copy the Client ID."
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Generated when requesting API access in the Trellix Developer Portal. Copy Client Secret immediately — it is only shown once."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Trellix Developer Portal > Self Service > API Access Management section."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Verifies that all Trellix ePO-managed endpoints are in a managed state with active agents",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerting",
+      "name": "Monitoring & Alerting",
+      "description": "Reviews recent Trellix ePO security events and threat detections to verify active monitoring",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Provides a complete inventory of all Trellix ePO-managed devices with agent status and version information",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/trello.json b/integrations-catalog/integrations/trello.json
new file mode 100644
index 0000000000..3ad41dcf09
--- /dev/null
+++ b/integrations-catalog/integrations/trello.json
@@ -0,0 +1,51 @@
+{
+  "slug": "trello",
+  "name": "Trello",
+  "description": "Monitor Trello board organization and workspace members for compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.atlassian.com/cloud/trello/rest/",
+  "baseUrl": "https://api.trello.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to https://trello.com/power-ups/admin\n2. Create a new Power-Up (or select an existing one)\n3. Click on your Power-Up → go to the API Key tab\n4. Copy your API Key\n5. Click the Token link next to your key → click Allow to authorize\n6. Copy the generated token\n7. Enter your API Key and Token below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found at https://trello.com/power-ups/admin → your Power-Up → API Key tab"
+        },
+        {
+          "label": "Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate at https://trello.com/power-ups/admin → your Power-Up → API Key tab → click the Token link"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "trello_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Trello organization members and their access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "trello_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies that Trello boards are organized for environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/trend-micro-vision-one.json b/integrations-catalog/integrations/trend-micro-vision-one.json
new file mode 100644
index 0000000000..c081390960
--- /dev/null
+++ b/integrations-catalog/integrations/trend-micro-vision-one.json
@@ -0,0 +1,65 @@
+{
+  "slug": "trend-micro-vision-one",
+  "name": "Trend Micro Vision One",
+  "description": "Trend Micro Vision One XDR endpoint security platform. Monitor security alerts, endpoints, audit logs, and compliance posture.",
+  "category": "Security",
+  "docsUrl": "https://automation.trendmicro.com/xdr/Guides/API-documentation/",
+  "baseUrl": "https://api.xdr.trendmicro.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Trend Micro Vision One console.\n2. Go to Administration → API Keys.\n3. Click 'Add API Key' and configure:\n   - Name: CompAI Integration\n   - Role: Custom role with required permissions\n   - Permissions needed:\n     * Workbench: View, filter, and search\n     * Audit Logs: View, filter, and search, Export and Download\n     * Endpoint Inventory: View\n4. Copy the API token and select your region below.",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "API token from Vision One console (Administration → API Keys). Create with required permissions: Workbench (View, filter, and search), Audit Logs (View, filter, and search, Export and Download), Endpoint Inventory (View)."
+        },
+        {
+          "label": "Region",
+          "type": "select",
+          "required": true,
+          "helpText": "Select your Vision One region base URL"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "connectivity",
+      "name": "API Connectivity Test",
+      "description": "Verify connection to Vision One API using EICAR test endpoint",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "security_alerts",
+      "name": "Security Alerts Monitoring",
+      "description": "Monitor active security alerts and workbench investigations",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "endpoint_inventory",
+      "name": "Endpoint Device Inventory",
+      "description": "Monitor managed endpoint devices and their protection status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "audit_logs",
+      "name": "Administrative Audit Logs",
+      "description": "Monitor administrative activities and configuration changes",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/trigger-dev.json b/integrations-catalog/integrations/trigger-dev.json
new file mode 100644
index 0000000000..bac2f750b0
--- /dev/null
+++ b/integrations-catalog/integrations/trigger-dev.json
@@ -0,0 +1,45 @@
+{
+  "slug": "trigger-dev",
+  "name": "Trigger.dev",
+  "description": "Trigger.dev open-source background jobs and workflow automation platform",
+  "category": "Development",
+  "docsUrl": "https://trigger.dev/docs",
+  "baseUrl": "https://api.trigger.dev",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Trigger.dev\n2. Go to Settings → Personal Access Tokens\n3. Generate a new token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Trigger.dev → Settings → Personal Access Tokens → Generate Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "trigger_dev_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Trigger.dev platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "trigger_dev_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Trigger.dev projects to verify developer access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/trinet.json b/integrations-catalog/integrations/trinet.json
new file mode 100644
index 0000000000..3fbb64c2c1
--- /dev/null
+++ b/integrations-catalog/integrations/trinet.json
@@ -0,0 +1,38 @@
+{
+  "slug": "trinet",
+  "name": "TriNet",
+  "description": "TriNet HR platform for payroll, benefits, and HR management",
+  "category": "HR & People",
+  "docsUrl": "https://developers.zenefits.com/reference/getting-started",
+  "baseUrl": "https://api.zenefits.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to TriNet at https://secure.zenefits.com\n2. Click the menu icon (☰) → Company Profile\n3. Click Custom Integrations\n4. Under REST API Access, click Add Token\n5. Grant People read access and save\n6. Copy the token and paste it below\n\nNote: Do NOT look under Integrated Apps — that is the vendor marketplace. The API token is under Company Profile → Custom Integrations.",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "TriNet → Admin Apps → Custom Integrations → REST API Access → Add Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "trinet_employee_access",
+      "name": "Employee Access",
+      "description": "Lists TriNet employees to verify HR access is active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/turso.json b/integrations-catalog/integrations/turso.json
new file mode 100644
index 0000000000..2e3597c428
--- /dev/null
+++ b/integrations-catalog/integrations/turso.json
@@ -0,0 +1,45 @@
+{
+  "slug": "turso",
+  "name": "Turso",
+  "description": "Monitor Turso edge SQLite databases for infrastructure inventory and access compliance",
+  "category": "Cloud",
+  "docsUrl": "https://docs.turso.tech/api-reference",
+  "baseUrl": "https://api.turso.tech/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Turso at https://turso.tech\n2. Go to Settings → API Tokens\n3. Create a new API token\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Turso Settings → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "turso_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Turso organizations and databases for edge database infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "turso_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Turso organization members and their database access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/twilio.json b/integrations-catalog/integrations/twilio.json
new file mode 100644
index 0000000000..6d48afa4ff
--- /dev/null
+++ b/integrations-catalog/integrations/twilio.json
@@ -0,0 +1,51 @@
+{
+  "slug": "twilio",
+  "name": "Twilio",
+  "description": "Monitor Twilio account configuration and communication resources for compliance",
+  "category": "Communication",
+  "docsUrl": "https://www.twilio.com/docs/usage/api",
+  "baseUrl": "https://api.twilio.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to https://console.twilio.com — copy your Account SID and Auth Token\n2. Encode credentials: base64('AccountSID:AuthToken')\n3. Enter both the encoded value and raw Account SID below",
+      "credentialFields": [
+        {
+          "label": "Encoded Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode your Account SID and Auth Token: base64('AccountSID:AuthToken'). Use https://www.base64encode.org/"
+        },
+        {
+          "label": "Account SID",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Twilio Account SID from the console dashboard"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "twilio_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Twilio account is active and properly configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "twilio_contact_information",
+      "name": "Contact Information",
+      "description": "Lists Twilio phone numbers for communication infrastructure inventory",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/twingate.json b/integrations-catalog/integrations/twingate.json
new file mode 100644
index 0000000000..1bd066d0af
--- /dev/null
+++ b/integrations-catalog/integrations/twingate.json
@@ -0,0 +1,65 @@
+{
+  "slug": "twingate",
+  "name": "Twingate",
+  "description": "Monitor Twingate zero-trust network access: user access, device trust, groups, remote networks, and security policies",
+  "category": "Security",
+  "docsUrl": "https://www.twingate.com/docs/api-overview",
+  "baseUrl": "https://placeholder.twingate.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Twingate Network Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Twingate network subdomain. If your URL is https://mycompany.twingate.com, enter 'mycompany'."
+        },
+        {
+          "label": "API Key",
+          "type": "text",
+          "required": true,
+          "helpText": "Generate an API key in the Twingate Admin Console: Settings > API > Generate Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "twingate_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Twingate users and their access status. Flags disabled or inactive accounts that still exist.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "twingate_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that Twingate groups are configured with proper access controls. Lists group types, active status, and member counts.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "twingate_secure_devices",
+      "name": "Secure Devices",
+      "description": "Checks device trust status and active state across all Twingate devices.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "twingate_infrastructure_inventory",
+      "name": "Infrastructure Inventory",
+      "description": "Lists all Twingate remote networks with connector and resource counts for infrastructure inventory evidence.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/typeform.json b/integrations-catalog/integrations/typeform.json
new file mode 100644
index 0000000000..a1513d08dc
--- /dev/null
+++ b/integrations-catalog/integrations/typeform.json
@@ -0,0 +1,45 @@
+{
+  "slug": "typeform",
+  "name": "Typeform",
+  "description": "Monitor Typeform survey forms for data collection compliance and access management",
+  "category": "Productivity",
+  "docsUrl": "https://www.typeform.com/developers/create/",
+  "baseUrl": "https://api.typeform.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Typeform at https://admin.typeform.com\n2. Go to your Profile → Developer apps\n3. Create a Personal Access Token\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "Personal Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Typeform Profile → Personal Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "typeform_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Typeform workspace members and their form access",
+      "defaultSeverity": "low",
+      "enabled": true
+    },
+    {
+      "slug": "typeform_data_masking",
+      "name": "Data Masking",
+      "description": "Verifies Typeform forms are not collecting excessive sensitive data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/ukg-ready.json b/integrations-catalog/integrations/ukg-ready.json
new file mode 100644
index 0000000000..c471ac4d4b
--- /dev/null
+++ b/integrations-catalog/integrations/ukg-ready.json
@@ -0,0 +1,69 @@
+{
+  "slug": "ukg-ready",
+  "name": "UKG Ready",
+  "description": "Monitor UKG Ready HRIS for employee records, workforce compliance, and system access controls",
+  "category": "HR & People",
+  "docsUrl": "https://secure7.saashr.com/ta/docs/rest/public/",
+  "baseUrl": "https://secure.saashr.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to UKG Ready\n2. Note your instance URL (e.g. secure3.saashr.com from your login URL)\n3. Note your Company Short Name (visible in the login URL)\n4. Ask your UKG Ready administrator to create a dedicated service account and generate an API Key\n5. Enter all values below",
+      "credentialFields": [
+        {
+          "label": "Instance URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your UKG Ready server hostname (e.g. secure.saashr.com, secure3.saashr.com). Check your UKG Ready login URL."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Developer API key from UKG Ready. Contact your UKG Ready administrator to generate one."
