How connecting a tool works

You paste a credential

You create a credential inside your own tool, then paste it into the connect form on that tool's page. MarqIQ never asks for your password. The one exception is Connect with Salesforce, where it is offered: it sends you to Salesforce to sign in and approve MarqIQ there.

Eight connect forms carry a card headed What MarqIQ needs from that tool: HubSpot, Salesforce, Pipedrive, Microsoft Dynamics, Zoho CRM, Marketo, Adobe Campaign and Google Tag Manager. The card names the credential, says where in that tool to create it, and lists every permission split into Required and the optional ones, each with the single thing it turns on. Permissions that also allow writing carry an Allows writing badge where they are granted.

Where to go to create each one

These are the destinations the connect form itself links to, so the article and the screen cannot drift apart. Open the one for your tool, create the credential, then come back.

What MarqIQ reads on the first sync

MarqIQ asks your tool for its own field definitions before it reads a single record. It does not work from a fixed list, so your custom fields arrive alongside the standard ones, and the labels you gave them arrive with them.

• People: contacts, leads, persons, prospects or subscribers, depending on what your tool calls them, with every field on them.
• Companies, and the company each person belongs to.
• Deals or opportunities, from the six tools that hold them — HubSpot, Salesforce, Pipedrive, Zoho CRM, Microsoft Dynamics and Pardot.
• Your pipelines and stages, and the owner names behind the owner ids.
• Field change history, from the tools that keep one.
• The field catalog itself, which you can read back at Unified field catalog.

What MarqIQ writes into your tool

MarqIQ writes to a record only when a person starts it. The reviewed way is a change set. It lists every record and every field as before and after, item by item, and writes nothing until a workspace admin approves and applies it.

• The safest class of change only fills a field that is empty. It can never replace a value.
• A change that replaces a value needs an admin. A change your tool cannot reverse, such as a merge, is the highest tier of all.
• Every item is re-checked against the live value at the moment it is applied. An item whose live value has moved on is skipped, not forced.
• Undo restores the previous value, and only where the field still holds what MarqIQ wrote.
• An AI assistant may propose a change set. It may never approve or apply one.
• A change set is capped at 500 items.

Other writes are not change sets, and each one is started by you from a screen: the one-click first-touch fill, writing standardised or enriched values back, creating the tracking fields, adding hidden fields to your forms, building the HubSpot or Marketo source-tracking automation, pushing a template into your marketing tool, creating a draft email or landing page from one, uploading an image for a template, and deploying the script through Google Tag Manager. None has an approval step, and MarqIQ cannot undo any of them. What MarqIQ will never do to your data says who can run each, and each tool's own article says which it supports. Nothing is written to a record on a schedule. The scheduled sync only reads, and for Adobe Journey Optimizer it creates the export it reads from.

Choosing a sandbox

Salesforce and Pardot are the only two connect forms that carry an Environment choice. Picking Sandbox labels the connection with a " · Sandbox" suffix everywhere it appears, and sends any token refresh to test.salesforce.com rather than login.salesforce.com.

How your credentials are held

• Every credential is encrypted before it is stored, and the list of your connections is served without the credential column at all.
• Nothing is shown back to you. Data-source screens show a masked tail only.
• Where you supply a URL or a tenant, the destination is pinned before the first request leaves. A Salesforce or Pardot instance URL is refused when it resolves to an internal address, and a redirect off that host is refused. Adobe Campaign is pinned to mc.adobe.io exactly. A Pipedrive company domain must be one plain label. A Marketo Munchkin ID may hold only letters, numbers and hyphens.
• You can revoke access from inside your own tool at any time. Deleting the credential there stops MarqIQ at once, whatever MarqIQ's own record says.

Which plan lets you connect what

Two rules decide, and the connect form enforces both. A tool your plan does not allow is refused when you click Connect, not merely hidden from the list. The Integrations page shows the first one as a counter, for example "2 / 4 tools · GTM free".

The second rule is the connector's own minimum plan. Starter can connect Google Tag Manager, HubSpot, Salesforce, Zoho CRM, Pipedrive, Marketo, Pardot, Mailchimp, Google Analytics 4, HTML Forms and WordPress & CMS. Microsoft Dynamics, Salesforce Marketing Cloud, Adobe Campaign, Adobe Journey Optimizer, Google Ads, Meta Ads, LinkedIn Ads, Snowflake, BigQuery and Custom API need Pro or above.

Seven connectors are early access

Google Ads, Meta Ads, LinkedIn Ads, Google Analytics 4, Snowflake, BigQuery and Custom API are published as Early access rather than generally available, and each one's description on the Explore Integrations page says so. Read the early-access article before you plan work around one of them.

What happens when you disconnect

Disconnecting deletes the stored credential and stops syncing. Your already-synced records and your field mappings stay, so reconnecting later picks up where you left off with no remapping. The confirmation spells all three out before anything happens.

Everything MarqIQ created inside your own tool stays yours. A property, a hidden form field or a workflow it built is not removed when you disconnect — taking it out again is a manual step in that tool.