NimbusOS integrates with more than 35 third-party services across seven categories: CRM, email sending platforms, enrichment and data, email verification, AI, phone and SMS, and data warehouses. Every integration uses the same BYOK credential pattern with Fernet-encrypted storage, the same audit log, and the same per-workspace scoping. This article covers the integration categories, the credential model, and the setup flow.
The Categories
Email sending platforms
ReachInbox is the default and most deeply integrated. The platform pulls campaign state, account health, warmup analytics, and reply events bidirectionally.
Smartlead, Instantly, Lemlist, and Woodpecker are also integrated as sending platforms. NimbusOS can create campaigns in these platforms from its own definitions, sync account health, and pull replies back. They are alternatives to ReachInbox for teams already committed to another platform.
CRM integrations
HubSpot and Salesforce are the primary CRM integrations. Both are bidirectional: contacts, companies, and deal stages sync in both directions. Outreach and Salesloft are supported as well but are usually used as export targets rather than two-way sync sources.
Enrichment providers
Apollo, ZoomInfo, Clearbit, Clay, People Data Labs, Hunter, and Lusha. Each brings a different data set strength. All use BYOK; your provider account pays for credits.
Email verification
ZeroBounce, NeverBounce, and Hunter email verification. All BYOK, all produce the same verification status categories.
AI providers
Anthropic Claude is the primary AI. Used for the hyper personalization engine, reply classification, Nimby chat, and the deliverability brain. Perplexity is used for web research. OpenAI is used for embeddings and Whisper (speech-to-text), not for completions.
Phone and SMS
Twilio, Vonage, Plivo, and Telnyx for VoIP and SMS. Used by the phone dialer and the SMS channel in multichannel campaigns.
Data warehouses
BigQuery, Databricks, and Snowflake. Used for exporting NimbusOS data into your own analytics stack.
Domain and DNS
NameSilo for domain purchasing. Cloudflare and Route53 for DNS. These power the outbound infrastructure pipeline.
Other
Zapier for general automation, Slack for notifications, Google Workspace and Microsoft 365 for calendar-related features (not yet integrated deeply for calendar booking; roadmap item).
The BYOK Pattern
Bring your own key. Every integration asks for credentials scoped to your account with the third party.
Why BYOK
Three reasons this is the default.
Cost transparency. You see every credit used in your provider dashboard. No markup from NimbusOS.
Compliance. Some enterprise contracts require direct vendor relationships. BYOK gives you that.
Capacity. Your rate limits and volume tiers are yours.
How credentials are stored
Fernet-encrypted at rest. The encryption key is workspace-scoped and rotated on a schedule. A database dump does not contain plaintext credentials.
Credentials are loaded into memory only during an outgoing call to the third party. They are never logged, never printed in error messages, and never returned through the API.
Audit logging
Every credential read (decrypt event) writes an AuditLog row with user (or system process), workspace, purpose, and timestamp. The log is queryable in Account Settings.
Every credential change writes a full change log including the previous credential identifier (but not the plaintext) and the actor.
Rotation
Credentials can be rotated without disrupting campaigns. Paste the new credential and save. The platform test-authenticates before replacing. On success, new operations use the new credential. In-flight operations complete with the old credential.
The Integration Setup Flow
For every integration, the flow is the same.
Step 1. Open Integrations, find the provider, click Connect.
Step 2. Enter credentials. The exact fields depend on the provider (API key, API key + secret, OAuth, etc.).
Step 3. Test. The platform makes a test API call. Success is required; failure prompts a specific error message.
Step 4. Configure defaults. Provider-specific settings: which account to sync from, which lists to pull, which events to forward.
Step 5. Save. The integration is now active and appears in the connected list.
Integration Health
Every active integration has a health status visible in Integrations.
- healthy. Last API call succeeded within the last hour.
- degraded. Recent failures but not continuous.
- failed. Consecutive failures for over an hour.
- paused. Manually disabled but credentials retained.
- no_credentials. Credentials removed but integration definition exists.
Failed integrations alert. Degraded integrations warn. The platform retries failed operations with exponential backoff before declaring continuous failure.
Sync Cadence
Most integrations run on a schedule.