+        },
+        {
+          "label": "Service Account Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Username for the dedicated UKG Ready service account used for API access"
+        },
+        {
+          "label": "Service Account Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Password for the UKG Ready service account"
+        },
+        {
+          "label": "Company Short Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your UKG Ready company short name (numeric or alphanumeric code). Check your UKG Ready login URL or contact your administrator."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "ukg_ready_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews UKG Ready employee records to audit workforce access and employment status",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "ukg_ready_employee_verification",
+      "name": "Employee Verification",
+      "description": "Verifies UKG Ready employment records include required verification data for compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/upcloud.json b/integrations-catalog/integrations/upcloud.json
new file mode 100644
index 0000000000..a309d131c1
--- /dev/null
+++ b/integrations-catalog/integrations/upcloud.json
@@ -0,0 +1,37 @@
+{
+  "slug": "upcloud",
+  "name": "UpCloud",
+  "description": "European cloud infrastructure provider. Monitor servers and resources.",
+  "category": "Cloud",
+  "docsUrl": "https://developers.upcloud.com/",
+  "baseUrl": "https://api.upcloud.com",
+  "authConfig": {
+    "type": "basic",
+    "config": {
+      "setupInstructions": "1. Log in to UpCloud\n2. Go to Account → API credentials\n3. Use your username and password below"
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "upcloud_app_availability",
+      "name": "UpCloud App Availability",
+      "description": "Checks UpCloud app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "upcloud_employee_access",
+      "name": "UpCloud Employee Access",
+      "description": "Checks UpCloud employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/updown.json b/integrations-catalog/integrations/updown.json
new file mode 100644
index 0000000000..23cee7ab00
--- /dev/null
+++ b/integrations-catalog/integrations/updown.json
@@ -0,0 +1,45 @@
+{
+  "slug": "updown",
+  "name": "Updown.io",
+  "description": "Simple website monitoring service. Monitor uptime checks and response times.",
+  "category": "Monitoring",
+  "docsUrl": "https://updown.io/api",
+  "baseUrl": "https://updown.io",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Updown.io\n2. Go to Settings → API\n3. Copy your API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Updown.io → Settings → API."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "updown_app_availability",
+      "name": "Updown.io App Availability",
+      "description": "Verifies Updown.io API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "updown_monitoring",
+      "name": "Updown.io Monitoring",
+      "description": "Verifies uptime monitoring is configured.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/upstash.json b/integrations-catalog/integrations/upstash.json
new file mode 100644
index 0000000000..4c72580267
--- /dev/null
+++ b/integrations-catalog/integrations/upstash.json
@@ -0,0 +1,51 @@
+{
+  "slug": "upstash",
+  "name": "Upstash",
+  "description": "Monitor Upstash serverless Redis and Kafka databases for infrastructure compliance",
+  "category": "Cloud",
+  "docsUrl": "https://upstash.com/docs/devops/developer-api/overview",
+  "baseUrl": "https://api.upstash.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Upstash at https://console.upstash.com\n2. Go to Account > Management API\n3. Click Create API Key\n4. Copy the API key and enter it below with your email",
+      "credentialFields": [
+        {
+          "label": "Email",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Upstash account email address."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "From Upstash Console > Account > Management API > Create API Key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "upstash_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Upstash Redis databases for serverless cache infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "upstash_encryption",
+      "name": "Encryption at Rest",
+      "description": "Verifies Upstash databases have TLS enabled for data in transit",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/userflow.json b/integrations-catalog/integrations/userflow.json
new file mode 100644
index 0000000000..4e1f932de8
--- /dev/null
+++ b/integrations-catalog/integrations/userflow.json
@@ -0,0 +1,45 @@
+{
+  "slug": "userflow",
+  "name": "Userflow",
+  "description": "Userflow in-app onboarding and product adoption platform",
+  "category": "Productivity",
+  "docsUrl": "https://userflow.com/docs/api",
+  "baseUrl": "https://api.userflow.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Userflow\n2. Go to Settings → Integrations → API Keys\n3. Create or copy an API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Userflow → Settings → Integrations → API Keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "userflow_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Userflow product adoption platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "userflow_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Userflow users to verify product adoption access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/veeam.json b/integrations-catalog/integrations/veeam.json
new file mode 100644
index 0000000000..264f0b6a07
--- /dev/null
+++ b/integrations-catalog/integrations/veeam.json
@@ -0,0 +1,63 @@
+{
+  "slug": "veeam",
+  "name": "Veeam Backup & Replication",
+  "description": "Monitor Veeam Backup & Replication for backup job status, backup sessions, repository health, and infrastructure inventory for compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://helpcenter.veeam.com/references/vbr/13/rest/",
+  "baseUrl": "https://veeam-server.example.com:9419/api/v1/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Server URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Veeam B&R server URL (e.g., https://veeam.company.com:9419)"
+        },
+        {
+          "label": "Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Veeam administrator username"
+        },
+        {
+          "label": "Password",
+          "type": "secret",
+          "required": true,
+          "helpText": "Veeam administrator password"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "backup_jobs",
+      "name": "Backup logs",
+      "description": "Monitors backup job status and ensures jobs are running successfully",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "backup_sessions",
+      "name": "Backup Restoration Test",
+      "description": "Reviews recent backup sessions to verify backup completion and success rates",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "repository_health",
+      "name": "Infrastructure Inventory",
+      "description": "Monitors backup repository status and storage capacity for infrastructure compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/veracode.json b/integrations-catalog/integrations/veracode.json
new file mode 100644
index 0000000000..16f978332b
--- /dev/null
+++ b/integrations-catalog/integrations/veracode.json
@@ -0,0 +1,35 @@
+{
+  "slug": "veracode",
+  "name": "Veracode",
+  "description": "Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) platform for identifying security vulnerabilities in applications.",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": null,
+  "authConfig": {
+    "type": "custom",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_code",
+      "name": "Secure Code",
+      "description": "Monitors application scans for security vulnerabilities and findings",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "app_availability",
+      "name": "App Availability",
+      "description": "Verifies that applications are being scanned and monitored for security vulnerabilities",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/vercel.json b/integrations-catalog/integrations/vercel.json
new file mode 100644
index 0000000000..b94f68039d
--- /dev/null
+++ b/integrations-catalog/integrations/vercel.json
@@ -0,0 +1,35 @@
+{
+  "slug": "vercel",
+  "name": "Vercel",
+  "description": "Monitor Vercel deployments and project configuration for cloud compliance",
+  "category": "Cloud",
+  "docsUrl": "https://vercel.com/docs/rest-api",
+  "baseUrl": "https://api.vercel.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vercel_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Vercel projects have active production deployments",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "vercel_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Vercel projects have environment variables configured per environment",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/victorops.json b/integrations-catalog/integrations/victorops.json
new file mode 100644
index 0000000000..52feb96365
--- /dev/null
+++ b/integrations-catalog/integrations/victorops.json
@@ -0,0 +1,51 @@
+{
+  "slug": "victorops",
+  "name": "Splunk On-Call",
+  "description": "Incident management and on-call platform.",
+  "category": "Monitoring",
+  "docsUrl": "https://portal.victorops.com/public/api-docs.html",
+  "baseUrl": "https://api.victorops.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Splunk On-Call\n2. Go to Integrations → API\n3. Copy the API ID and API Key\n4. Paste both below",
+      "credentialFields": [
+        {
+          "label": "API ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Splunk On-Call → Integrations → API."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Splunk On-Call → Integrations → API."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "victorops_app_availability",
+      "name": "Splunk On-Call App Availability",
+      "description": "Checks Splunk On-Call app availability.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "victorops_employee_access",
+      "name": "Splunk On-Call Employee Access",
+      "description": "Checks Splunk On-Call employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/vitally.json b/integrations-catalog/integrations/vitally.json
new file mode 100644
index 0000000000..8d7bd449c2
--- /dev/null
+++ b/integrations-catalog/integrations/vitally.json
@@ -0,0 +1,45 @@
+{
+  "slug": "vitally",
+  "name": "Vitally",
+  "description": "Monitor Vitally customer success platform for account access and customer data compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.vitally.io/integrating-with-vitally/vitally-rest-api",
+  "baseUrl": "https://api.vitally.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Vitally\n2. Go to Settings → Integrations → REST API\n3. Copy your Secret Key\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "Secret Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Vitally Settings → Integrations → REST API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vitally_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Vitally users with access to customer success data",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "vitally_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Vitally customer success platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/vmware-workspace-one.json b/integrations-catalog/integrations/vmware-workspace-one.json
new file mode 100644
index 0000000000..a4570a3958
--- /dev/null
+++ b/integrations-catalog/integrations/vmware-workspace-one.json
@@ -0,0 +1,70 @@
+{
+  "slug": "vmware-workspace-one",
+  "name": "VMware Workspace ONE",
+  "description": "Monitor device compliance, enrollment status, and user access in VMware Workspace ONE UEM (Unified Endpoint Management).",
+  "category": "Security",
+  "docsUrl": null,
+  "baseUrl": "https://as1234.awmdm.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to your Workspace ONE UEM console\n2. Go to Groups & Settings > All Settings > System > Advanced > API > REST API\n3. Enable API access if not already enabled\n4. Copy the API Key (aw-tenant-code) from the General tab\n5. Create or use an admin account with API role access\n6. Enter the console URL (e.g. https://as1234.awmdm.com), username, password, and API key below",
+      "credentialFields": [
+        {
+          "label": "Tenant URL",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Workspace ONE UEM console URL (e.g. https://as1234.awmdm.com)"
+        },
+        {
+          "label": "API Username",
+          "type": "text",
+          "required": true,
+          "helpText": "Admin username with REST API access in Workspace ONE UEM"
+        },
+        {
+          "label": "API Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Password for the API admin user"
+        },
+        {
+          "label": "API Key (aw-tenant-code)",
+          "type": "password",
+          "required": true,
+          "helpText": "REST API key from Groups & Settings > All Settings > System > Advanced > API > REST API"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "secure_devices",
+      "name": "Secure Devices",
+      "description": "Verify enrolled devices are compliant and not compromised in Workspace ONE UEM",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "Retrieve and verify all enrolled devices in Workspace ONE UEM for asset inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Verify user accounts and their enrollment status in Workspace ONE UEM",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/vonage.json b/integrations-catalog/integrations/vonage.json
new file mode 100644
index 0000000000..86ef13b456
--- /dev/null
+++ b/integrations-catalog/integrations/vonage.json
@@ -0,0 +1,51 @@
+{
+  "slug": "vonage",
+  "name": "Vonage",
+  "description": "Vonage (Nexmo) Communications APIs for SMS, voice, video, and messaging",
+  "category": "Communication",
+  "docsUrl": "https://developer.vonage.com",
+  "baseUrl": "https://rest.nexmo.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to dashboard.nexmo.com\n2. Go to API Settings\n3. Copy your API Key and API Secret\n4. Paste them below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "text",
+          "required": true,
+          "helpText": "Vonage API Dashboard → API Settings → API Key"
+        },
+        {
+          "label": "API Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Vonage API Dashboard → API Settings → API Secret"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vonage_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Vonage Communications API account is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "vonage_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Vonage account credentials are valid and access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/vulncheck.json b/integrations-catalog/integrations/vulncheck.json
new file mode 100644
index 0000000000..e2dbaf35ec
--- /dev/null
+++ b/integrations-catalog/integrations/vulncheck.json
@@ -0,0 +1,45 @@
+{
+  "slug": "vulncheck",
+  "name": "VulnCheck",
+  "description": "VulnCheck vulnerability intelligence platform for exploit and threat data",
+  "category": "Security",
+  "docsUrl": "https://docs.vulncheck.com",
+  "baseUrl": "https://api.vulncheck.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to VulnCheck\n2. Go to Account → API Tokens\n3. Create a new token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "VulnCheck → Account → API Tokens → Create Token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vulncheck_app_availability",
+      "name": "App Availability",
+      "description": "Verifies VulnCheck vulnerability intelligence platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "vulncheck_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies VulnCheck team access to vulnerability intelligence",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/vultr.json b/integrations-catalog/integrations/vultr.json
new file mode 100644
index 0000000000..b0f08d4f6b
--- /dev/null
+++ b/integrations-catalog/integrations/vultr.json
@@ -0,0 +1,35 @@
+{
+  "slug": "vultr",
+  "name": "Vultr",
+  "description": "Monitor Vultr cloud instances for infrastructure inventory and separation of environments",
+  "category": "Cloud",
+  "docsUrl": "https://www.vultr.com/api/",
+  "baseUrl": "https://api.vultr.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "vultr_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Vultr cloud instances for infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "vultr_separation",
+      "name": "Separation of Environments",
+      "description": "Verifies Vultr uses multiple regions/VPC configs for environment separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/wandb.json b/integrations-catalog/integrations/wandb.json
new file mode 100644
index 0000000000..a184b18948
--- /dev/null
+++ b/integrations-catalog/integrations/wandb.json
@@ -0,0 +1,35 @@
+{
+  "slug": "wandb",
+  "name": "Weights & Biases",
+  "description": "ML experiment tracking and model management. Monitor project access and team collaboration.",
+  "category": "Cloud",
+  "docsUrl": "https://docs.wandb.ai/ref/python/public-api/",
+  "baseUrl": "https://api.wandb.ai",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "wandb_app_availability",
+      "name": "Weights & Biases App Availability",
+      "description": "Checks that the W&B API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "wandb_employee_access",
+      "name": "Weights & Biases Employee Access",
+      "description": "Verifies employee access to W&B.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/watchguard.json b/integrations-catalog/integrations/watchguard.json
new file mode 100644
index 0000000000..1a2cdeed60
--- /dev/null
+++ b/integrations-catalog/integrations/watchguard.json
@@ -0,0 +1,69 @@
+{
+  "slug": "watchguard",
+  "name": "WatchGuard",
+  "description": "Monitor WatchGuard Cloud firewall policies, device management, and security alerts for compliance",
+  "category": "Security",
+  "docsUrl": "https://www.watchguard.com/help/docs/API/Content/en-US/api_get_started/get_started.html",
+  "baseUrl": "https://api.usa.cloud.watchguard.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in WatchGuard Cloud > Administration > Managed Access"
+        },
+        {
+          "label": "Access ID (Read-write)",
+          "type": "text",
+          "required": true,
+          "helpText": "Read-write Access ID from WatchGuard Cloud > Administration > Managed Access"
+        },
+        {
+          "label": "Access Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Read-write password from WatchGuard Cloud > Administration > Managed Access"
+        },
+        {
+          "label": "API Region",
+          "type": "select",
+          "required": true,
+          "helpText": "Select your WatchGuard Cloud data region"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "production_firewall",
+      "name": "Production Firewall",
+      "description": "Check firewall policies and configuration",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "device_list",
+      "name": "Device List",
+      "description": "List managed WatchGuard devices",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "monitoring_alerts",
+      "name": "Monitoring & Alerting",
+      "description": "Check security alerts and system events",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/webex.json b/integrations-catalog/integrations/webex.json
new file mode 100644
index 0000000000..70ad2182c2
--- /dev/null
+++ b/integrations-catalog/integrations/webex.json
@@ -0,0 +1,35 @@
+{
+  "slug": "webex",
+  "name": "Webex",
+  "description": "Monitor Webex users and team configuration for communication compliance",
+  "category": "Communication",
+  "docsUrl": "https://developer.webex.com/docs/api/v1",
+  "baseUrl": "https://webexapis.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "webex_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Webex users and verifies active accounts",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "webex_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Webex teams are configured for team communication",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/webflow.json b/integrations-catalog/integrations/webflow.json
new file mode 100644
