Security, Admin & Agency

Streams every OneSpot mutation to a SIEM in JSON-Lines, CSV, or CEF format, with daily scheduled and on-demand filtered exports and an optional per-export PGP encryption option.

• 3 export formats (JSON-Lines / CSV / CEF)
• Daily scheduled + on-demand exports
• Filterable by actor, object, action, date range
• SIEM-format presets (Splunk HEC, Elastic ECS)

Replaces Vanta evidence collection

Role-based scope sets (Admin / Sales Manager / Sales Rep / CS Manager / Read-Only) plus per-tool allow/deny overrides and per-user extras — so onboarding a rep is one assignment, not 50 toggle clicks.

• 5 seeded role templates
• Per-tool allow/deny overrides + per-user extras
• Role-discovery wizard (analyzes 30 days of audit log)
• Bulk reassignment

Replaces Drata RBAC

Seeded SOC 2 + GDPR controls, automatic evidence capture from the audit log, and a Data-Subject-Request state machine with built-in 30-day SLA bands and a quarterly review queue.

• Seeded SOC 2 + GDPR controls
• Auto-evidence collection from the audit log
• DSR state machine with 30-day SLA bands
• Per-framework export packet (PDF + JSON) for auditors

Replaces Vanta, Drata

Agency-only: switch into a linked client portal with a short-lived session token. Every API call during the session is scoped to that client — no separate HubSpot login per client.

• Switch into a linked client portal
• Short-lived, tenant-scoped session token
• Session activity log
• Client portal health dashboard

Replaces N separate HubSpot logins

A branded login portal on the agency's own domain with magic-link auth and scoped dashboard access per client. The agency's clients see the agency's brand, not OneSpot.

• Branded login on the agency domain
• Magic-link authentication
• Scoped dashboard per client
• Custom-domain DNS verification

Replaces Whop branded portals

Walks every new user through OAuth → BYOK connections → tier choice → first-value tool, plus a first-run tour of every key surface — so users find value in their first session instead of churning.

• 5-step structured onboarding
• 6-step first-run tour across the key surfaces
• Per-step completion tracking
• Per-user state so teammates each get their own start

Replaces Pendo onboarding

Manages a marketplace listing's metadata — taglines, screenshots, pricing tiers, and scope classification — with per-version snapshotting and validation, so submission errors never burn an attempt.

• Listing metadata management
• Screenshot upload + ordering
• Scope classification (Required / Conditional / Optional)
• Per-version snapshotting

Replaces hand-editing listing JSON

Runs every HubSpot Marketplace certification check against the live install and reports pass / warning / fail with a remediation step for each — so you always know whether you actually meet the bar.

• 14 certification checks against the live install
• Pass / warning / fail status with remediation steps
• Run on demand or on a schedule
• History view of when each check last passed

Replaces guesswork before submission

A deterministic seed-data generator for prospect demos, screencasts, and certification-review walkthroughs — 4 seed kinds with realistic contacts, companies, and deals so a demo never looks empty.

• 4 seed kinds (sales / success / agency / starter)
• Realistic contacts, companies, deals
• Per-prospect named portal links with usage tracking
• Deterministic output + re-seed on demand

Replaces DemoStack

A branded public /status page with component statuses, active and recent incidents, and a 90-day uptime calendar. An auto-probe scheduler polls every component so the page stays live.

• Component statuses (API, DB, AI gateway, HubSpot, queue)
• Active + recent incidents
• 90-day uptime calendar
• Auto-probe scheduler + subscribe-by-email

Replaces Atlassian Statuspage

Referral code generation, signup attribution, conversion tracking, and a payout calculator — with a 4-stage funnel, tiered rewards, and automatic fraud detection.

• Human-friendly 8-character codes
• 4-stage funnel tracking (visited → installed → subscribed → churned)
• Tiered rewards with automatic payout calculation
• Auto-disable on suspected fraud

Replaces Refersion