Security & data access

Workspace Audit reads; it never changes a setting. Signing in only tells us who you are: your name and email address. Your Workspace's super admin grants read access once, in your own Google Admin console, to the exact scopes below. We read security metadata and configuration — never the contents of your emails, files, calendar events or chats.

How access works

• Your super admin authorises our client ID and these scopes under Security → Access and data control → API controls → Domain-wide delegation, and can see, change or remove it there at any time. Removing it ends our access to your Workspace: Google stops issuing us new access, and access already issued expires within an hour. Results we have already stored stay until you ask us to delete them.
• We act only as the super admin who is signed in at the time, never as anyone else in your Workspace. We confirm with Google that they are a super admin before showing anything, re-checking at least every five minutes, and again at the moment of any change.
• No key file exists. Our server proves who it is to Google with short-lived credentials from our hosting provider, and only our production service can use your grant.
• Access tokens last at most an hour, are held only in server memory, and never reach your browser.

Scopes you authorise

All read-only except one, admin.directory.user.security, explained below. drive.readonly is read-only too, but it is the one Google classes as restricted, because it could reach file contents.

• admin.directory.device.chromeos.readonlyRead the list of managed Chrome devices, for the same checks.
• admin.directory.device.mobile.readonlyRead the list of mobile devices with Workspace access, to find ones that have stopped syncing or lack a passcode.
• admin.directory.domain.readonlyRead your domain list to tell internal from external sharing.
• admin.directory.group.member.readonlyRead group membership to find over-broad access.
• admin.directory.group.readonlyRead group settings to audit membership exposure.
• admin.directory.orgunit.readonlyRead your organisational-unit structure so findings can be scoped by OU.
• admin.directory.rolemanagement.readonlyRead admin-role assignments to flag excess privilege.
• admin.directory.user.readonlyList users to check account posture, including 2-Step Verification enrolment. Directory metadata only, never mailbox contents.
• admin.directory.user.securityThe one scope that is not read-only. Google describes it as “Manage data access permissions for users on your domain”, and it is the only way Google offers to list the third-party apps each user has authorised. We use it only to list them.
• admin.reports.audit.readonlyRead the audit log to build the Security Timeline.
• admin.reports.usage.readonlyRead usage reports (e.g. 2SV enforcement) for the User Security module.
• cloud-identity.policies.readonlyRead your admin-console policy settings (the core of the audit) — no content, just configuration.
• drive.readonlyFor the Shared Drives and Sites checks. Google classes it as a restricted scope: it could read any file the signed-in admin can. We use it only to read sharing settings, never file contents, and you can remove it in Settings (those two checks then stop).

How your data is protected

• Encrypted in transit (HTTPS) and at rest.
• Your data is never used to train any AI model.
• You can request deletion of your scan data at any time by emailing darren@dcai.co.za.

Our formal Privacy Policy, Data Processing Addendum and sub-processor list set out the full detail.