index 0000000000..e199724007
--- /dev/null
+++ b/integrations-catalog/integrations/webflow.json
@@ -0,0 +1,35 @@
+{
+  "slug": "webflow",
+  "name": "Webflow",
+  "description": "Monitor Webflow sites and publishing status for web presence compliance",
+  "category": "Cloud",
+  "docsUrl": "https://developers.webflow.com/reference/",
+  "baseUrl": "https://api.webflow.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "webflow_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Webflow sites are published and live",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "webflow_tls",
+      "name": "TLS / HTTPS",
+      "description": "Verifies Webflow sites have HTTPS and custom domains configured",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/when-i-work.json b/integrations-catalog/integrations/when-i-work.json
new file mode 100644
index 0000000000..780e1e4e77
--- /dev/null
+++ b/integrations-catalog/integrations/when-i-work.json
@@ -0,0 +1,46 @@
+{
+  "slug": "when-i-work",
+  "name": "When I Work",
+  "description": "Employee scheduling and time clock platform.",
+  "category": "HR & People",
+  "docsUrl": "https://apidocs.wheniwork.com/",
+  "baseUrl": "https://api.wheniwork.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to When I Work\n2. Go to Settings → API\n3. Generate or copy your API token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in When I Work → Settings → API Token. Contact support if not visible."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "when_i_work_app_availability",
+      "name": "When I Work App Availability",
+      "description": "Verifies When I Work API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "when_i_work_employee_access",
+      "name": "When I Work Employee Access",
+      "description": "Verifies employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/wistia.json b/integrations-catalog/integrations/wistia.json
new file mode 100644
index 0000000000..a81af6dc4a
--- /dev/null
+++ b/integrations-catalog/integrations/wistia.json
@@ -0,0 +1,45 @@
+{
+  "slug": "wistia",
+  "name": "Wistia",
+  "description": "Wistia video hosting and analytics platform for businesses",
+  "category": "Communication",
+  "docsUrl": "https://wistia.com/support/developers/data-api",
+  "baseUrl": "https://api.wistia.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Wistia\n2. Go to Account → API Access\n3. Copy the API Password\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Password",
+          "type": "password",
+          "required": true,
+          "helpText": "Wistia → Account → API Access → API Password"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "wistia_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Wistia platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "wistia_employee_access",
+      "name": "Employee Access",
+      "description": "Verifies Wistia account access is active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/wiz.json b/integrations-catalog/integrations/wiz.json
new file mode 100644
index 0000000000..6f62660e6b
--- /dev/null
+++ b/integrations-catalog/integrations/wiz.json
@@ -0,0 +1,51 @@
+{
+  "slug": "wiz",
+  "name": "Wiz",
+  "description": "Monitor Wiz cloud security posture management for vulnerability findings and compliance controls",
+  "category": "Security",
+  "docsUrl": "https://docs.wiz.io/wiz-docs/docs/using-the-wiz-api",
+  "baseUrl": "https://api.app.wiz.io/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Wiz at https://app.wiz.io\n2. Go to Settings → Service Accounts\n3. Click Create Service Account with read permissions\n4. Copy the Client ID and Client Secret\n5. Enter both below",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Found in Wiz Settings → Service Accounts → Create Service Account"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Generated when creating a Service Account in Wiz Settings"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "wiz_monitoring",
+      "name": "Monitoring & Alerting",
+      "description": "Verifies Wiz is scanning cloud environments and detecting security issues",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "wiz_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Wiz users with access to cloud security findings",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/workable.json b/integrations-catalog/integrations/workable.json
new file mode 100644
index 0000000000..f033ee1b45
--- /dev/null
+++ b/integrations-catalog/integrations/workable.json
@@ -0,0 +1,51 @@
+{
+  "slug": "workable",
+  "name": "Workable",
+  "description": "Monitor Workable account member access and role assignments for compliance",
+  "category": "HR & People",
+  "docsUrl": "https://workable.readme.io/reference",
+  "baseUrl": "https://www.workable.com/spi/v3/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Workable Subdomain",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Workable subdomain (e.g., 'mycompany' from mycompany.workable.com)"
+        },
+        {
+          "label": "API Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate in Workable: Settings > Integrations > API Access Tokens. Must have r_jobs scope."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Workable account members with their roles to verify appropriate access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "role_based_access",
+      "name": "Role-based Access Controls",
+      "description": "Verifies role assignments for all Workable account members to ensure proper access controls",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/workato.json b/integrations-catalog/integrations/workato.json
new file mode 100644
index 0000000000..8ba16dd76b
--- /dev/null
+++ b/integrations-catalog/integrations/workato.json
@@ -0,0 +1,45 @@
+{
+  "slug": "workato",
+  "name": "Workato",
+  "description": "Monitor Workato enterprise integration platform for automation access and workflow security compliance",
+  "category": "Productivity",
+  "docsUrl": "https://docs.workato.com/workato-api.html",
+  "baseUrl": "https://www.workato.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Workato at https://app.workato.com\n2. Go to Account Settings → API Token\n3. Copy your API token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Workato Account Settings → API token"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "workato_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Workato team members with access to integration automation workflows",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "workato_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Workato integration automation platform is operational",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/workday.json b/integrations-catalog/integrations/workday.json
new file mode 100644
index 0000000000..46d04a0e21
--- /dev/null
+++ b/integrations-catalog/integrations/workday.json
@@ -0,0 +1,68 @@
+{
+  "slug": "workday",
+  "name": "Workday",
+  "description": "Monitor Workday HCM/HR platform for employee access, workforce data, and audit logging compliance",
+  "category": "HR & People",
+  "docsUrl": "https://community.workday.com/sites/default/files/file-hosting/productionapi/versions/v10.0/staffing.html",
+  "baseUrl": "https://{{credentials.tenant_name}}.workday.com/ccx/api/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "Tenant Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Workday tenant name (from your Workday URL)"
+        },
+        {
+          "label": "Tenant ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Workday tenant ID (found in API Client settings)"
+        },
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "OAuth2 API Client ID from Workday"
+        },
+        {
+          "label": "Client Secret",
+          "type": "secret",
+          "required": true,
+          "helpText": "OAuth2 API Client Secret"
+        },
+        {
+          "label": "Refresh Token",
+          "type": "secret",
+          "required": true,
+          "helpText": "OAuth2 Refresh Token (generated during API Client setup)"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Workday worker records and access for HR compliance and employee verification",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "audit_logging",
+      "name": "Access Review Log",
+      "description": "Monitors Workday activity logs for user access events and system audit compliance",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/workos.json b/integrations-catalog/integrations/workos.json
new file mode 100644
index 0000000000..30efd5c29a
--- /dev/null
+++ b/integrations-catalog/integrations/workos.json
@@ -0,0 +1,35 @@
+{
+  "slug": "workos",
+  "name": "WorkOS",
+  "description": "Monitor WorkOS enterprise SSO users and organizations for identity compliance",
+  "category": "Identity & Access",
+  "docsUrl": "https://workos.com/docs/reference",
+  "baseUrl": "https://api.workos.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "workos_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews WorkOS users with SSO access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "workos_access_review",
+      "name": "Access Review Log",
+      "description": "Reviews WorkOS organizations configured for SSO",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/workramp.json b/integrations-catalog/integrations/workramp.json
new file mode 100644
index 0000000000..f8031a374d
--- /dev/null
+++ b/integrations-catalog/integrations/workramp.json
@@ -0,0 +1,38 @@
+{
+  "slug": "workramp",
+  "name": "WorkRamp",
+  "description": "WorkRamp learning management system for employee training",
+  "category": "HR & People",
+  "docsUrl": "https://help.workramp.com/en/articles/6559080",
+  "baseUrl": "https://app.workramp.com/api/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to WorkRamp as admin\n2. Go to Admin Settings → Integrations\n3. Copy your API key\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "WorkRamp → Admin Settings → Integrations → API Key"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "workramp_employee_access",
+      "name": "Employee Access",
+      "description": "Lists WorkRamp users to verify training platform access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/wrike.json b/integrations-catalog/integrations/wrike.json
new file mode 100644
index 0000000000..c1ea23594e
--- /dev/null
+++ b/integrations-catalog/integrations/wrike.json
@@ -0,0 +1,35 @@
+{
+  "slug": "wrike",
+  "name": "Wrike",
+  "description": "Monitor Wrike users and project spaces for project management compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developers.wrike.com/api/v4/",
+  "baseUrl": "https://www.wrike.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "wrike_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Wrike contacts and team members",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "wrike_separation_of_envs",
+      "name": "Separation of Environments",
+      "description": "Verifies Wrike spaces are organized for project separation",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/xata.json b/integrations-catalog/integrations/xata.json
new file mode 100644
index 0000000000..8bcb19dce7
--- /dev/null
+++ b/integrations-catalog/integrations/xata.json
@@ -0,0 +1,45 @@
+{
+  "slug": "xata",
+  "name": "Xata",
+  "description": "Monitor Xata serverless database workspaces for infrastructure and access compliance",
+  "category": "Cloud",
+  "docsUrl": "https://xata.io/docs/rest-api",
+  "baseUrl": "https://api.xata.io/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Xata at https://app.xata.io\n2. Go to Account Settings → Personal API keys\n3. Generate a new API key\n4. Copy and enter it below",
+      "credentialFields": [
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Xata Account Settings → Personal API keys"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "xata_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists Xata workspaces for serverless database infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "xata_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Xata workspace members and their database access permissions",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/xero.json b/integrations-catalog/integrations/xero.json
new file mode 100644
index 0000000000..56fb07eb81
--- /dev/null
+++ b/integrations-catalog/integrations/xero.json
@@ -0,0 +1,46 @@
+{
+  "slug": "xero",
+  "name": "Xero",
+  "description": "Monitor Xero users and contact records for HR and finance compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.xero.com/documentation/api/accounting/overview",
+  "baseUrl": "https://api.xero.com/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Create an app at https://developer.xero.com/app/manage\n2. Set redirect URI to: https://api.trycomp.ai/v1/integrations/oauth/callback\n3. Copy Client ID and Secret\n4. After connecting, enter your Xero Tenant/Organization ID (found in Xero settings URL)",
+      "scopes": [
+        "openid",
+        "profile",
+        "email",
+        "accounting.contacts.read",
+        "offline_access"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "xero_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Xero users with system access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "xero_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Xero contacts are maintained with complete information",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zapier.json b/integrations-catalog/integrations/zapier.json
new file mode 100644
index 0000000000..680851c9e9
--- /dev/null
+++ b/integrations-catalog/integrations/zapier.json
@@ -0,0 +1,35 @@
+{
+  "slug": "zapier",
+  "name": "Zapier",
+  "description": "Workflow automation platform. Monitor connected Zaps and integration access.",
+  "category": "Productivity",
+  "docsUrl": "https://platform.zapier.com/reference/api",
+  "baseUrl": "https://api.zapier.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zapier_app_availability",
+      "name": "Zapier App Availability",
+      "description": "Checks that the Zapier API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zapier_employee_access",
+      "name": "Zapier Employee Access",
+      "description": "Verifies employee access to Zapier via API.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zelt.json b/integrations-catalog/integrations/zelt.json
new file mode 100644
index 0000000000..1975e5fa56
--- /dev/null
+++ b/integrations-catalog/integrations/zelt.json
@@ -0,0 +1,38 @@
+{
+  "slug": "zelt",
+  "name": "Zelt",
+  "description": "Zelt HR and workforce management platform",
+  "category": "HR & People",
+  "docsUrl": "https://zelt.app/",
+  "baseUrl": "https://api.zelt.app/v1",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Zelt\n2. Go to Settings → Integrations → API Tokens\n3. Create a new token\n4. Paste it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Zelt → Settings → Integrations → API Tokens → Create"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zelt_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Zelt employees to verify HR platform access",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zendesk.json b/integrations-catalog/integrations/zendesk.json
new file mode 100644
index 0000000000..10a10798c2
--- /dev/null
+++ b/integrations-catalog/integrations/zendesk.json
@@ -0,0 +1,45 @@
+{
+  "slug": "zendesk",
+  "name": "Zendesk",
+  "description": "Monitor Zendesk agents and group configuration for customer support compliance",
+  "category": "Productivity",
+  "docsUrl": "https://developer.zendesk.com/api-reference/",
+  "baseUrl": "https://yoursubdomain.zendesk.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Zendesk Admin > Apps and Integrations > Zendesk API\n2. Enable Token Access and create an API token\n3. Encode your credentials: base64('your_email/token:your_api_token')\n4. Enter the encoded value below along with your subdomain",
+      "credentialFields": [
+        {
+          "label": "Encoded API Credentials",
+          "type": "password",
+          "required": true,
+          "helpText": "Base64 encode your credentials: {email}/token:{api_token}. Use https://www.base64encode.org/ — encode 'user@example.com/token:your_api_token'"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zendesk_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews Zendesk agents and verifies appropriate access levels",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zendesk_contact_information",
+      "name": "Contact Information",
+      "description": "Verifies Zendesk groups are configured for support organization",
+      "defaultSeverity": "low",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zenefits.json b/integrations-catalog/integrations/zenefits.json
new file mode 100644
index 0000000000..b045cbd469
--- /dev/null
+++ b/integrations-catalog/integrations/zenefits.json
@@ -0,0 +1,38 @@
+{
+  "slug": "zenefits",
+  "name": "Zenefits",
+  "description": "Zenefits HR platform for payroll, benefits, and HR management",
+  "category": "HR & People",
+  "docsUrl": "https://developers.zenefits.com/docs/getting-started",
+  "baseUrl": "https://api.zenefits.com/",
+  "authConfig": {
+    "type": "api_key",
+    "config": {
+      "setupInstructions": "1. Log in to Zenefits at https://secure.zenefits.com\n2. Go to Settings → Custom Integrations → API Tokens\n3. Generate a new token with People read access\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in Zenefits Settings → Custom Integrations → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zenefits_employee_access",
+      "name": "Employee Access",
+      "description": "Lists TriNet HR Platform employees to verify HR access is active",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 1,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zerotier.json b/integrations-catalog/integrations/zerotier.json
new file mode 100644
index 0000000000..f448277272
--- /dev/null
+++ b/integrations-catalog/integrations/zerotier.json
@@ -0,0 +1,45 @@
+{
+  "slug": "zerotier",
+  "name": "ZeroTier",
+  "description": "Monitor ZeroTier software-defined networking for secure network access and device compliance",
+  "category": "Infrastructure",
+  "docsUrl": "https://docs.zerotier.com/api/",
+  "baseUrl": "https://api.zerotier.com/",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to ZeroTier Central at https://my.zerotier.com\n2. Go to Account → API Access Tokens\n3. Generate a new token\n4. Enter it below",
+      "credentialFields": [
+        {
+          "label": "API Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Found in ZeroTier Central → Account → API Tokens"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zerotier_infrastructure",
+      "name": "Infrastructure Inventory",
+      "description": "Lists ZeroTier networks for secure network infrastructure inventory",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zerotier_employee_access",
+      "name": "Employee Access",
+      "description": "Reviews ZeroTier network members to audit private network access",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zoho-crm.json b/integrations-catalog/integrations/zoho-crm.json
new file mode 100644
index 0000000000..eb46fb3c03
--- /dev/null
+++ b/integrations-catalog/integrations/zoho-crm.json
@@ -0,0 +1,59 @@
+{
+  "slug": "zoho-crm",
+  "name": "Zoho CRM",
+  "description": "Zoho CRM customer relationship management. Monitor user access, roles, profiles, and organization settings.",
+  "category": "Productivity",
+  "docsUrl": "https://www.zoho.com/crm/developer/docs/api/v7/",
+  "baseUrl": "https://www.zohoapis.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Zoho API Console at https://api-console.zoho.com\n2. Create a Self Client application\n3. Generate a token with scopes: ZohoCRM.users.READ, ZohoCRM.settings.READ, ZohoCRM.org.READ\n4. Paste the access token below\n5. If your Zoho account is not in the US region, enter your data center domain (e.g. www.zohoapis.eu for EU)\n\nNote: For long-term use, set up OAuth2 refresh tokens via Zoho API Console.",
+      "credentialFields": [
+        {
+          "label": "OAuth Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate from Zoho API Console (https://api-console.zoho.com). Create a Self Client, generate token with scopes: ZohoCRM.users.READ, ZohoCRM.settings.READ, ZohoCRM.org.READ."
