Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (11)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Brex ↗ | 7.7* | 6.0* |
| Double ↗ | 7.6* | 6.5* |
| Mercury ↗ | 8.3* | 5.5* |
| SAP Concur ↗ | 5.6* | 4.2* |
| Ramp ↗ | 6.1* | 3.3* |
| Coupa ↗ | 4.7* | 5.1* |
| Expensify ↗ | 5.1* | 3.6* |
| Navan ↗ | 4.7* | 4.5* |
| Pleo ↗ | 6.2* | 4.4* |
| Spendesk ↗ | 6.3* | 4.6* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Bank records, card transactions and expense workflows have different authorization boundaries. Read access does not establish permission to move funds or approve expenses.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Brex
Finance operations · Checked 2026-10-12
Brex / customer-owned user token, list APIs and transfer/card operations. Commercial partner OAuth has a separate onboarding path.
Read findings and sources ↗Double
Finance operations · Checked 2026-10-12
Double / practice-owned OAuth client and the published practice-management API. Connected-ledger copies are not the ledger’s own API.
Read findings and sources ↗| Customer control | Brex ↗ | Double ↗ | Mercury ↗ | SAP Concur ↗ | Ramp ↗ | Coupa ↗ | Expensify ↗ | Navan ↗ | Pleo ↗ | Spendesk ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Category | Finance operations | Finance operations | Finance operations | Finance operations | Finance operations | Finance operations | Finance operations | Finance operations | Finance operations | Finance operations | Databases and data platforms |
| Overall control | |||||||||||
| Data access | |||||||||||
| Third-party accessibility | |||||||||||
| External action | |||||||||||
| Continuity | |||||||||||
| Data exit | |||||||||||
| Business logic and customization | |||||||||||
| Assessment scope | Brex / customer-owned user token, list APIs and transfer/card operations. Commercial partner OAuth has a separate onboarding path. | Double / practice-owned OAuth client and the published practice-management API. Connected-ledger copies are not the ledger’s own API. | Mercury / customer banking API tokens, account/statement reads, send-money operations and webhooks. Paid invoicing is a separate entitlement. | SAP Concur / registered OAuth application, Expense Reports v4 and Event Subscription Service. Partner registration is distinct from company token authorization. | Ramp Developer API / customer client credentials for transactions and scoped transaction edits; partner OAuth requires separate production approval. | Coupa Core customer-instance invoice reads and invoice create/update; Supplier Portal, Treasury, CCW and CSO are separate products and entitlement routes. | Expensify Integration Server expense/report export jobs, configurable FreeMarker output and optional markAsExported action; multi-user partner OAuth is a separate beta route. | Navan Expense API selected card/Connect/manual transactions and related transaction families, with PATCH accounting metadata; Travel bookings, account-wide audit completeness and native approval rules are not combined. | Current Pleo accounting-entry search/export APIs and chart-of-accounts create/update; company standalone keys and partner OAuth differ, while deprecated legacy APIs are excluded. | Spendesk company-scoped payable snapshots and wallet reads, with optional experimental payable accounting-field PATCH/webhooks; partner OAuth and organization-level grants are separate conditions. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Brex ↗
Brex lets account administrators create scoped API tokens. Transfer and card actions are available, but access agreements and operation-specific limits still matter.
Brex / customer-owned user token, list APIs and transfer/card operations. Commercial partner OAuth has a separate onboarding path.
Double ↗
Double exposes a broad practice-management API with customer-created credentials. Its two rolling rate windows can constrain bulk synchronization even when the one-minute limit looks generous.
Double / practice-owned OAuth client and the published practice-management API. Connected-ledger copies are not the ledger’s own API.
Mercury ↗
Mercury provides scoped customer tokens and a choice between direct payment execution and dashboard-approved payment requests. Account statement coverage is narrower than the full product portfolio.
Mercury / customer banking API tokens, account/statement reads, send-money operations and webhooks. Paid invoicing is a separate entitlement.
SAP Concur ↗
Concur’s application registration and company authorization are separate gates. A working OAuth token does not imply access to every expense or travel API.
SAP Concur / registered OAuth application, Expense Reports v4 and Event Subscription Service. Partner registration is distinct from company token authorization.
Ramp ↗
Ramp supports customer-owned developer apps with granular scopes. A technology partner must obtain approval before onboarding production customers through OAuth.
Ramp Developer API / customer client credentials for transactions and scoped transaction edits; partner OAuth requires separate production approval.
Coupa ↗
Coupa Core exposes filtered invoice records and invoice actions through customer-instance APIs. OAuth client purpose, selected scopes and tenant permissions govern access; these do not establish blanket third-party eligibility or a portable copy of native approval logic.
Coupa Core customer-instance invoice reads and invoice create/update; Supplier Portal, Treasury, CCW and CSO are separate products and entitlement routes.
Expensify ↗
Expensify offers self-service Integration Server credentials and report exports with customer-defined fields. Export dates, report states and optional marking actions affect what is returned; they do not establish a complete update/deletion stream.
Expensify Integration Server expense/report export jobs, configurable FreeMarker output and optional markAsExported action; multi-user partner OAuth is a separate beta route.
Navan ↗
Navan Expense documents company-scoped transaction reads and permissioned accounting-field updates. Modified-date filters and cursor pages support extraction, but read visibility can lag updates and batch success must be checked per transaction.
Navan Expense API selected card/Connect/manual transactions and related transaction families, with PATCH accounting metadata; Travel bookings, account-wide audit completeness and native approval rules are not combined.
Pleo ↗
Pleo exposes accounting entries, export jobs and accounting-reference actions through its current APIs. Company keys are scoped to one organization, while production multi-customer integrations favor OAuth; export jobs can lock entries and change workflow state.
Current Pleo accounting-entry search/export APIs and chart-of-accounts create/update; company standalone keys and partner OAuth differ, while deprecated legacy APIs are excluded.
Spendesk ↗
Spendesk provides scoped customer credentials and asynchronous payable snapshots. Experimental accounting mutations require extra access and a Controller actor; webhook retries and snapshot caching offer bounded operational recovery without proving a retained change log.
Spendesk company-scoped payable snapshots and wallet reads, with optional experimental payable accounting-field PATCH/webhooks; partner OAuth and organization-level grants are separate conditions.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.