Integrations

Keep Your Systems. ComplyFlow Connects to Them Three Ways.

Native connectors for twelve systems, an open REST API for anything else with an API, and an MCP server for your AI assistant. Below: how each way works, how the data moves, and a directory of the systems our customers run.

Book a Demo Find Your Systems

IT & Data
Procurement
Facilities
Operations
Safety & HSE

What the Integrations Do.

ComplyFlow connects to the systems you already run in three ways: native connectors for twelve named systems, an open REST API for anything else with an API, and an MCP server for your AI assistant. Nothing is replaced; the compliance record sits beside your ERP, your identity provider, and your BI tool.

Way one: twelve systems connect natively. Microsoft and Okta for sign-on; Yardi and TechnologyOne; KeyWatcher, Unicard, and Torus for access and keys; intelliPermit, hsi, and solv; Power BI and CoreVision for reporting.
Way two: everything else with an API uses ours. Every module read; staff, sites, work orders, inspections, and competencies written. JWT, a test environment, a documented endpoint per module.
Way three: your AI assistant reads it through MCP. Claude, Claude Code, or GitHub Copilot on scoped, expiring tokens, read-only if you want, with the permissions of the person who made them.
Whichever way, your ERP asks before it releases work. A work order arrives with its supplier; your system reads the supplier’s compliance and holds the job until they are cleared.

A systems analyst at a two-monitor desk in an Australian corporate office, API documentation open on one screen and a reporting dashboard on the other, both soft

How We Connect

Three Ways In.

Every system reaches the compliance record one of three ways. Most stacks use two.

Native Connector

Twelve systems ComplyFlow has built connectors for and maintains. We switch it on for your tenancy; your team writes nothing.

Good for sign-on, property and work orders, access hardware, permits, reporting.
See the twelve
Open REST API

Anything with an API of its own connects to ours: JWT sign-in, test and production, every module readable, writes where work is raised. Documented before you buy.

Good for ERP, HR, maintenance, procurement, BI, and integration platforms.
Read the API documentation
MCP Server

Your AI assistant works with the live record on a personal token with only the scopes you choose, read-only if you want it to be. Claude, Claude Code, and GitHub Copilot documented.

Good for a person asking a question, rather than a system moving data.
More on MCP below

Find Your Systems

Find Your Systems. See How Each One Connects.

The systems our customers run, from the ERP to the key cabinet. Pick a category or search a name; each card says which of the three ways in carries it. Not here? If it has an API, it connects the same way.

938 systems

Native means ComplyFlow built and maintains the connector. API means the system has an API of its own and connects to ours through the documented endpoints; it is the mechanism, not a promise that a connector already exists. MCP means your AI assistant reads the record. Vendor marks belong to their owners.

Ask About a System

How the Data Moves, Whichever Way It Connects

Work Comes In. Clearance and Proof Go Out.

Read it left to right: the systems that raise work and hold identity, the one record that checks it, and the systems that read the result.

What sends to ComplyFlow

Work orders from your ERP or maintenance systemYardi and TechnologyOne natively; SAP, Oracle, Maximo, MEX, and Pronto through the API API

Access control and key cabinetsKeyWatcher Australia, Unicard, and Torus native

Permit and safety systemsintelliPermit, hsi, and solv native

Sign-on from Microsoft or OktaYour people log in the way they already do, with your MFA and conditional access native

Training completions from your LMSA completion lands on the Worker’s competency through the API

Integrate any existing system and hardwareIf it has an API, it belongs on this drawing: access control, CMMS, ERP, identity, BI Universal

What reads from ComplyFlow

Power BI and CoreVision dashboardsCompliance beside spend and safety, on your refresh schedule native

Your ERP, before it releases the jobSupplier compliance read through the API; the order is held until the supplier is cleared API

Your AI assistant, through MCPClaude, Claude Code, and GitHub Copilot read the record, and change it only if you allow MCP

Owners, auditors, and investigatorsThe sign-in book, approvals, and inspections as PDF, with names and dates

Your own codeJWT authentication, a test environment, and a documented endpoint per module

Email and mobile alertsThe people who need to act hear about it where they already are Real-time

Twelve connectors are ComplyFlow’s own. Everything else in your stack connects through the open API and MCP, so if a system has an API, it belongs on this drawing.