+        },
+        {
+          "label": "Zoho Data Center Region",
+          "type": "text",
+          "required": false,
+          "helpText": "Your Zoho data center domain. Examples: www.zohoapis.com (US), www.zohoapis.eu (EU), www.zohoapis.in (IN), www.zohoapis.com.au (AU), www.zohoapis.jp (JP), www.zohoapis.com.cn (CN)."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "zoho_crm_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all Zoho CRM users and verifies their account status.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zoho_crm_rbac",
+      "name": "Role-based Access Controls",
+      "description": "Verifies that Zoho CRM has roles and profiles configured for access control.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zoho_crm_app_availability",
+      "name": "App Availability",
+      "description": "Verifies that the Zoho CRM API is accessible and returns organization information.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 3,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zoho-people.json b/integrations-catalog/integrations/zoho-people.json
new file mode 100644
index 0000000000..e1f0fa5496
--- /dev/null
+++ b/integrations-catalog/integrations/zoho-people.json
@@ -0,0 +1,46 @@
+{
+  "slug": "zoho-people",
+  "name": "Zoho People",
+  "description": "Cloud-based HR management. Monitor employee records and organizational data.",
+  "category": "HR & People",
+  "docsUrl": "https://www.zoho.com/people/api/",
+  "baseUrl": "https://people.zoho.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Go to Zoho API Console at https://api-console.zoho.com\n2. Create a Self Client application\n3. Generate a token with scope: ZOHOPEOPLE.forms.ALL\n4. Paste the access token below\n\nNote: Tokens expire. For long-term use, set up OAuth2 refresh tokens.",
+      "credentialFields": [
+        {
+          "label": "OAuth Access Token",
+          "type": "password",
+          "required": true,
+          "helpText": "Generate from Zoho API Console (https://api-console.zoho.com). Create a Self Client, generate token with scope: ZOHOPEOPLE.forms.ALL."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks",
+    "sync"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": true,
+  "checks": [
+    {
+      "slug": "zoho_people_app_availability",
+      "name": "Zoho People App Availability",
+      "description": "Verifies Zoho People API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zoho_people_employee_access",
+      "name": "Zoho People Employee Access",
+      "description": "Verifies employee access.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zoom.json b/integrations-catalog/integrations/zoom.json
new file mode 100644
index 0000000000..a6b46f74bf
--- /dev/null
+++ b/integrations-catalog/integrations/zoom.json
@@ -0,0 +1,43 @@
+{
+  "slug": "zoom",
+  "name": "Zoom",
+  "description": "Monitor Zoom user access and account security settings including two-factor authentication compliance",
+  "category": "Communication",
+  "docsUrl": "https://developers.zoom.us/docs/api/",
+  "baseUrl": "https://api.zoom.us/",
+  "authConfig": {
+    "type": "oauth2",
+    "config": {
+      "setupInstructions": "1. Go to Zoom App Marketplace (marketplace.zoom.us)\n2. Click 'Develop' > Build App > OAuth\n3. Add redirect URL: https://api.trycomp.ai/v1/integrations/oauth/callback\n4. Add scopes: user:read:admin, account:read:admin\n5. Copy Client ID and Client Secret",
+      "scopes": [
+        "user:read:admin",
+        "account:read:admin"
+      ],
+      "clientAuthMethod": "body",
+      "supportsRefreshToken": true
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "user_access",
+      "name": "Employee Access",
+      "description": "Reviews active Zoom users to verify employee access management",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "mfa_settings",
+      "name": "2FA",
+      "description": "Verifies that two-factor authentication is enforced for Zoom account sign-in",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zscaler-zia.json b/integrations-catalog/integrations/zscaler-zia.json
new file mode 100644
index 0000000000..45d063a1c5
--- /dev/null
+++ b/integrations-catalog/integrations/zscaler-zia.json
@@ -0,0 +1,76 @@
+{
+  "slug": "zscaler-zia",
+  "name": "Zscaler Internet Access",
+  "description": "Cloud security platform providing secure internet access, URL filtering, firewall policies, and DLP. Monitor user access, firewall rules, admin roles, and data loss prevention policies.",
+  "category": "Security",
+  "docsUrl": "https://help.zscaler.com/zia/getting-started-zia-api",
+  "baseUrl": "https://zsapi.zscaler.net",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "credentialFields": [
+        {
+          "label": "ZIA Cloud Name",
+          "type": "text",
+          "required": true,
+          "helpText": "Your Zscaler cloud name. Valid values: zscaler, zscalerone, zscalertwo, zscalerthree, zscloud, zscalerbeta. Found in your ZIA admin portal URL (e.g., admin.zscalerone.net means cloud name is 'zscalerone')."
+        },
+        {
+          "label": "Admin Username",
+          "type": "text",
+          "required": true,
+          "helpText": "ZIA administrator username (email format)."
+        },
+        {
+          "label": "Admin Password",
+          "type": "password",
+          "required": true,
+          "helpText": "ZIA administrator password."
+        },
+        {
+          "label": "API Key",
+          "type": "password",
+          "required": true,
+          "helpText": "ZIA Cloud Service API key. Found in ZIA Admin Portal > Administration > Cloud Service API Security > Cloud Service API Key."
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zia_employee_access",
+      "name": "Employee Access",
+      "description": "Lists all ZIA managed users to verify employee access configuration and review active user accounts.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zia_firewall_rules",
+      "name": "Production Firewall",
+      "description": "Reviews ZIA firewall filtering rules and URL filtering policies to verify security controls are properly configured.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "zia_admin_roles",
+      "name": "Role-based Access Controls",
+      "description": "Reviews ZIA admin users and their assigned roles to ensure proper role-based access control is configured.",
+      "defaultSeverity": "high",
+      "enabled": true
+    },
+    {
+      "slug": "zia_dlp_policies",
+      "name": "Secure Secrets",
+      "description": "Reviews ZIA DLP dictionaries and web DLP rules to verify data loss prevention policies are configured to protect sensitive data.",
+      "defaultSeverity": "high",
+      "enabled": true
+    }
+  ],
+  "checkCount": 4,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zscaler-zpa.json b/integrations-catalog/integrations/zscaler-zpa.json
new file mode 100644
index 0000000000..2e6c85375a
--- /dev/null
+++ b/integrations-catalog/integrations/zscaler-zpa.json
@@ -0,0 +1,35 @@
+{
+  "slug": "zscaler-zpa",
+  "name": "Zscaler Private Access",
+  "description": "Zero trust network access platform. Monitor application access and policies.",
+  "category": "Security",
+  "docsUrl": "https://help.zscaler.com/zpa/api",
+  "baseUrl": "https://config.private.zscaler.com",
+  "authConfig": {
+    "type": "api_key",
+    "config": {}
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zscaler_zpa_app_availability",
+      "name": "Zscaler ZPA App Availability",
+      "description": "Checks that the Zscaler ZPA API is accessible.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zscaler_zpa_employee_access",
+      "name": "Zscaler ZPA Employee Access",
+      "description": "Verifies access to Zscaler ZPA.",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/integrations-catalog/integrations/zuora.json b/integrations-catalog/integrations/zuora.json
new file mode 100644
index 0000000000..952fd3b738
--- /dev/null
+++ b/integrations-catalog/integrations/zuora.json
@@ -0,0 +1,51 @@
+{
+  "slug": "zuora",
+  "name": "Zuora",
+  "description": "Zuora subscription management and recurring billing platform",
+  "category": "Productivity",
+  "docsUrl": "https://developer.zuora.com",
+  "baseUrl": "https://rest.zuora.com",
+  "authConfig": {
+    "type": "custom",
+    "config": {
+      "setupInstructions": "1. Log in to Zuora\n2. Go to Settings → Administration → OAuth Client Management\n3. Create a new OAuth Client\n4. Enter the Client ID and Client Secret below",
+      "credentialFields": [
+        {
+          "label": "Client ID",
+          "type": "text",
+          "required": true,
+          "helpText": "Zuora → Settings → Administration → OAuth Client Management"
+        },
+        {
+          "label": "Client Secret",
+          "type": "password",
+          "required": true,
+          "helpText": "Zuora → Settings → Administration → OAuth Client Management"
+        }
+      ]
+    }
+  },
+  "capabilities": [
+    "checks"
+  ],
+  "supportsMultipleConnections": false,
+  "syncSupported": false,
+  "checks": [
+    {
+      "slug": "zuora_app_availability",
+      "name": "App Availability",
+      "description": "Verifies Zuora billing platform is accessible",
+      "defaultSeverity": "medium",
+      "enabled": true
+    },
+    {
+      "slug": "zuora_employee_access",
+      "name": "Employee Access",
+      "description": "Lists Zuora users to verify billing access is managed",
+      "defaultSeverity": "medium",
+      "enabled": true
+    }
+  ],
+  "checkCount": 2,
+  "isActive": true
+}
diff --git a/packages/analytics/src/components/organization-identifier.tsx b/packages/analytics/src/components/organization-identifier.tsx
new file mode 100644
index 0000000000..035103eec8
--- /dev/null
+++ b/packages/analytics/src/components/organization-identifier.tsx
@@ -0,0 +1,35 @@
+'use client';
+
+import { usePathname } from 'next/navigation';
+import { usePostHog } from 'posthog-js/react';
+import { useEffect, useRef } from 'react';
+
+interface OrganizationIdentifierProps {
+  orgId: string;
+  orgName?: string;
+}
+
+export function OrganizationIdentifier({ orgId, orgName }: OrganizationIdentifierProps) {
+  const posthog = usePostHog();
+  const pathname = usePathname();
+  const isFirstPathnameRun = useRef(true);
+
+  useEffect(() => {
+    if (!posthog || !orgId) return;
+    posthog.group('organization', orgId, orgName ? { name: orgName } : undefined);
+  }, [posthog, orgId, orgName]);
+
+  // Refresh flags on route changes so users pick up admin toggles during
+  // normal SPA navigation. Skip the initial mount — posthog.init() already
+  // fetches flags on page load.
