---
title: Hub
sidebar:
  label: Overview
description: Optional add-ons that record AI sessions, keep them in your own cloud, and connect your identity provider.
---

_[console.superalign.ai/hub](https://console.superalign.ai/hub)_

Think of Surface as a base product with add-ons, which live in Hub. Only an Admin can turn one on or off. They start in different states:

- **AI Tools start on.** Recording begins as soon as an endpoint enrols, and you turn off what you do not want.
- **Data Sources and Cloud Agents start off.** They need credentials, so nothing happens until someone saves them and turns on the **Enabled** switch.
- **Identity & Access starts disconnected.** It has no **Enabled** switch. Nothing happens until someone clicks **Connect**, and **Disconnect** stops it.

Every change is written to the Audit Log.

Hub has two tabs, and each tab groups its cards into sections.

| Tab | Section | Runs on | What it does |
| --- | --- | --- | --- |
| **Extensions** | [AI Tools](/surface/hub/ai-tools/overview) | Enrolled endpoints | Records sessions from one AI tool each |
| **Extensions** | [Data Sources](/surface/hub/data-sources/overview) | SuperAlign's backend | Keeps sessions in [S3](/surface/hub/data-sources/s3) or [Splunk](/surface/hub/data-sources/splunk) |
| **Extensions** | [Cloud Agents](/surface/hub/cloud-agents) | SuperAlign's backend | Pulls agents and sessions from cloud agent platforms |
| **Integrations** | [Identity & Access](/surface/hub/identity-access/overview) | SuperAlign's backend | Keeps users and groups in step with your identity provider |

```mermaid
flowchart LR
  subgraph endpoint["Enrolled endpoints"]
    P[AI Tools<br/>Claude Code, Codex, Chrome]
  end
  P -->|sessions| S[Surface]
  X[Cloud agent platforms<br/>Copilot Studio, Cursor Cloud Agents]
  subgraph cloud["SuperAlign's backend"]
    Y[Cloud Agents]
    C[Data Sources<br/>S3, Splunk]
  end
  X --> Y --> S
  S --> C
  I[Google Workspace,<br/>Entra ID, Okta] -->|users and groups| S
```

**Identity & Access** sits apart from the rest. It carries no session data — it keeps your user list in step with your identity provider.

<CardGroup cols={2}>
  <Card title="AI Tools" href="/surface/hub/ai-tools/overview" icon="laptop">
    Run on endpoints. Each one records sessions from one AI tool, such as Claude Code, Codex, or AI websites in a browser.
  </Card>
  <Card title="Data Sources" href="/surface/hub/data-sources/overview" icon="cloud">
    Keep session data in storage you own.
  </Card>
  <Card title="Cloud Agents" href="/surface/hub/cloud-agents" icon="cloud">
    Pull sessions from cloud agent platforms that never touch an endpoint.
  </Card>
  <Card title="Identity & Access" href="/surface/hub/identity-access/overview" icon="plug">
    Keep your user list in sync with Google Workspace, Microsoft Entra ID, or Okta.
  </Card>
</CardGroup>

## Where to find them in the console

Click **Hub** at the bottom of the left menu. Each extension is a card on the **Extensions** tab, grouped into three sections:

| Hub section | What is in it |
| --- | --- |
| **Data Sources** | Amazon S3, Splunk |
| **Cloud Agents** | Microsoft Copilot Studio, Cursor Cloud Agents |
| **AI Tools** | Claude Code, Codex, Chrome, and other tools Surface records |

Each card shows **Enabled** when the extension is running and **Configure** when it is not. Click a card to open its panel on the right, where the **Enabled** switch and any settings live.

The **Integrations** tab holds [Identity & Access](/surface/hub/identity-access/overview). It is visible but greyed out until the next console release.

## Who can change them

Admins. Everyone else sees Hub read-only.