- CRM sync. Every 15 minutes by default. Configurable per CRM.
- Sending platform sync. Every 5 minutes for campaign and account state. Event-driven for replies and bounces.
- Enrichment jobs. On demand. No scheduled pulls.
- ISP monitoring. Every 6 hours (Gmail Postmaster), daily (Microsoft SNDS), near-real-time (Yahoo FBL).
- Data warehouse export. Configurable per warehouse. Usually nightly.
Event-driven integrations (webhooks from the provider) fire within seconds of the event. Scheduled integrations have a cadence-dependent lag.
Webhooks vs Polling
Where the provider supports webhooks, NimbusOS prefers them. Webhooks are lower latency and lower cost.
Webhook verification: every inbound webhook is verified against the provider's signature scheme. ReachInbox, Stripe, and Clay use HMAC-SHA256. A webhook without a valid signature is rejected.
Where webhooks are not available, the platform polls. Polling cadences are set conservatively to avoid rate limit issues.
Cross-Integration Patterns
Some workflows span multiple integrations. Examples.
CSV -> enrichment -> verification -> CRM. Import CSV, enrich with Apollo, verify with ZeroBounce, sync the verified enriched contacts to HubSpot.
HubSpot lead -> ReachInbox campaign. New HubSpot contact triggers enrollment in a NimbusOS sequence routed through ReachInbox.
ReachInbox reply -> Slack notification -> CRM update. A positive reply in ReachInbox fires a Slack DM to the rep, and an update to the HubSpot contact record.
These are built with the Automation engine, not as custom integrations. Standard building blocks, composed.
Disconnecting an Integration
Disconnecting has three options.
Pause. Disable the integration but keep credentials. Operations halt; status shows paused.
Disconnect with credential retention. Remove active sync but keep credentials for later reconnection.
Disconnect with credential removal. Full removal. Credentials are hard-deleted after the audit log is written. A disconnected integration with removed credentials has to go through full setup again to reconnect.
Depending on the integration, disconnecting may leave sync state behind (for example, contacts previously synced from HubSpot stay in NimbusOS). Explicit cleanup is available where relevant.
Integration Limits
Default limits per workspace:
- 35 total active integrations
- 10 CRM integrations
- 5 sending platform integrations
- 15 enrichment provider integrations
- Unlimited data warehouse exports
Most workspaces use 5 to 10 integrations actively. Going near the limits usually indicates unconsolidated workflows.
Enterprise Integrations
Some integrations are enterprise tier only. Listed in the Enterprise Integrations section of the Integrations page.
- Single Sign-On (SSO). SAML 2.0 with Okta, Azure AD, Google, and generic providers.
- Advanced data warehouse export. Real-time streaming, schema customization, dedicated connector.
- Custom SMTP bulk. Direct MTA integration for very high volume senders.
- On-premises connectors. For self-hosted CRMs and databases.
Contact sales for enterprise integration availability.
Troubleshooting
"Integration shows healthy but sync is not happening"
Check the sync configuration. An integration can be connected and healthy but not actively syncing if no sync task is scheduled. Open the integration detail to see the next scheduled sync time.
"Credentials keep invalidating"
The provider has rotated or expired the credential. OAuth-based integrations need re-auth periodically. API key integrations need manual rotation if the provider expires keys.
"Webhook events are not arriving"
Check the webhook URL configured at the provider side. Make sure it matches the NimbusOS endpoint. Check the webhook log for signature verification failures.
Frequently Asked Questions
Do I pay NimbusOS for integration usage?
No. You pay the third-party provider directly through BYOK. NimbusOS does not mark up provider costs.
Can I use an integration without BYOK?
For some integrations (ReachInbox, specifically), NimbusOS offers a managed option where you pay NimbusOS and NimbusOS provides the underlying service. For most enrichment and verification providers, BYOK is required.
How do I request a new integration?
Open a support ticket. Integration requests are prioritized by user demand. Integrations in the top ten of requests ship within a quarter typically.
What to Read Next
Useful next pages after this one: CRM Integrations for HubSpot and Salesforce setup, Outreach Tools for ReachInbox, Smartlead, and Instantly integration, and BYOK (Bring Your Own Key) for the credential model deep dive.