Hub
Optional add-ons that record AI sessions, keep them in your own cloud, and connect your identity provider.
Think of Surface as a base product with add-ons, which live in Hub. Only an Admin can turn one on or off. They start in different states:
- AI Tools start on. Recording begins as soon as an endpoint enrols, and you turn off what you do not want.
- Data Sources and Cloud Agents start off. They need credentials, so nothing happens until someone saves them and turns on the Enabled switch.
- Identity & Access starts disconnected. It has no Enabled switch. Nothing happens until someone clicks Connect, and Disconnect stops it.
Every change is written to the Audit Log.
Hub has two tabs, and each tab groups its cards into sections.
| Tab | Section | Runs on | What it does |
|---|---|---|---|
| Extensions | AI Tools | Enrolled endpoints | Records sessions from one AI tool each |
| Extensions | Data Sources | SuperAlign’s backend | Keeps sessions in S3 or Splunk |
| Extensions | Cloud Agents | SuperAlign’s backend | Pulls agents and sessions from cloud agent platforms |
| Integrations | Identity & Access | SuperAlign’s backend | Keeps users and groups in step with your identity provider |
Identity & Access sits apart from the rest. It carries no session data — it keeps your user list in step with your identity provider.
AI Tools
Run on endpoints. Each one records sessions from one AI tool, such as Claude Code, Codex, or AI websites in a browser.
Data Sources
Keep session data in storage you own.
Cloud Agents
Pull sessions from cloud agent platforms that never touch an endpoint.
Identity & Access
Keep your user list in sync with Google Workspace, Microsoft Entra ID, or Okta.
Where to find them in the console
Click Hub at the bottom of the left menu. Each extension is a card on the Extensions tab, grouped into three sections:
| Hub section | What is in it |
|---|---|
| Data Sources | Amazon S3, Splunk |
| Cloud Agents | Microsoft Copilot Studio, Cursor Cloud Agents |
| AI Tools | Claude Code, Codex, Chrome, and other tools Surface records |
Each card shows Enabled when the extension is running and Configure when it is not. Click a card to open its panel on the right, where the Enabled switch and any settings live.
The Integrations tab holds Identity & Access. It is visible but greyed out until the next console release.
Who can change them
Admins. Everyone else sees Hub read-only.