Sightspool has no data of its own. Everything it claims traces back to a source you connected, and every source is scoped to a single workspace. This page covers what you can connect, what each source contributes, and how credentials are handled.
What you can connect
- PostHog — behavioural evidence. The register's signals run against your project, and it is the delivery channel when a study is better served by a survey you already own.
- GitHub — the repository as a source. Sightspool watches what you ship, re-arms assumptions a change threatens, and drafts new ones for surfaces nothing covers.
- Stripe — commercial context. Revenue and payment behaviour tell the agent which findings are expensive, not just which are true.
- The in-product SDK — first-party signals captured at the moment of friction (intent, effort, account), plus the delivery channel for approved interventions.
How credentials are handled
Connector credentials are encrypted at rest with AES-256-GCM and resolved per workspace at runtime. They are read credentials: Sightspool reads your project, and the one exception is explicit — a PostHog key with survey-write scope, which you supply only if you want approved studies delivered through your own PostHog. The in-product SDK key is deliberately different: it is publishable, meant to be visible in your page source, and constrained by an origin allowlist you control.
Live, sample and off
Each source runs in one of three modes. Live reads your real project. Sample returns realistic mock data so you can explore the product before wiring anything up. Off leaves the source disconnected.
Sample data is explicitly marked as mock everywhere it appears, and the distinction is enforced rather than annotated: in production, a finding whose every cited source is mock is rejected before it can publish. You can explore with sample data as long as you like — it simply cannot become evidence.
Running the first read
Once a source is live, Run analysis on the Connections page starts a pass over it. From then on the work is continuous: a background worker advances queued tasks, checks the signals behind committed assumptions, scans your repository both ways, and sends a weekly digest of what actually changed — silence when nothing did.