Cube vs Pigment (2026)

Cube connects to hundreds of source systems, with guides for NetSuite, Salesforce, Workday, Sage Intacct, Snowflake, Databricks, ADP Workforce Now, QuickBooks, HubSpot, Rillet, Dynamics 365 Business Central and Campfire, and syncs them on a schedule or on demand. Agents can start a fresh import from an existing connection before they answer, and they put their work into Cube scenarios, Boards, Tables and decks. None of them books an entry, updates a deal or changes an employee record back in the ERP, CRM or HR system.

Sourcecubesoftware.com/integrationsread 2026-10-13

Data reaches the model through scheduled imports from ERP, CRM, HR, data warehouse, BI, spreadsheet and file storage sources, and the agents work on that model instead of inside the source systems. Agent connectors reach outward to Notion and Slack. An admin switches a connector on, each member signs in with their own account, and each read, write or delete tool is set to always allow, needs approval or blocked. Google Drive is still to come, and a team cannot add an MCP server of its own, so agent action outside Pigment stops at those two products.

Sourcekb.pigment.com/docs/set-up-agent-connectorsread 2026-10-13

Charlie, the super agent, breaks a question into tasks, routes each piece to one of four agent teams (Data Managers, Analysts, Planners and Business Partners), lets them pull, reconcile, model and draft, then checks the combined answer against the source data before returning it. One request can run from a data refresh through variance analysis to a drafted board deck. Cube Workflows add task lists with owners, assignees, statuses and due dates for processes such as the month end close.

Sourcecubesoftware.com/ai-agentsread 2026-10-13

In Plan & Build mode the Modeler Agent gathers context, writes a structured action plan and then carries it out across Dimensions, Lists, Metrics, formulas and data imports, asking before it switches to another mode. The Analyst Agent takes a Mission, a task written in plain language, and works through its subtasks.

It sources the data, drills into the drivers, runs its own code against the model's metrics and assembles a report of text and charts. A user can leave an agent working and come back to an unread badge on the chats that have answered. Custom Agents draw on the same analysis and documentation skills, though they cannot schedule Missions.

Sourcekb.pigment.com/docs/configure-and-run-the-modeler-agentread 2026-10-13

People reach Charlie in the Cube Workspace, in the Excel and Google Sheets add ins, in Slack and Teams, and from any MCP assistant such as Claude or ChatGPT. Anomaly Detection watches the numbers and flags lines that look off before anyone asks. Source systems sync on a schedule, so fresh actuals land in the model and the plans update around them without someone starting the work.

Sourcecubesoftware.com/ai-agents/analystsread 2026-10-13

Saving an Analyst report as a Mission makes it repeatable, and switching on Scheduling sets a start time and a cadence for later runs, with each run's output kept in the report or exported to a text Metric. The Missions tab shows every saved Mission with its run frequency. People also start the agents from the AI sidebar on any Board, from the AI Analysis button beside a Metric, Table or numeric Widget, and from a prompt typed at the top of the Workspace homepage.

Sourcekb.pigment.com/docs/configure-and-run-the-conversational-analyst-agentread 2026-10-13

Charlie answers from the customer's own Cube. It decides which slices of actuals, budgets, forecasts and scenarios it needs and fetches them through the governed layer, with the company's formulas, account and entity hierarchies and currency conversions already applied, so revenue means what the company means by revenue. It can drill from a summary figure to transaction lines in the connected source systems, and every number opens back to the records behind it.

Sourcehelp.cubesoftware.com/hc/en-us/articles/36376094163092-about-ai-at-cuberead 2026-10-13

Answers come from the customer's live planning model, its Applications, Blocks, Metrics and Boards, and an admin can switch AI data access off on any Block that should stay out of reach. The Analyst prepares itself once per Application on the first question, a setup that takes longer the more Blocks there are.

Custom Agents carry standing knowledge a team supplies, such as process documents, glossaries, FAQs, guidelines and chosen Boards and Metrics, and users can attach spreadsheets, text and images to a chat. When a security admin allows it, the agents also search the web, optionally only on approved domains, and look inside the model first when the answer may be there.

Sourcekb.pigment.com/docs/create-custom-agentsread 2026-10-13

Each conversation with Charlie and each Planner session is saved for the user who started it, and a History view reopens any of them to carry on where it left off. Context stays inside one conversation, so starting a new one for an unrelated question keeps the earlier context from carrying over. Admins can also write standing instructions for Charlie, such as always showing budget against actuals or how the fiscal calendar runs, which apply in every conversation for every user. Nothing an agent learns in one conversation reaches the next.