How It Works

Four Screens That Carry the Feature.

The tokens your tools hold, the work orders your ERP sent, the suppliers your BI tool reads, and the assistant asking the record.

The Tokens, and What Each May Do.

Every connected tool holds a personal token named for what it is. Each carries only the scopes it needs, read or write, and expires within a year.

Read or write scopes, per module
Expiry from 7 days to one year
Shown once; up to 10 per user

Personal API tokens 4 of 10

Every token carries only the scopes you give it. A token is shown once, at creation, and never again.

New token

Claude Code · Safety Team incidents:readinspections:readrisks:read
Expires14 Nov 2026 Last used2 minutes ago Revoke
Power BI · Monthly board pack sites:readcontractors:readstaff:read
Expires02 Mar 2027 Last usedToday, 6:00am Revoke
Copilot · Procurement contractors:read
Expires30 Sep 2026 Last usedYesterday Revoke
Terminal ops · sign-in book sites:readpermits:read
Expires11 Oct 2026 Last used3 days ago Revoke

Prefix cf_pat_ · expiry of 7, 30, 60, or 90 days, one year, or a date of your choosing up to one year · revoking takes effect immediately.

The Work Order, Checked Before It Is Released.

Your maintenance system adds the order through the API and reads the supplier’s compliance before it releases the job. Cleared, and the Worker signs in to the order; not cleared, and your system holds it with the reason on the supplier’s record.

Add, update, list, and read work orders
Supplier compliance read through the API
Workers sign in to the order in Live Access

Work orders 4 received today

Raised in your maintenance or ERP system. Your system reads each supplier's compliance here before it releases the job.

Replace chiller 2 compressorWO-88214 · from Maintenance system Harbour MechanicalHarrow Street Tower Supplier cleared
Annual switchboard thermal scanWO-88209 · from Maintenance system Southline ElectricalMarlow Point Terminal Supplier not clearedPublic liability expired 03 Sep · held in your system
Roof anchor recertificationWO-88197 · from ERP Harbour LiftsGreyhaven Wharf 9 Supplier cleared
Fire panel quarterly testWO-88190 · from ERP Tallis FireHarrow Street Tower Supplier cleared

The Suppliers, as Your BI Tool Sees Them.

The supplier list with each company’s status and the documents behind it is one API call. Enterprise Clients pull it into Power BI beside spend and safety data.

Supplier list, details, and compliance endpoints
Documents and expiries behind each status
Refreshed on your schedule, not ours

Suppliers 128

Every contractor company on your panel, measured against the requirements you set.

Add Suppliers

Supplier Categories Status Sites Next expiry

Tallis Civil Pty LtdABN 41 … Civil, High Risk Cleared Kwinana Terminal and 2 others PL insurance, 28 Feb 2027

Southline ElectricalABN 77 … Electrical Pending review Ballarat Line Prequal awaiting review

Harbour Lifts Pty LtdABN 19 … Lifts, High Risk Not cleared Port Botany Workers comp expired 02 Sep

Northgate CleaningABN 58 … Cleaning Cleared Kwinana Terminal and 4 others Modern slavery form, 14 Oct

Ridgeway ScaffoldABN 63 … Scaffold, High Risk Cleared Ballarat Line and 1 other SWMS review, 30 Nov

The Assistant, Asking the Record.

A safety manager asks which sites reported incidents this month. Through MCP the assistant reads the register with the scopes on their token and answers with the rows. On read scopes only it looks and changes nothing; with write scopes it can act, within the user’s own permissions.

Claude, Claude Code, and GitHub Copilot
Read-only if you want, with the user’s own permissions
Configured in a few lines from the Help Centre

You

Which sites reported incidents this month, and what was the most serious at each?