+  useEffect(() => {
+    if (!posthog) return;
+    if (isFirstPathnameRun.current) {
+      isFirstPathnameRun.current = false;
+      return;
+    }
+    posthog.reloadFeatureFlags();
+  }, [posthog, pathname]);
+
+  return null;
+}
diff --git a/packages/analytics/src/hooks/use-feature-flag.ts b/packages/analytics/src/hooks/use-feature-flag.ts
new file mode 100644
index 0000000000..6f6e29e714
--- /dev/null
+++ b/packages/analytics/src/hooks/use-feature-flag.ts
@@ -0,0 +1,14 @@
+'use client';
+
+import { useFeatureFlagEnabled } from 'posthog-js/react';
+
+/**
+ * Returns whether a feature flag is enabled for the current user/group.
+ * Thin wrapper around posthog-js's reactive hook. Returns false until flags
+ * finish loading — callers should treat the flag as the source of truth, and
+ * create + toggle the flag via the admin UI (or PostHog) to enable features
+ * locally.
+ */
+export function useFeatureFlag(flagKey: string): boolean {
+  return useFeatureFlagEnabled(flagKey) === true;
+}
diff --git a/packages/analytics/src/index.ts b/packages/analytics/src/index.ts
index 0ff62235d6..45754873df 100644
--- a/packages/analytics/src/index.ts
+++ b/packages/analytics/src/index.ts
@@ -26,3 +26,5 @@ export const Analytics = {
 // Export components for client usage only
 export * from './components/page-view';
 export * from './components/provider';
+export * from './components/organization-identifier';
+export * from './hooks/use-feature-flag';
diff --git a/packages/db/package.json b/packages/db/package.json
index 23a99b8bfd..abcf57a5fd 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -55,6 +55,7 @@
         "docker:down": "docker compose down",
         "docker:up": "docker compose up -d",
         "lint": "prettier --check 'src/**/*.{ts,tsx,js,jsx,json}' 'prisma/**/*.prisma' && tsc --noEmit",
+        "postinstall": "node scripts/generate-prisma-client-js.js || true",
         "prepublishOnly": "bun run build"
     }
 }
diff --git a/packages/db/prisma/migrations/20260420000000_timeline_feature/migration.sql b/packages/db/prisma/migrations/20260420000000_timeline_feature/migration.sql
new file mode 100644
index 0000000000..0732dbb0f9
--- /dev/null
+++ b/packages/db/prisma/migrations/20260420000000_timeline_feature/migration.sql
@@ -0,0 +1,133 @@
+
+-- CreateEnum
+CREATE TYPE "TimelineStatus" AS ENUM ('DRAFT', 'ACTIVE', 'PAUSED', 'COMPLETED');
+
+-- CreateEnum
+CREATE TYPE "TimelinePhaseStatus" AS ENUM ('PENDING', 'IN_PROGRESS', 'COMPLETED');
+
+-- CreateEnum
+CREATE TYPE "PhaseCompletionType" AS ENUM ('AUTO_TASKS', 'AUTO_POLICIES', 'AUTO_PEOPLE', 'AUTO_FINDINGS', 'AUTO_UPLOAD', 'MANUAL');
+
+-- CreateTable
+CREATE TABLE "TimelineTemplate" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('tml'::text),
+    "frameworkId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "trackKey" TEXT NOT NULL DEFAULT 'primary',
+    "cycleNumber" INTEGER NOT NULL,
+    "templateKey" TEXT,
+    "nextTemplateKey" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "TimelineTemplate_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "TimelinePhaseTemplate" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('tpt'::text),
+    "templateId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "groupLabel" TEXT,
+    "orderIndex" INTEGER NOT NULL,
+    "defaultDurationWeeks" INTEGER NOT NULL,
+    "completionType" "PhaseCompletionType" NOT NULL DEFAULT 'MANUAL',
+    "locksTimelineOnComplete" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "TimelinePhaseTemplate_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "TimelineInstance" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('tli'::text),
+    "organizationId" TEXT NOT NULL,
+    "frameworkInstanceId" TEXT NOT NULL,
+    "templateId" TEXT NOT NULL,
+    "trackKey" TEXT NOT NULL DEFAULT 'primary',
+    "cycleNumber" INTEGER NOT NULL,
+    "status" "TimelineStatus" NOT NULL DEFAULT 'DRAFT',
+    "startDate" TIMESTAMP(3),
+    "pausedAt" TIMESTAMP(3),
+    "lockedAt" TIMESTAMP(3),
+    "lockedById" TEXT,
+    "unlockedAt" TIMESTAMP(3),
+    "unlockedById" TEXT,
+    "unlockReason" TEXT,
+    "completedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "TimelineInstance_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "TimelinePhase" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('tlp'::text),
+    "instanceId" TEXT NOT NULL,
+    "phaseTemplateId" TEXT,
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "groupLabel" TEXT,
+    "orderIndex" INTEGER NOT NULL,
+    "status" "TimelinePhaseStatus" NOT NULL DEFAULT 'PENDING',
+    "startDate" TIMESTAMP(3),
+    "endDate" TIMESTAMP(3),
+    "durationWeeks" INTEGER NOT NULL,
+    "completionType" "PhaseCompletionType" NOT NULL DEFAULT 'MANUAL',
+    "locksTimelineOnComplete" BOOLEAN NOT NULL DEFAULT false,
+    "regressedAt" TIMESTAMP(3),
+    "datesPinned" BOOLEAN NOT NULL DEFAULT false,
+    "completedAt" TIMESTAMP(3),
+    "completedById" TEXT,
+    "readyForReview" BOOLEAN NOT NULL DEFAULT false,
+    "readyForReviewAt" TIMESTAMP(3),
+    "documentUrl" TEXT,
+    "documentName" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "TimelinePhase_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "TimelineTemplate_frameworkId_trackKey_cycleNumber_key" ON "TimelineTemplate"("frameworkId", "trackKey", "cycleNumber");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "TimelineTemplate_frameworkId_templateKey_key" ON "TimelineTemplate"("frameworkId", "templateKey");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "TimelineInstance_frameworkInstanceId_trackKey_cycleNumber_key" ON "TimelineInstance"("frameworkInstanceId", "trackKey", "cycleNumber");
+
+-- AddForeignKey
+ALTER TABLE "TimelineTemplate" ADD CONSTRAINT "TimelineTemplate_frameworkId_fkey" FOREIGN KEY ("frameworkId") REFERENCES "FrameworkEditorFramework"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelinePhaseTemplate" ADD CONSTRAINT "TimelinePhaseTemplate_templateId_fkey" FOREIGN KEY ("templateId") REFERENCES "TimelineTemplate"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelineInstance" ADD CONSTRAINT "TimelineInstance_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelineInstance" ADD CONSTRAINT "TimelineInstance_frameworkInstanceId_fkey" FOREIGN KEY ("frameworkInstanceId") REFERENCES "FrameworkInstance"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelineInstance" ADD CONSTRAINT "TimelineInstance_templateId_fkey" FOREIGN KEY ("templateId") REFERENCES "TimelineTemplate"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelineInstance" ADD CONSTRAINT "TimelineInstance_lockedById_fkey" FOREIGN KEY ("lockedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelineInstance" ADD CONSTRAINT "TimelineInstance_unlockedById_fkey" FOREIGN KEY ("unlockedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelinePhase" ADD CONSTRAINT "TimelinePhase_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "TimelineInstance"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelinePhase" ADD CONSTRAINT "TimelinePhase_phaseTemplateId_fkey" FOREIGN KEY ("phaseTemplateId") REFERENCES "TimelinePhaseTemplate"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TimelinePhase" ADD CONSTRAINT "TimelinePhase_completedById_fkey" FOREIGN KEY ("completedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
diff --git a/packages/db/prisma/schema/auth.prisma b/packages/db/prisma/schema/auth.prisma
index 7edf6af6fe..d03e54822b 100644
--- a/packages/db/prisma/schema/auth.prisma
+++ b/packages/db/prisma/schema/auth.prisma
@@ -15,16 +15,19 @@ model User {
   banExpires                     DateTime?
   isPlatformAdmin                Boolean   @default(false)
 
-  accounts            Account[]
-  auditLog            AuditLog[]
-  integrationResults  IntegrationResult[]
-  invitations         Invitation[]
-  members             Member[]
-  sessions            Session[]
-  fleetPolicyResults  FleetPolicyResult[]
-  evidenceSubmissions EvidenceSubmission[] @relation("EvidenceSubmitter")
-  evidenceReviews     EvidenceSubmission[] @relation("EvidenceReviewer")
-  adminFindings       Finding[]            @relation("AdminFindingCreator")
+  accounts                   Account[]
+  auditLog                   AuditLog[]
+  integrationResults         IntegrationResult[]
+  invitations                Invitation[]
+  members                    Member[]
+  sessions                   Session[]
+  fleetPolicyResults         FleetPolicyResult[]
+  evidenceSubmissions        EvidenceSubmission[] @relation("EvidenceSubmitter")
+  evidenceReviews            EvidenceSubmission[] @relation("EvidenceReviewer")
+  adminFindings              Finding[]            @relation("AdminFindingCreator")
+  timelinePhaseCompletions   TimelinePhase[]
+  lockedTimelineInstances    TimelineInstance[]   @relation("TimelineInstanceLockedBy")
+  unlockedTimelineInstances  TimelineInstance[]   @relation("TimelineInstanceUnlockedBy")
 
   @@unique([email])
 }
diff --git a/packages/db/prisma/schema/framework-editor.prisma b/packages/db/prisma/schema/framework-editor.prisma
index 230fa931da..959ea833f7 100644
--- a/packages/db/prisma/schema/framework-editor.prisma
+++ b/packages/db/prisma/schema/framework-editor.prisma
@@ -22,6 +22,7 @@ model FrameworkEditorFramework {
   frameworkInstances FrameworkInstance[]
   soaConfigurations  SOAFrameworkConfiguration[] // Multiple SOA config versions per framework
   soaDocuments       SOADocument[] // SOA documents from organizations
+  timelineTemplates  TimelineTemplate[]
 
   // Dates
   createdAt DateTime @default(now())
diff --git a/packages/db/prisma/schema/framework.prisma b/packages/db/prisma/schema/framework.prisma
index 9ccb57793c..3d26a45749 100644
--- a/packages/db/prisma/schema/framework.prisma
+++ b/packages/db/prisma/schema/framework.prisma
@@ -15,6 +15,7 @@ model FrameworkInstance {
   // Relationships
   organization       Organization     @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   requirementsMapped RequirementMap[]
+  timelineInstances  TimelineInstance[]
 
   @@unique([organizationId, frameworkId])
   @@unique([organizationId, customFrameworkId])
diff --git a/packages/db/prisma/schema/organization.prisma b/packages/db/prisma/schema/organization.prisma
index b1cbb9eb99..f6e9111d03 100644
--- a/packages/db/prisma/schema/organization.prisma
+++ b/packages/db/prisma/schema/organization.prisma
@@ -81,6 +81,9 @@ model Organization {
   organizationRoles          OrganizationRole[]
   roleNotificationSettings   RoleNotificationSetting[]
 
+  // Timeline
+  timelineInstances          TimelineInstance[]
+
   // Custom frameworks / requirements authored by this org
   customFrameworks   CustomFramework[]
   customRequirements CustomRequirement[]
diff --git a/packages/db/prisma/schema/timeline.prisma b/packages/db/prisma/schema/timeline.prisma
new file mode 100644
index 0000000000..7f3d63ee30
--- /dev/null
+++ b/packages/db/prisma/schema/timeline.prisma
@@ -0,0 +1,121 @@
+enum TimelineStatus {
+  DRAFT
+  ACTIVE
+  PAUSED
+  COMPLETED
+}
+
+enum TimelinePhaseStatus {
+  PENDING
+  IN_PROGRESS
+  COMPLETED
+}
+
+enum PhaseCompletionType {
+  AUTO_TASKS
+  AUTO_POLICIES
+  AUTO_PEOPLE
+  AUTO_FINDINGS
+  AUTO_UPLOAD
+  MANUAL
+}
+
+model TimelineTemplate {
+  id              String   @id @default(dbgenerated("generate_prefixed_cuid('tml'::text)"))
+  frameworkId     String
+  name            String
+  trackKey        String   @default("primary")
+  cycleNumber     Int
+  templateKey     String?
