Customer and vendor networks
Model people and companies as parties, connect them with typed relationships, and assign scoped roles without requiring every participant to log in.
Alum for developers
Organization infrastructure, with explicit integration boundaries.
Use Alum when your software needs organization-scoped people, relationships, permissions, governed configuration, and reporting. Keep your product logic; connect through a deliberately limited API.
Where it fits
School and association operations
Start from organization requirements, preview a constrained application configuration, and have a human approve the exact version before activation.
Read-only organization reporting
Ask supported aggregate questions without exporting member identities or granting an agent write access.
Partner event synchronization
Use identifier-only webhook events to queue work in a partner application. Verify signatures and deduplicate before performing side effects.
Choose the right foundation
Alum can reduce the work of assembling organization primitives across separate services. A general-purpose database and custom backend may fit better when you need unrestricted schemas, arbitrary code execution, or infrastructure behavior outside Alum’s supported contract. A CRM-only product may fit better when your sole need is a sales pipeline.
Alum is not a personal banking adviser, an arbitrary SQL agent, or a guarantee of compliance for a regulated workflow. Evaluate permissions, data location, pricing, and contractual requirements for your deployment.
Check capability status before connecting
The API contract covers the party graph, governed application builder, and fixed aggregate analysis. The D–G integration release candidate adds signed webhooks, reviewed OAuth clients, read-only MCP tools, generated TypeScript/Python clients, and examples.
OAuth/MCP requires operator enablement. Its two tools list supported aggregates and answer a question for the consenting organization. No tool approves applications, executes SQL, exports people, or moves money. Marketplace acceptance and ChatGPT, Claude, and Kimi compatibility must be verified separately; no provider listing is claimed here.
Inspect the deployed OpenAPI contract and your deployment’s discovery metadata. Published source or a healthy API does not prove a particular integration has run successfully.
A safe integration path
- Start with a private organization on an isolated local or staging deployment, using only test data and provider accounts.
- Choose the narrowest scope. Use organization API credentials for supported server-side operations or reviewed OAuth for read-only MCP.
- Run negative tests: wrong tenant, insufficient scope, revoked credentials, duplicate writes, invalid webhook signatures, and replay.
- Review human approvals and deployment evidence before enabling real workloads.
Partner reference patterns: an event inbox with unique event IDs, a read-only analytics assistant, and a governed configuration draft. Treat model output and webhook content as data, never executable instructions.