Xama - Access & permissions
Elevale uses OAuth2 client credentials to read metrics from Xama. Elevale does not modify data in the external system. Tokens and keys are encrypted server-side after validation.
Who can connect
Workspace admins and users with permission to manage Workspace Settings integrations.
Connections are managed from Workspace Settings → Integrations.
Requires professional on your workspace plan.
What Elevale accesses
Read-only metrics exposed as KPI data points (see the Data points article).
Connection metadata (account IDs, property IDs, organisation tenants) needed for sync.
No write access to campaigns, repositories, accounting records, or CRM objects unless the provider API requires it for authentication only.
In Xama
A Xama admin opens Settings → Apps → Open API.
Copy three values, in this order: Xama client ID, OAuth2 client ID, and OAuth2 secret.Xama API authenticationAll three are stored encrypted.
Sync direction
Both ways. A later sync writes name, email, phone, address, and date of birth from Elevale to Xama, and from Xama back to Elevale, when the values differ. The company name is included.
Risk assessments are read from Xama into the company profile.
Passport and driving licence numbers are not copied into Elevale.
Disconnect and data retention
Disconnect from Workspace Settings → Integrations to revoke stored credentials and stop scheduled syncs.
Previously synced KPI history remains until you delete or convert those KPIs.
Subprocessors and data handling: Subprocessors and integrations