+  nextTemplateKey String?
+  createdAt       DateTime @default(now())
+  updatedAt       DateTime @updatedAt
+
+  framework FrameworkEditorFramework @relation(fields: [frameworkId], references: [id])
+  phases    TimelinePhaseTemplate[]
+  instances TimelineInstance[]
+
+  @@unique([frameworkId, trackKey, cycleNumber])
+  // Note: Postgres treats NULLs as distinct in unique indexes, so this
+  // constraint only enforces uniqueness among rows where templateKey is set.
+  // That's intentional — frameworks without explicit keys (legacy defaults)
+  // are uniquely identified by the (frameworkId, trackKey, cycleNumber)
+  // constraint above, so multiple NULL templateKey rows are permitted.
+  @@unique([frameworkId, templateKey])
+}
+
+model TimelinePhaseTemplate {
+  id                   String              @id @default(dbgenerated("generate_prefixed_cuid('tpt'::text)"))
+  templateId           String
+  name                 String
+  description          String?
+  groupLabel           String?
+  orderIndex           Int
+  defaultDurationWeeks Int
+  completionType       PhaseCompletionType @default(MANUAL)
+  locksTimelineOnComplete Boolean          @default(false)
+  createdAt            DateTime            @default(now())
+  updatedAt            DateTime            @updatedAt
+
+  template TimelineTemplate @relation(fields: [templateId], references: [id], onDelete: Cascade)
+  phases   TimelinePhase[]
+}
+
+model TimelineInstance {
+  id                 String         @id @default(dbgenerated("generate_prefixed_cuid('tli'::text)"))
+  organizationId     String
+  frameworkInstanceId String
+  templateId         String
+  trackKey           String         @default("primary")
+  cycleNumber        Int
+  status             TimelineStatus @default(DRAFT)
+  startDate          DateTime?
+  pausedAt           DateTime?
+  lockedAt           DateTime?
+  lockedById         String?
+  unlockedAt         DateTime?
+  unlockedById       String?
+  unlockReason       String?
+  completedAt        DateTime?
+  createdAt          DateTime       @default(now())
+  updatedAt          DateTime       @updatedAt
+
+  organization     Organization     @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  frameworkInstance FrameworkInstance @relation(fields: [frameworkInstanceId], references: [id], onDelete: Cascade)
+  template         TimelineTemplate @relation(fields: [templateId], references: [id])
+  lockedBy         User?            @relation("TimelineInstanceLockedBy", fields: [lockedById], references: [id])
+  unlockedBy       User?            @relation("TimelineInstanceUnlockedBy", fields: [unlockedById], references: [id])
+  phases           TimelinePhase[]
+
+  @@unique([frameworkInstanceId, trackKey, cycleNumber])
+}
+
+model TimelinePhase {
+  id               String              @id @default(dbgenerated("generate_prefixed_cuid('tlp'::text)"))
+  instanceId       String
+  phaseTemplateId  String?
+  name             String
+  description      String?
+  groupLabel       String?
+  orderIndex       Int
+  status           TimelinePhaseStatus @default(PENDING)
+  startDate        DateTime?
+  endDate          DateTime?
+  durationWeeks    Int
+  completionType   PhaseCompletionType @default(MANUAL)
+  locksTimelineOnComplete Boolean       @default(false)
+  regressedAt       DateTime?
+  datesPinned      Boolean             @default(false)
+  completedAt      DateTime?
+  completedById    String?
+  readyForReview   Boolean             @default(false)
+  readyForReviewAt DateTime?
+  documentUrl      String?
+  documentName     String?
+  createdAt        DateTime            @default(now())
+  updatedAt        DateTime            @updatedAt
+
+  instance      TimelineInstance       @relation(fields: [instanceId], references: [id], onDelete: Cascade)
+  phaseTemplate TimelinePhaseTemplate? @relation(fields: [phaseTemplateId], references: [id])
+  completedBy   User?                  @relation(fields: [completedById], references: [id])
+}
diff --git a/packages/docs/openapi.json b/packages/docs/openapi.json
index 2d2471c231..9efcc80ac9 100644
--- a/packages/docs/openapi.json
+++ b/packages/docs/openapi.json
@@ -2192,6 +2192,92 @@
         ]
       }
     },
+    "/v1/timelines": {
+      "get": {
+        "operationId": "TimelinesController_findAll_v1",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "List timelines for the organization",
+        "tags": [
+          "Timelines"
+        ]
+      }
+    },
+    "/v1/timelines/{id}": {
+      "get": {
+        "operationId": "TimelinesController_findOne_v1",
+        "parameters": [
+          {
+            "name": "id",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "Get a single timeline instance with phases",
+        "tags": [
+          "Timelines"
+        ]
+      }
+    },
+    "/v1/timelines/{id}/phases/{phaseId}/ready": {
+      "post": {
+        "operationId": "TimelinesController_markReadyForReview_v1",
+        "parameters": [
+          {
+            "name": "id",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "phaseId",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "Mark a phase as ready for review",
+        "tags": [
+          "Timelines"
+        ]
+      }
+    },
     "/v1/risks": {
       "get": {
         "description": "Returns all risks for the authenticated organization. Supports both API key authentication (X-API-Key header) and session authentication (Bearer token or cookies).",
diff --git a/packages/integration-platform/src/manifests/github/checks/sanitized-inputs.ts b/packages/integration-platform/src/manifests/github/checks/sanitized-inputs.ts
index 2acdde1373..20364da685 100644
--- a/packages/integration-platform/src/manifests/github/checks/sanitized-inputs.ts
+++ b/packages/integration-platform/src/manifests/github/checks/sanitized-inputs.ts
@@ -1,9 +1,11 @@
 /**
  * Sanitized Inputs Check
  *
- * Ensures repositories use a modern validation/sanitization library
- * (Zod or Pydantic) and have automated static analysis (CodeQL) enabled.
- * Supports monorepos by scanning all package.json/requirements.txt files.
+ * Ensures repositories use a modern validation/sanitization library and have
+ * automated static analysis (CodeQL) enabled. Supports monorepos by scanning
+ * all package.json / requirements.txt / pyproject.toml / composer.json files.
+ *
+ * Validation-library detection covers JS/TS, Python, and PHP ecosystems.
  *
  * Code scanning detection supports:
  * - GitHub CodeQL default setup
@@ -21,10 +23,43 @@ import type {
 } from '../types';
 import { parseRepoBranch, targetReposVariable } from '../variables';
 
-const JS_VALIDATION_PACKAGES = ['zod'];
-const PY_VALIDATION_PACKAGES = ['pydantic'];
+const JS_VALIDATION_PACKAGES = [
+  'zod',
+  'yup',
+  'joi',
+  '@effect/schema',
+  'effect',
+  'valibot',
+  'ajv',
+  'class-validator',
+  'io-ts',
+  'superstruct',
+  'runtypes',
+];
+
+const PY_VALIDATION_PACKAGES = [
+  'pydantic',
+  'marshmallow',
+  'cerberus',
+  'voluptuous',
+  'jsonschema',
+  'schematics',
+  'typeguard',
+];
 
-const TARGET_FILES = ['package.json', 'requirements.txt', 'pyproject.toml'];
+const PHP_VALIDATION_PACKAGES = [
+  'laravel/framework',
+  'respect/validation',
+  'symfony/validator',
+  'vlucas/valitron',
+];
+
+const TARGET_FILES = [
+  'package.json',
+  'requirements.txt',
+  'pyproject.toml',
+  'composer.json',
+];
 
 // Patterns that indicate code scanning is configured in a workflow
 const CODE_SCANNING_PATTERNS = [
@@ -76,7 +111,7 @@ export const sanitizedInputsCheck: IntegrationCheck = {
   id: 'sanitized_inputs',
   name: 'Sanitized Inputs & Code Scanning',
   description:
-    'Verifies repositories use Zod/Pydantic for input validation and have GitHub CodeQL scanning enabled. Scans entire repository including monorepo subdirectories.',
+    'Verifies repositories use a supported input-validation library (JS/TS, Python, or PHP) and have GitHub CodeQL scanning enabled. Scans entire repository including monorepo subdirectories.',
   service: 'code-security',
   taskMapping: TASK_TEMPLATES.sanitizedInputs,
   defaultSeverity: 'medium',
@@ -151,16 +186,68 @@ export const sanitizedInputsCheck: IntegrationCheck = {
       return null;
     };
 
-    const checkPythonFile = (content: string, filePath: string): ValidationMatch | null => {
-      const lower = content.toLowerCase();
-      for (const candidate of PY_VALIDATION_PACKAGES) {
-        if (lower.includes(candidate)) {
-          return { library: candidate, file: filePath };
+    const escapeRegex = (s: string): string =>
+      s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+    const checkPythonFile = (
+      content: string,
+      filePath: string,
+      fileName: string,
+    ): ValidationMatch | null => {
+      // Parse line-by-line so we can strip comments and match package names as
+      // standalone tokens (e.g. don't match "schema" inside "jsonschema" or inside
+      // a prose comment).
+      //
+      // Comment syntax differs between the two Python dependency file formats:
+      //   - pyproject.toml (TOML): `#` starts a comment anywhere outside a string.
+      //     Dependency values are always quoted, so stripping at any `#` is safe
+      //     — the package name in `"name @ url#egg=name"` appears before the URL.
+      //   - requirements.txt (pip): `#` only starts a comment when preceded by
+      //     whitespace (or at line start). This preserves VCS URL fragments like
+      //     `git+https://...#egg=pydantic` used for editable installs.
+      const isTOML = fileName === 'pyproject.toml';
+      const stripCommentRegex = isTOML ? /#.*$/ : /(^|\s)#.*$/;
+      const lines = content.split('\n');
+      for (const rawLine of lines) {
+        const line = rawLine.replace(stripCommentRegex, '').toLowerCase();
+        if (!line.trim()) continue;
+        for (const candidate of PY_VALIDATION_PACKAGES) {
+          const escaped = escapeRegex(candidate.toLowerCase());
+          // Match the package name as a standalone token. Leading context: start
+          // of line or a separator commonly preceding a package name (whitespace,
+          // quote, bracket, comma, semicolon, or `=` for `#egg=name` VCS syntax).
+          // Trailing context: end of line or a separator that can follow a
+          // package name (whitespace, version operator, bracket, quote, comma,
+          // semicolon).
+          const pattern = new RegExp(
+            `(?:^|[\\s"'\\[,;=])${escaped}(?:$|[\\s=<>!~\\[\\]"',;])`,
+          );
+          if (pattern.test(line)) {
+            return { library: candidate, file: filePath };
+          }
         }
       }
       return null;
     };
 
+    const checkComposerJson = (content: string, filePath: string): ValidationMatch | null => {
+      try {
+        const pkg = JSON.parse(content);
+        const deps = {
+          ...(pkg.require || {}),
+          ...(pkg['require-dev'] || {}),
+        };
+        for (const candidate of PHP_VALIDATION_PACKAGES) {
+          if (deps[candidate]) {
+            return { library: candidate, file: filePath };
+          }
+        }
+      } catch {
+        // Invalid JSON, skip
+      }
+      return null;
+    };
+
     const findValidationLibraries = async (
       repoName: string,
       tree: GitHubTreeEntry[],
@@ -182,7 +269,10 @@ export const sanitizedInputsCheck: IntegrationCheck = {
           const match = checkPackageJson(content, entry.path);
           if (match) matches.push(match);
         } else if (fileName === 'requirements.txt' || fileName === 'pyproject.toml') {
-          const match = checkPythonFile(content, entry.path);
+          const match = checkPythonFile(content, entry.path, fileName);
+          if (match) matches.push(match);
+        } else if (fileName === 'composer.json') {
+          const match = checkComposerJson(content, entry.path);
           if (match) matches.push(match);
         }
       }
@@ -335,15 +425,20 @@ export const sanitizedInputsCheck: IntegrationCheck = {
           .filter((e) => e.type === 'blob' && TARGET_FILES.includes(getFileName(e.path)))
           .map((e) => e.path);
 
+        const supportedLibraries = [
+          ...JS_VALIDATION_PACKAGES,
+          ...PY_VALIDATION_PACKAGES,
+          ...PHP_VALIDATION_PACKAGES,
+        ].join(', ');
+
         ctx.fail({
           title: `No input validation library found in ${repo.name}`,
-          description:
-            'Could not detect Zod or Pydantic in any package.json, requirements.txt, or pyproject.toml. Implement input validation and sanitization using one of these libraries.',
+          description: `Could not detect a supported validation library in any package.json, requirements.txt, pyproject.toml, or composer.json. Checked for: ${supportedLibraries}. If you use a different library, you can mark this task manually with evidence.`,
           resourceType: 'repository',
           resourceId: repo.full_name,
           severity: 'medium',
           remediation:
-            'Add Zod (JavaScript/TypeScript) or Pydantic (Python) to enforce schema validation on inbound data.',
+            'Add a supported input-validation library (e.g. Zod/Yup/Joi/Valibot for JS/TS, Pydantic/Marshmallow for Python, Laravel/Respect-Validation for PHP) to enforce schema validation on inbound data.',
           evidence: {
             [repo.full_name]: {
               validation: {
diff --git a/packages/utils/src/devices.test.ts b/packages/utils/src/devices.test.ts
new file mode 100644
index 0000000000..3f1316ee88
--- /dev/null
+++ b/packages/utils/src/devices.test.ts
@@ -0,0 +1,120 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import {
+  STALE_DEVICE_THRESHOLD_DAYS,
+  daysSinceCheckIn,
+  getDeviceComplianceStatus,
+  isDeviceStale,
+} from './devices';
+
+// Fri 2026-04-17 12:00:00 UTC — a fixed "now" for deterministic math.