Sourcehelp.cubesoftware.com/hc/en-us/articles/41283352702356-chat-with-charlie-cube-s-ai-analystread 2026-10-13

Each member keeps a private chat history with the agents, where chats can be pinned, filtered by Application and reopened to carry on from where they stopped. The Modeler remembers which mode was last used in each chat, and a saved Mission keeps an analysis so it can run again. A team that wants an agent to hold on to its conventions writes them into a Custom Agent's instructions, since chats do not build up a memory of their own.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13

Agent writes land only in scenarios opened for AI write back or created by the AI, so the live budget stays untouched unless someone opens it, and each write carries the user's name and an AI flag. Writing through MCP needs its own permission, which only Finance or Admin users can hold, new workflows and tasks arrive as drafts with no assignee, and a publish can be undone. Data Manager agents score each proposed mapping or bulk change by confidence, and the team approves it before anything lands.

Sourcehelp.cubesoftware.com/hc/en-us/articles/54111068392724-what-ai-tools-can-do-through-the-cube-mcp-serverread 2026-10-13

In Plan & Build mode the Modeler Agent puts its action plan up for validation and waits for a go ahead at each waypoint as it works. Auto accept lets it continue without stopping, except for deletions, which a person confirms every time.

Its changes to the model are permanent and attributed in Application History to the member who ran it, and Ask mode answers without touching anything.

Connector tools set to needs approval make the agent propose a create, edit or delete in Notion or Slack and wait for the member to confirm it, and a web search that might reveal sensitive data asks for approval first.

Sourcekb.pigment.com/docs/configure-and-run-the-modeler-agentread 2026-10-13

Cube holds SOC 2 Type II and SOC 1 reports, the SOC 2 examined by Dansa D'Arata Soucia, and handles data to HIPAA requirements. Sign in runs through SAML or OIDC single sign on with Okta, Duo, Google or Microsoft Entra, which an admin can enforce, plus app or text based multifactor authentication. Role based access and each user's Data Access Scope reach down to the cell, the agents inherit the asker's permissions, and separate permissions govern Charlie, the Planner, MCP read, MCP write and AI administration, so AI can be switched on or off for each use through the same roles.

Sourcecubesoftware.com/securityread 2026-10-13

Sign in runs through SAML 2.0 single sign on with SCIM provisioning for Okta, Microsoft Entra ID or any compliant identity provider, or through Google Login, with multifactor authentication and domain allowlisting on top.

Group based roles and fine grained data access rights decide who can see and change each piece of data, and the agents, Custom Agents and MCP sessions act only within the rights of the member using them, under separate permissions to use agents and to configure them. Pigment holds ISO 27001 certification and SOC 1 Type 2 and SOC 2 Type 2 reports, audited every year, offers a SOC 3 report, sits at CSA STAR level one and covers GDPR and CCPA.

An independent penetration test summary was refreshed in June 2026, and API keys created since May 2026 follow a structured format that secret scanning tools can catch.

Sourcepigment.com/securityread 2026-10-13

Every agent query, answer and publish is recorded with the user, the permission scope applied and the sources used, and denied actions are recorded too. The audit trail shows each data change with who made it, the event type, the number of values changed and the before and after figures, and change history marks which changes came from AI. Because answers open to the transactions behind each figure, a reviewer can see exactly what an agent relied on.

Sourcecubesoftware.com/securityread 2026-10-13

The Missions tab shows every Mission the agents have run, and each change the Modeler makes is recorded in Application History against the member who ran it, inside edit histories that go down to the block level. Agent outputs explain how they were reached, with the data and logic behind them, and the Modeler writes up each change as it goes. The Audit Trail API sends login, administration, security and application events to a SIEM, and admins follow AI credit use in near real time on the Plan & Usage and AI credits screens.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13

Cube runs as a hosted service on AWS, with all data and infrastructure in US based regions, and offers a data processing agreement for GDPR needs. A company that needs its financial data held in the EU or another country cannot get that, and there is no customer hosted edition.

Sourcesecurity.cubesoftware.com/faqread 2026-10-13

Customer data is stored in the region the customer picks, Frankfurt in Germany or Oregon in the United States, on Google Cloud across three independent zones, with backups in multiregional buckets inside the same geography. Buyers who need French or European sovereign hosting can run Pigment on S3NS PREMI3NS, a SecNumCloud 3.2 qualified cloud operated by a Thales subsidiary and shielded from jurisdiction outside Europe. Disaster recovery is rehearsed live once a year against a six hour recovery time and a 24 hour recovery point.

