[scavio-ai]

What & why

Adds scavio_maps, a firmographics provider next to google_maps. It looks the lead's company and
city up on Google Maps through Scavio and fills the
same fields as google_maps: phone, address, description, industry_tags, google_rating and
google_maps_url. Users who want Maps phone and address data no longer need a Google Cloud project;
a free Scavio account includes 50 credits and each lookup is one credit.

• Opt-in: keyed by SCAVIO_API_KEY, resolved like GOOGLE_MAPS_API_KEY (workspace setting, global
  setting, environment). No key means no request. It is not added to any default waterfall; users add
  it to a column's waterfall.
• Of the first three places, the first whose title contains the company's leading name word is used.
  Otherwise the result is a miss (No matching place found), so an unknown company does not pick up
  a neighbouring business's phone number.
• Listed in /api/workbooks/meta/providers (registry.json and both meta contract fixtures), the
  vendor catalog (public plan price, $0.0043 per lookup) and provenance (proprietary-api).
• Docs: providers guide row, configuration key list, docs/providers/scavio.md, .env.example,
  CHANGELOG.

I work on Scavio.

Type

• Bug fix
• New feature
• New enrichment provider / source
• Docs
• Refactor / chore

Checklist

• Commits are signed off (git commit -s) per the DCO
• I have signed the CLA (and my employer the Corporate CLA)
• Backend tests pass: go vet ./... and go test ./... in apps/backend-go (129 packages, 0 failures) on main as of 2026-10-31; commits since then are docs/CI only and do not touch the changed files. Integration tests (-tags integration) were compiled and vetted but not run locally; the two meta fixtures were updated to match registry.json.
• Monorepo lint and build pass (no frontend changes)
• I did not add scraping of paywalled / pirated / login-gated content
• Credentialed providers are opt-in and inert by default

Security-sensitive?

Outbound fetch with a credential. The endpoint is fixed
(https://api.scavio.dev/api/v2/google/maps/search), the request goes through the existing egress
client via providers.Do (no redirects, 1 MiB body cap, 15 s deadline), and the key is sent only in a
bearer Authorization header and scrubbed from transport errors. A test checks that a failing
transport's error text never carries the key, and that no request is made without a key or a company.

Notes

Tests use a trimmed live response as the fixture (request shape, field mapping, fallbacks, misses,
HTTP errors, malformed JSON, cancellation). A fresh Maps lookup can take several seconds, so the docs
suggest raising the provider timeout to 15 s when this provider is in a waterfall.

[github-actions]

All contributors on this pull request have signed the OpenGTM CLA. Thank you!

Agreement: OpenGTM CLA 1.0

• scavio-ai: signature record

[github-actions]

CLA waiting period ended; see the CLA check for the current status.

[scavio-ai]

I have read the OpenGTM CLA 1.0 and I hereby sign it.