+const FIXED_NOW = new Date('2026-04-17T12:00:00.000Z');
+
+const originalDateNow = Date.now;
+
+beforeEach(() => {
+  Date.now = () => FIXED_NOW.getTime();
+});
+
+afterEach(() => {
+  Date.now = originalDateNow;
+});
+
+function daysAgo(days: number): Date {
+  return new Date(FIXED_NOW.getTime() - days * 24 * 60 * 60 * 1000);
+}
+
+describe('STALE_DEVICE_THRESHOLD_DAYS', () => {
+  it('is 7 days', () => {
+    expect(STALE_DEVICE_THRESHOLD_DAYS).toBe(7);
+  });
+});
+
+describe('daysSinceCheckIn', () => {
+  it('returns null when lastCheckIn is null', () => {
+    expect(daysSinceCheckIn(null)).toBeNull();
+  });
+
+  it('returns 0 for just now', () => {
+    expect(daysSinceCheckIn(FIXED_NOW)).toBe(0);
+  });
+
+  it('returns whole days (floored) for past timestamps', () => {
+    expect(daysSinceCheckIn(daysAgo(1))).toBe(1);
+    expect(daysSinceCheckIn(daysAgo(6))).toBe(6);
+    expect(daysSinceCheckIn(daysAgo(7))).toBe(7);
+    expect(daysSinceCheckIn(daysAgo(51))).toBe(51);
+  });
+
+  it('accepts ISO strings', () => {
+    expect(daysSinceCheckIn(daysAgo(3).toISOString())).toBe(3);
+  });
+
+  it('returns null for invalid date strings', () => {
+    expect(daysSinceCheckIn('not-a-date')).toBeNull();
+    expect(daysSinceCheckIn('')).toBeNull();
+  });
+});
+
+describe('isDeviceStale', () => {
+  it('treats never-synced devices as stale', () => {
+    expect(isDeviceStale(null)).toBe(true);
+  });
+
+  it('is false for a check-in 6 days ago', () => {
+    expect(isDeviceStale(daysAgo(6))).toBe(false);
+  });
+
+  it('is true exactly at the 7-day boundary', () => {
+    expect(isDeviceStale(daysAgo(7))).toBe(true);
+  });
+
+  it('is true for a check-in 51 days ago', () => {
+    expect(isDeviceStale(daysAgo(51))).toBe(true);
+  });
+
+  it('treats invalid date strings as stale', () => {
+    expect(isDeviceStale('not-a-date')).toBe(true);
+  });
+});
+
+describe('getDeviceComplianceStatus', () => {
+  it('returns "stale" regardless of isCompliant when never synced', () => {
+    expect(getDeviceComplianceStatus({ isCompliant: true, lastCheckIn: null })).toBe('stale');
+    expect(getDeviceComplianceStatus({ isCompliant: false, lastCheckIn: null })).toBe('stale');
+  });
+
+  it('returns "stale" regardless of isCompliant when beyond threshold', () => {
+    expect(getDeviceComplianceStatus({ isCompliant: true, lastCheckIn: daysAgo(8) })).toBe('stale');
+    expect(getDeviceComplianceStatus({ isCompliant: false, lastCheckIn: daysAgo(51) })).toBe(
+      'stale',
+    );
+  });
+
+  it('returns "compliant" for fresh + isCompliant true', () => {
+    expect(getDeviceComplianceStatus({ isCompliant: true, lastCheckIn: daysAgo(1) })).toBe(
+      'compliant',
+    );
+  });
+
+  it('returns "non_compliant" for fresh + isCompliant false', () => {
+    expect(getDeviceComplianceStatus({ isCompliant: false, lastCheckIn: daysAgo(1) })).toBe(
+      'non_compliant',
+    );
+  });
+
+  it('honors the 7-day boundary: day 6 fresh, day 7 stale', () => {
+    expect(getDeviceComplianceStatus({ isCompliant: true, lastCheckIn: daysAgo(6) })).toBe(
+      'compliant',
+    );
+    expect(getDeviceComplianceStatus({ isCompliant: true, lastCheckIn: daysAgo(7) })).toBe('stale');
+  });
+
+  it('returns "stale" for invalid date strings regardless of isCompliant', () => {
+    expect(getDeviceComplianceStatus({ isCompliant: true, lastCheckIn: 'not-a-date' })).toBe(
+      'stale',
+    );
+    expect(getDeviceComplianceStatus({ isCompliant: false, lastCheckIn: 'not-a-date' })).toBe(
+      'stale',
+    );
+  });
+});
diff --git a/packages/utils/src/devices.ts b/packages/utils/src/devices.ts
index 79a9fd9e7c..6d411cec91 100644
--- a/packages/utils/src/devices.ts
+++ b/packages/utils/src/devices.ts
@@ -33,3 +33,50 @@ export function mergeDeviceLists<T>(
 
   return [...priorityDevices, ...uniqueSecondaryDevices];
 }
+
+/** How long without a check-in before a device is considered stale. */
+export const STALE_DEVICE_THRESHOLD_DAYS = 7;
+
+export type DeviceComplianceStatus = 'compliant' | 'non_compliant' | 'stale';
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+function toDate(value: Date | string): Date {
+  return value instanceof Date ? value : new Date(value);
+}
+
+/**
+ * Whole days since `lastCheckIn`. Returns null when the device has never
+ * checked in. Uses `Date.now()` so tests can freeze time.
+ */
+export function daysSinceCheckIn(lastCheckIn: Date | string | null): number | null {
+  if (lastCheckIn === null) return null;
+  const then = toDate(lastCheckIn).getTime();
+  if (Number.isNaN(then)) return null;
+  return Math.floor((Date.now() - then) / MS_PER_DAY);
+}
+
+/**
+ * True when a device hasn't checked in within STALE_DEVICE_THRESHOLD_DAYS.
+ * A device that has never synced is always stale.
+ */
+export function isDeviceStale(lastCheckIn: Date | string | null): boolean {
+  const days = daysSinceCheckIn(lastCheckIn);
+  if (days === null) return true;
+  return days >= STALE_DEVICE_THRESHOLD_DAYS;
+}
+
+/**
+ * Three-state compliance status. Stale wins over the stored `isCompliant`
+ * because old check-in data cannot be trusted.
+ */
+export function getDeviceComplianceStatus({
+  isCompliant,
+  lastCheckIn,
+}: {
+  isCompliant: boolean;
+  lastCheckIn: Date | string | null;
+}): DeviceComplianceStatus {
+  if (isDeviceStale(lastCheckIn)) return 'stale';
+  return isCompliant ? 'compliant' : 'non_compliant';
+}
diff --git a/tools/integrations-catalog-sync/README.md b/tools/integrations-catalog-sync/README.md
new file mode 100644
index 0000000000..d4825dc4c8
--- /dev/null
+++ b/tools/integrations-catalog-sync/README.md
@@ -0,0 +1,61 @@
+# integrations-catalog-sync
+
+Internal tooling to refresh the public `integrations-catalog/` folder from the CompAI production API.
+
+Runs on demand — no cron, no GitHub Action.
+
+## Scripts
+
+- **`sync.mjs`** — fetches every integration from the CompAI internal API, sanitizes the payload (strips check DSL, sync definition, internal IDs, logo URLs), runs a secret-pattern scan on the sanitized output, and writes one JSON per vendor to `integrations-catalog/integrations/<slug>.json`. Dedups by slug, content-hash idempotent, atomic writes, preserves files on fetch failure.
+- **`generate-readme.mjs`** — regenerates `integrations-catalog/README.md` with a full category breakdown + alphabetical vendor tables.
+
+## Usage
+
+Both scripts require two environment variables. Never commit either.
+
+```bash
+export COMPAI_INTERNAL_API_BASE="<internal api base url>"
+export COMPAI_INTERNAL_TOKEN="<internal api token>"
+
+node tools/integrations-catalog-sync/sync.mjs
+node tools/integrations-catalog-sync/generate-readme.mjs
+```
+
+Optional tuning:
+
+- `SYNC_CONCURRENCY` (default `2`) — concurrent fetches. Higher values trigger API rate limits.
+- `SYNC_MIN_INTERVAL_MS` (default `100`) — minimum interval between HTTP requests, enforced globally across all workers. Paces the sync to stay under the API throttle. Increase if you still see 429s; decrease (or set `0`) if the backend is raised later.
+
+## Safety guardrails
+
+`sync.mjs` blocks any sanitized output containing:
+
+- Stripe `pk_/sk_` tokens
+- GitHub tokens (`ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`)
+- AWS access keys (`AKIA...`)
+- Anthropic keys (`sk-ant-...`)
+- Jina keys (`jina_...`)
+- Slack tokens (`xox...`)
+- JWTs
+- Bearer tokens
+- logo.dev `token=pk_...`
+
+A match aborts the write for that integration and is logged. The script exits non-zero if any blocks happen, so CI or a human review catches it.
+
+## Fields stripped from every integration
+
+- `logoUrl` (contains logo.dev publishable token)
+- `checks[].definition` (the DSL — endpoint paths, request bodies, response parsing, aggregation)
+- `checks[].variables`
+- `syncDefinition` (replaced with boolean `syncSupported`)
+- Internal DB IDs (`id`, `integrationId`, `taskMapping`, credential field `id`s)
+- Credential field `placeholder` values
+
+## Fields published
+
+- `slug`, `name`, `description`, `category`
+- `docsUrl`, `baseUrl`
+- `authConfig.type` + sanitized `authConfig.config` (setupInstructions, createAppUrl, setupScript, credentialFields with only `label`/`type`/`required`/`helpText`, scopes, clientAuthMethod, supportsRefreshToken, usernameField, passwordField)
+- `capabilities`, `supportsMultipleConnections`, `isActive`
+- `checks[]` with only `slug`, `name`, `description`, `defaultSeverity`, `enabled`
+- `checkCount`, `syncSupported` (boolean)
diff --git a/tools/integrations-catalog-sync/generate-readme.mjs b/tools/integrations-catalog-sync/generate-readme.mjs
new file mode 100644
index 0000000000..118bd7591e
--- /dev/null
+++ b/tools/integrations-catalog-sync/generate-readme.mjs
@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = join(__dirname, "..", "..");
+const CATALOG_ROOT = join(REPO_ROOT, "integrations-catalog");
+const INDEX_FILE = join(CATALOG_ROOT, "index.json");
+const README_FILE = join(CATALOG_ROOT, "README.md");
+
+const index = JSON.parse(readFileSync(INDEX_FILE, "utf8"));
+const { total, byCategory, integrations, generatedAt } = index;
+
+const categoriesSorted = Object.entries(byCategory).sort((a, b) => b[1] - a[1]);
+
+const byCat = {};
+for (const i of integrations) {
+  const c = i.category || "Uncategorized";
+  (byCat[c] ||= []).push(i);
+}
+
+const catSections = Object.keys(byCat)
+  .sort()
+  .map((cat) => {
+    const rows = byCat[cat]
+      .sort((a, b) => a.name.localeCompare(b.name))
+      .map((i) => `| [${i.name}](${i.file}) | \`${i.slug}\` | ${i.authType} | ${i.checkCount} | ${i.syncSupported ? "✓" : ""} |`)
+      .join("\n");
+    return `### ${cat} (${byCat[cat].length})\n\n| Integration | Slug | Auth | Checks | Sync |\n|-------------|------|------|--------|------|\n${rows}\n`;
+  })
+  .join("\n");
+
+const readme = `# CompAI Integrations Catalog
+
+Public catalog of all compliance integrations available in the [CompAI](https://trycomp.ai) platform.
+
+**${total} integrations** across ${Object.keys(byCategory).length} categories.