Sourcepigment.com/securityread 2026-10-13

Four agent teams come with every plan. Data Managers handle mapping, bulk edits, connection setup and hierarchy upkeep, and Analysts bring slices, Smart Variance and Anomaly Detection. Planners carry the Planner Agent, Smart Forecaster and Formula Modeler, and Business Partners carry Visualization, Board Builder and Deck Builder. The Agent Exchange adds ready plays, such as a variance bridge to budget, a rolling forecast refresh, an investor update or a new entity mapping, which Charlie runs once the user fills in the bracketed inputs.

Sourcecubesoftware.com/ai-agentsread 2026-10-13

The Modeler, Analyst and Documentation Agents come ready to switch on for each Application, and each does its own job. The Modeler builds and maintains models, the Analyst analyzes and reports, and the Documentation Agent answers platform questions from Pigment's knowledge base. Custom Agents come with worked examples for user guidance and for FP&A, workforce and supply chain analysis, and the chat offers a library of suggested prompts. The Analyst comes with ready use cases by role, from monthly expense variance and EBITDA and cash checks to ARR cohorts, hiring gaps and supplier risk.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13

Charlie and the agent teams run on language models from providers available through Amazon Bedrock, chosen by Cube, with Anthropic named among Cube's subprocessors since March 2026, and Cube trains no models of its own for these features. AI settings hold a company's standing instructions and nothing else, so a company cannot pick the model behind its agents. Outside assistants such as Claude or ChatGPT can work on Cube data through the MCP server, but those are the customer's own tools reading Cube.

Sourcesecurity.cubesoftware.com/faqread 2026-10-13

The agents run on pretrained models from AI vendors under enterprise agreements with zero data retention, and customer data is never used to train them. Which vendors and models sit behind the agents is not public, and an admin has no setting to pick or switch the model. Claude, ChatGPT or Mistral can reach Pigment through its MCP server, which puts a team's own assistant in front of Pigment data while Pigment's agents stay on Pigment's choice.

Sourcekb.pigment.com/docs/ai-faqread 2026-10-13

The Cube MCP Server, generally available on every plan with usage limits, signs users in with OAuth and offers a full tool set, from get_financial_slice_of_data and get_drilldown_data to publish_data, duplicate_scenario, create_dashboard, create_planning_table, create_workflow and initiate_import, so a team can point any agent framework at the governed model and write plans, Boards, Tables, scenarios and workflows back under the user's permissions. The Cube REST API has a public OpenAPI reference covering agent chat and Planner sessions, AI settings and credits, canvases, workflow runs and connection syncs, authenticates through OAuth with a PKCE flow, and is sold as an add on.

Sourcehelp.cubesoftware.com/hc/en-us/articles/54111068392724-what-ai-tools-can-do-through-the-cube-mcp-serverread 2026-10-13

The public REST API, with a Swagger reference, imports data, exports Metric, Table and List data, returns import configurations and starts data flows, under API keys that carry their owner's access rights, IP allow lists and set rate limits, beside an Audit Logs API.

The Pigment MCP server gives each Workspace its own endpoint and signs people in with their Pigment accounts. Its default tools read and analyze, and advanced mode adds tools that create Applications, build Dimensions, Metrics and Tables, write formulas, design Views and Boards and enter data. Pigment keeps Skills files and plugins for Claude Code and Cursor in a public repository.

Sourcekb.pigment.com/docs/supported-toolsread 2026-10-13

Before Charlie returns an answer it checks each figure against the source data, and every query, answer and AI write sits in the log for review afterward. The Planner, still in open beta, asks clarifying questions before it builds a scenario. Cube tested its own accuracy on its own books and does not warrant AI output, reminding users on every AI surface to check results. A finance team cannot run an agent against a set of known questions to see how it does before giving it to the wider team.

Sourcecubesoftware.com/ai-agentsread 2026-10-13

A builder previews a Custom Agent and refines it before switching it on for members. Test & Deploy environments stage model changes, the Modeler's included, before they reach a production Application that can be locked, and in managed Applications the Modeler works in Ask mode only. Every answer can be traced to its data and logic. Nothing scores the agents' answers against a test set before rollout.

Sourcekb.pigment.com/docs/create-custom-agentsread 2026-10-13

The agents work through Cube's governed data layer, its source connections and the spreadsheet, Slack, Teams and MCP surfaces. None of them opens another application and clicks through it for a user.

Sourcecubesoftware.com/ai-agentsread 2026-10-13

The agents act inside Pigment's own model and reach Notion and Slack through connectors. Web search returns information to them, and none of them opens a browser, drives another application's screen or works a desktop session for a user.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13