Assistant

Reading ComplyFlowlist_incidentsget_site

Three sites reported incidents in September. From your ComplyFlow record:

Site	Incidents	Most serious
Marlow Point Terminal	3	Medical treatment
Greyhaven Wharf 9	2	First aid
Wattle Creek Line	1	Near miss

I can read your incidents, inspections, suppliers, workers, risks, plant, sites, and permits with the scopes on your token. This token has read scopes only, so I cannot change anything.

The Third Way: Model Context Protocol

Ask Your AI Assistant About Your Sites. It Reads ComplyFlow.

What it is: MCP is the open standard that lets an AI assistant read another system safely. ComplyFlow ships an MCP server, so the assistant your team already uses can read your compliance record.
What it lets you do: Ask who is on site, which suppliers are not cleared, which inspections are overdue, or what happened at a site last month, in plain English, and get the answer from the live record.

Read-only if you want it to be. A personal token with only the scopes you choose, read or write, expiring within a year, and never more than the person who made it is allowed to do.

Our own MCP server, live since June 2026. The first among the contractor compliance platforms we track. Read the MCP Guide

You

Which sites reported incidents this month, and what was the most serious at each?

Assistant

Reading ComplyFlowlist_incidentsget_site

Three sites reported incidents in September. From your ComplyFlow record:

Site	Incidents	Most serious
Marlow Point Terminal	3	Medical treatment
Greyhaven Wharf 9	2	First aid
Wattle Creek Line	1	Near miss

I can read your incidents, inspections, suppliers, workers, risks, plant, sites, and permits with the scopes on your token. This token has read scopes only, so I cannot change anything.

MCP

Who is on site at Gate B right now?
Which suppliers with open work orders are not cleared?
What is overdue on the risk register?
List incidents reported this month

Who It Is For

What the Integrations Mean for Me.

Find your job. The three lines under it are what connecting your systems changes for you.

Tell Us What You Need to Connect. We Will Tell You Which Way In Fits.

Name the systems, the direction the data has to travel, and who owns them. Someone who has connected ComplyFlow to maintenance systems, identity providers, and BI tools will come back to you.

Which of the three ways in suits each system: native, API, or MCP
What a supplier’s compliance read looks like beside a work order
How tokens are scoped, who can create one, and how they are revoked

Book a Demo Instead

A straight answer from someone who has set this up before, not a brochure.

Send Us a Message

Tell us what you need and who you are.

Send Message

The form loads from HubSpot. If it does not appear, the button takes you to the contact page.

A printed spreadsheet of contractor records spread across an office desk beside a laptop, columns highlighted by hand, and a USB stick and a coffee cup on the pages

How It Stacks Up

Where Integration Usually Lives, and What Each Misses.

Most compliance systems integrate by CSV export, by an API you have to ask about, or by a connector for one named product.

	CSV exportsWorks once; wrong by the time it is opened	An API on requestDocumented after you sign	A connector for one productNothing for the rest of your stack	ComplyFlowOne record, your standard
Native connectors to named systems	Not there	Not there	Partly	Twelve, including sign-on, property, access control, and reporting
Documented in the open, before you buy	Not there	Not there	Partly	A public Help Centre collection, grouped by module
Reads every module; writes where work is raised	Partly	Partly	Not there	Reads all; writes staff, sites, work orders, inspections, competencies
Work orders checked against supplier compliance	Not there	Partly	Partly	Add and update through the API; compliance read beside them
Your AI assistant reads the live record	Not there	Not there	Not there	MCP server; scoped tokens, read-only if you want
A test environment to build against	Not there	Partly	Partly	Test and production base URLs, documented

This compares kinds of approach, by how they are sold, not named vendors. Named comparisons, with dates and sources, live on the comparison pages.

What You Get

What the Integrations Deliver, in Plain Words.

No re-keying, no exports, no work released to a contractor who is not cleared, and answers in the tools your people already have open.

A maintenance planner in hi-vis in a plant room checking a work order on a tablet against the compliance plate of a chiller, with pipes and a switchboard behind

Work Is Not Released to the Uncleared

Your ERP raises the order and asks ComplyFlow whether the supplier is cleared before it releases the job.