+
+> Last updated: ${generatedAt.slice(0, 10)}
+
+## What's in this catalog
+
+Each \`integrations/<slug>.json\` file contains the public-facing metadata for one integration:
+
+- **Vendor info:** name, slug, category, description, docs URL, base URL
+- **Authentication:** auth type + customer-facing setup instructions + credential field labels
+- **Checks:** names + descriptions + default severity of every compliance check we run
+- **Capabilities:** employee sync support, multi-connection support
+
+## What's NOT in this catalog
+
+Implementation details are intentionally excluded:
+
+- Check DSL (endpoint paths, request bodies, response parsing, aggregation logic)
+- Sync definition (how we extract employees)
+- Internal database IDs
+- Credential field format hints or placeholders
+- Vendor logos
+
+## How to read a definition
+
+\`\`\`bash
+curl https://raw.githubusercontent.com/trycompai/comp/main/integrations-catalog/integrations/axonius.json | jq
+\`\`\`
+
+## Summary by category
+
+${categoriesSorted.map(([cat, n]) => `- **${cat}** — ${n} integrations`).join("\n")}
+
+## Full catalog
+
+${catSections}
+
+## How this is maintained
+
+This catalog is synced manually on demand from the CompAI production API using the tooling in [\`tools/integrations-catalog-sync/\`](../tools/integrations-catalog-sync). To request a refreshed snapshot or a new integration, open an issue.
+
+## License
+
+MIT — see repo root LICENSE file.
+`;
+
+writeFileSync(README_FILE, readme);
+console.log(`README.md written with ${total} integrations in ${Object.keys(byCategory).length} categories.`);
diff --git a/tools/integrations-catalog-sync/sync.mjs b/tools/integrations-catalog-sync/sync.mjs
new file mode 100644
index 0000000000..4087741cdf
--- /dev/null
+++ b/tools/integrations-catalog-sync/sync.mjs
@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+
+import { mkdirSync, writeFileSync, existsSync, readdirSync, readFileSync, renameSync, unlinkSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = join(__dirname, "..", "..");
+const CATALOG_ROOT = join(REPO_ROOT, "integrations-catalog");
+const INTEGRATIONS_DIR = join(CATALOG_ROOT, "integrations");
+const INDEX_FILE = join(CATALOG_ROOT, "index.json");
+
+const API_BASE = process.env.COMPAI_INTERNAL_API_BASE;
+const TOKEN = process.env.COMPAI_INTERNAL_TOKEN;
+
+if (!API_BASE) {
+  console.error("COMPAI_INTERNAL_API_BASE env var is required");
+  process.exit(1);
+}
+if (!TOKEN) {
+  console.error("COMPAI_INTERNAL_TOKEN env var is required");
+  process.exit(1);
+}
+
+const HEADERS = { "X-Internal-Token": TOKEN, "Accept": "application/json" };
+
+const SECRET_PATTERNS = [
+  /\b(pk|sk)_(live|test)_[a-zA-Z0-9]{20,}/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bsk-ant-[a-zA-Z0-9_-]{30,}/,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
+  /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}/,
+  /\bjina_[a-zA-Z0-9]{20,}/,
+  /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+  /Bearer\s+[A-Za-z0-9._~+\/=-]{20,}/,
+  /token=pk_[A-Za-z0-9]{15,}/
+];
+
+function scanSecrets(value, path = "") {
+  const hits = [];
+  if (value == null) return hits;
+  if (typeof value === "string") {
+    for (const re of SECRET_PATTERNS) {
+      if (re.test(value)) hits.push(path);
+    }
+  } else if (Array.isArray(value)) {
+    value.forEach((v, i) => hits.push(...scanSecrets(v, `${path}[${i}]`)));
+  } else if (typeof value === "object") {
+    for (const k of Object.keys(value)) hits.push(...scanSecrets(value[k], path ? `${path}.${k}` : k));
+  }
+  return hits;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+const MIN_REQUEST_INTERVAL_MS = parseInt(process.env.SYNC_MIN_INTERVAL_MS || "100", 10);
+let nextAllowedAt = 0;
+
+async function pace() {
+  const now = Date.now();
+  if (now < nextAllowedAt) await sleep(nextAllowedAt - now);
+  nextAllowedAt = Date.now() + MIN_REQUEST_INTERVAL_MS;
+}
+
+async function fetchJson(path, maxRetries = 5) {
+  let lastError;
+  for (let attempt = 0; attempt < maxRetries; attempt++) {
+    await pace();
+    const res = await fetch(`${API_BASE}${path}`, { headers: HEADERS });
+    if (res.ok) return res.json();
+    const text = await res.text();
+    if ((res.status === 429 || res.status >= 500) && attempt < maxRetries - 1) {
+      const retryAfter = parseInt(res.headers.get("retry-after") || "0", 10);
+      const delay = retryAfter > 0 ? retryAfter * 1000 : Math.min(1000 * Math.pow(2, attempt), 15000);
+      lastError = new Error(`${path} HTTP ${res.status}: ${text.slice(0, 200)}`);
+      console.warn(`  ${path} → ${res.status}, backing off ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
+      await sleep(delay);
+      continue;
+    }
+    throw new Error(`${path} HTTP ${res.status}: ${text.slice(0, 200)}`);
+  }
+  throw lastError;
+}
+
+function sanitizeCredentialField(field) {
+  return {
+    label: field.label,
+    type: field.type,
+    required: field.required ?? false,
+    helpText: field.helpText
+  };
+}
+
+function sanitizeAuthConfig(authConfig) {
+  if (!authConfig || typeof authConfig !== "object") return null;
+  const { type, config = {} } = authConfig;
+  const {
+    setupInstructions,
+    createAppUrl,
+    setupScript,
+    credentialFields = [],
+    usernameField,
+    passwordField,
+    scopes,
+    clientAuthMethod,
+    supportsRefreshToken
+  } = config;
+
+  const publicConfig = {};
+  if (setupInstructions) publicConfig.setupInstructions = setupInstructions;
+  if (createAppUrl) publicConfig.createAppUrl = createAppUrl;
+  if (setupScript) publicConfig.setupScript = setupScript;
+  if (Array.isArray(credentialFields) && credentialFields.length > 0) {
+    publicConfig.credentialFields = credentialFields.map(sanitizeCredentialField);
+  }
+  if (usernameField) publicConfig.usernameField = usernameField;
+  if (passwordField) publicConfig.passwordField = passwordField;
+  if (Array.isArray(scopes)) publicConfig.scopes = scopes;
+  if (clientAuthMethod) publicConfig.clientAuthMethod = clientAuthMethod;
+  if (typeof supportsRefreshToken === "boolean") publicConfig.supportsRefreshToken = supportsRefreshToken;
+
+  return { type, config: publicConfig };
+}
+
+function sanitizeCheck(check) {
+  return {
+    slug: check.checkSlug,
+    name: check.name,
+    description: check.description,
+    defaultSeverity: check.defaultSeverity,
+    enabled: check.isEnabled ?? true
+  };
+}
+
+function sanitize(integration) {
+  return {
+    slug: integration.slug,
+    name: integration.name,
+    description: integration.description,
+    category: integration.category,
+    docsUrl: integration.docsUrl,
+    baseUrl: integration.baseUrl,
+    authConfig: sanitizeAuthConfig(integration.authConfig),
+    capabilities: integration.capabilities ?? [],
+    supportsMultipleConnections: integration.supportsMultipleConnections ?? false,
+    syncSupported: integration.syncDefinition != null,
+    checks: Array.isArray(integration.checks) ? integration.checks.map(sanitizeCheck) : [],
+    checkCount: Array.isArray(integration.checks) ? integration.checks.length : 0,
+    isActive: integration.isActive ?? true
+  };
+}
+
+function normalizeSlug(slug) {
+  return String(slug || "").replace(/[^a-z0-9-]/gi, "-").toLowerCase();
+}
+
+function slugToFilename(slug) {
+  return `${normalizeSlug(slug)}.json`;
+}
+
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+function atomicWrite(targetPath, content) {
+  const tmp = `${targetPath}.tmp`;
+  writeFileSync(tmp, content);
+  renameSync(tmp, targetPath);
+}
+
+async function main() {
+  mkdirSync(INTEGRATIONS_DIR, { recursive: true });
+
+  console.log(`Fetching integration list from ${API_BASE}...`);
+  const list = await fetchJson("/dynamic-integrations");
+  console.log(`Found ${list.length} integrations from API.`);
+
+  const seenSlugs = new Map();
+  const expectedSlugs = new Set();
+  const deduped = [];
+  for (const item of list) {
+    const slug = normalizeSlug(item.slug);
+    if (!slug) {
+      console.warn(`  skipped: no slug on id=${item.id}`);
+      continue;
+    }
+    if (seenSlugs.has(slug)) {
+      console.warn(`  duplicate slug="${slug}" (ids=${seenSlugs.get(slug)}, ${item.id}) — keeping first`);
+      continue;
+    }
+    seenSlugs.set(slug, item.id);
+    expectedSlugs.add(slug);
+    deduped.push(item);
+  }
+  if (deduped.length !== list.length) {
+    console.log(`After dedup: ${deduped.length} unique slugs.`);
+  }
+
+  const CONCURRENCY = parseInt(process.env.SYNC_CONCURRENCY || "2", 10);
+  const queue = [...deduped];
+  const results = { written: 0, unchanged: 0, failed: 0, secretsBlocked: 0 };
+  const fetchedSlugs = new Set();
+  const index = [];
+  let completed = 0;
+
+  async function worker() {
+    while (queue.length > 0) {
+      const item = queue.shift();
+      if (!item) break;
+      const slug = normalizeSlug(item.slug);
+      try {
+        const full = await fetchJson(`/dynamic-integrations/${item.id}`);
+        const sanitized = sanitize(full);
+        sanitized.slug = normalizeSlug(sanitized.slug);
+
+        const hits = scanSecrets(sanitized);
+        if (hits.length > 0) {
+          results.secretsBlocked++;
+          console.error(`  [${slug}] BLOCKED: secret pattern at ${hits.join(", ")}`);
+          continue;
+        }
+
+        const filename = slugToFilename(sanitized.slug);
+        const filepath = join(INTEGRATIONS_DIR, filename);
+        const content = JSON.stringify(sanitized, null, 2) + "\n";
+        const newHash = sha256(content);
+        let unchanged = false;
+        if (existsSync(filepath)) {
+          const existing = readFileSync(filepath, "utf8");
+          if (sha256(existing) === newHash) unchanged = true;
+        }
+        if (!unchanged) {
+          atomicWrite(filepath, content);
+          results.written++;
+        } else {
+          results.unchanged++;
+        }
+        fetchedSlugs.add(sanitized.slug);
+        index.push({
+          slug: sanitized.slug,
+          name: sanitized.name,
+          category: sanitized.category,
+          authType: sanitized.authConfig?.type,
+          checkCount: sanitized.checkCount,
+          syncSupported: sanitized.syncSupported,
+          file: `integrations/${filename}`
+        });
+        completed++;
+        if (completed % 50 === 0) console.log(`  ${completed}/${deduped.length}`);
+      } catch (e) {
+        results.failed++;
+        console.error(`  [${slug}] ${e.message}`);
+      }
+    }
+  }
+
+  await Promise.all(Array.from({ length: CONCURRENCY }, () => worker()));
+
+  const staleFiles = readdirSync(INTEGRATIONS_DIR)
+    .filter((f) => f.endsWith(".json"))
+    .filter((f) => {
+      const slug = f.replace(/\.json$/, "");
+      return !expectedSlugs.has(slug);
+    });
+
+  for (const stale of staleFiles) {
+    unlinkSync(join(INTEGRATIONS_DIR, stale));
+    console.log(`  removed stale: ${stale}`);
+  }
+
+  if (results.failed > 0) {
+    for (const item of deduped) {
+      const slug = normalizeSlug(item.slug);
+      if (fetchedSlugs.has(slug)) continue;
+      const filename = slugToFilename(slug);
+      const filepath = join(INTEGRATIONS_DIR, filename);
+      if (existsSync(filepath)) {
+        const existing = JSON.parse(readFileSync(filepath, "utf8"));
+        index.push({
+          slug,
+          name: existing.name,
+          category: existing.category,
+          authType: existing.authConfig?.type,
+          checkCount: existing.checkCount,
+          syncSupported: existing.syncSupported,
+          file: `integrations/${filename}`,
+          stale: true
+        });
+      }
+    }
+  }
+
+  index.sort((a, b) => a.name.localeCompare(b.name));
+  const summary = {
+    generatedAt: new Date().toISOString(),
+    total: index.length,
+    sourceCount: list.length,
+    uniqueSlugs: expectedSlugs.size,
+    byCategory: index.reduce((acc, i) => {
+      const c = i.category || "Uncategorized";
+      acc[c] = (acc[c] || 0) + 1;
+      return acc;
+    }, {}),
+    integrations: index
+  };
+  atomicWrite(INDEX_FILE, JSON.stringify(summary, null, 2) + "\n");
+
+  console.log(`\nDone.`);
+  console.log(`  written: ${results.written}`);
+  console.log(`  unchanged: ${results.unchanged}`);
+  console.log(`  failed: ${results.failed}`);
+  console.log(`  secrets blocked: ${results.secretsBlocked}`);
+  console.log(`  stale removed: ${staleFiles.length}`);
+  console.log(`  total in index: ${index.length}`);
+
+  if (results.failed > 0 || results.secretsBlocked > 0) process.exit(1);
+}
+
+main().catch((e) => {
+  console.error(e.stack || e.message);
+  process.exit(1);
+});