Your Developers Read It Before They Ask

The API documented in the Help Centre, module by module, with a test environment.

Access Ends When Your Directory Says So

Single sign-on from Microsoft or Okta, with your MFA and conditional access, and a per-user SSO-only setting.

Live Compliance in Your Board Pack

Power BI and CoreVision natively; Looker, Qlik, or your own tool through the API.

Training Written Once, Read at the Gate

Your LMS updates the competency through the API; the Worker is cleared at the next scan.

Answers Where Your People Already Are

Claude, Claude Code, or Copilot connected through MCP, reading the live record on a token you can revoke.

Getting Started

We Set It Up With You. We Stay With You.

You are not handed an API key and left to it. Our team maps your systems, sets up the test environment with your developers, and stays on hand once the first work order comes through.

1 We Map Your Systems
Which system raises work, which holds identity, which reports, and which training records need to land on the Worker.
2 We Switch On the Connectors
Sign-on, property, access control, and reporting connectors where you run them, and the test environment for everything else.
3 We Connect Your Assistant
Scoped tokens for the MCP server in Claude Code or Copilot, and the first questions answered from your data.
4 You Go Live, We Stay Close
The first work orders checked, the first reports refreshed, and a support team that picks up the phone.

ISO 27001Certified 2019
Certified 2023
Compliant 2020
Single sign-on

Security & Data

Certified, Audited & Hosted in Australia.

Your compliance record is the evidence you rely on when somebody asks, so where it lives and who can reach it matters. ComplyFlow is ISO 27001 certified, runs on AWS in Australia, and your people sign in with the accounts they already have.

Questions

Questions IT Teams Ask About Integrations Before a Demo.

Which of the three ways in should we use?

If your system is one of the twelve, native, and we set it up for you. If it has an API of its own, your developers or your integration platform build against ours, with a test environment first. If the question is being asked by a person rather than a system, MCP, in the assistant they already use, read-only if you want it to be. Most stacks are a mix, and a scoping call settles it in half an hour.

Which systems connect natively?

Twelve: Microsoft and Okta for sign-on; Yardi and TechnologyOne; KeyWatcher Australia, Unicard, and Torus for access control and key management; intelliPermit, hsi, and solv; and Power BI and CoreVision for reporting. Everything else connects through the open API and MCP.

Is the API documented, and can we read it before we buy?

Yes. The API Documentation collection in the Help Centre is public and grouped by module: authorisation, staff, suppliers and contractors, Workers, documents, plant, training, incidents, inspections, Live Access, the risk register, forms and permits, work orders, and sites.

How does authentication work?

The REST API uses JSON Web Tokens against a test or a production base URL. The MCP server uses personal API tokens prefixed cf_pat_, scoped per module, read or write as you choose, and expiring within a year. Single sign-on through Microsoft uses OAuth 2.0 with short-lived tokens and no password stored.

Can our ERP or maintenance system gate work on compliance?

Yes, once it is set up to ask. Work orders are added and updated through the API, and a separate endpoint returns a supplier’s compliance. ComplyFlow holds the status; your system reads it before it releases the order and holds the job if the supplier is not cleared.

Can we report on the data in Power BI?

Yes. Power BI and CoreVision connect natively, every module is readable through the API, and enterprise Clients already build their own reporting on it.

What can an AI assistant do through MCP, and what can it not?

Whatever the token allows, and never more than the user could do. Claude, Claude Code, and GitHub Copilot can look up and summarise incidents, inspections, suppliers and contractors, Workers, the risk register, plant, sites, and permits, within the token’s scopes and the user’s permissions. Give the token read scopes only and they cannot change anything; add write scopes and they can act on the answer too.

See It Against Your Own Systems.

Book a 30-minute demo and bring your IT lead. We will walk the endpoints your systems need, create a scoped token live, and read a supplier’s compliance beside a work order. No slides, no hard sell.

Book a Demo Speak to Us

ISO 27001
Hosted on AWS
Microsoft & Okta SSO
API & MCP
Data in Australia

Compliance you can prove, instantly.