Workspace Check プライバシーポリシー

Workspace Check and Google user data (English summary)

Workspace Check is a tool that helps a Google Workspace administrator review, folder by folder, who has which access to the files in the organization's shared drives and in employees' My Drive, and find and remove link sharing, external sharing and sharing with personal email addresses, and important files that Gemini could use to answer any employee. It runs entirely in the administrator's browser. Operator: UTNOA (sole proprietorship, Muo Ogawa). Contact: info@utnoa.com.

Data accessed. (1) With the administrator's Google sign-in: email address (openid, email) to identify the administrator; IAM (iam) to ask Google to sign short-lived tokens with the tool's own service account in the customer's Google Cloud project; and, only when the administrator clicks "Set up", cloudplatformprojects (create one dedicated project), cloudplatformorganizations.readonly (find the organization to place it in) and service.management (enable the required APIs), plus iam to create a keyless service account and grant the administrator the Service Account Token Creator role on it. (2) Through domain-wide delegation that the customer's administrator grants to the customer's own service account: file and folder names, locations, modified time, owners and sharing permissions including whether each permission is inherited (drive.metadata.readonly); the list of shared drives, only when listing them, because the Drive API requires it for that call, without reading file content (drive.readonly); users and group members to detect suspended accounts and group membership (admin.directory.user.readonly, admin.directory.group.member.readonly); Drive audit events in which an app accessed file content on behalf of a user (file ID and title, user, time, app number) and Gemini Notebook audit events (notebook name, owner, visibility, recipients, source names and URLs) to find important files that Gemini used and notebooks shared outside the organization (admin.reports.audit.readonly); creating a "Workspace Check の記録" folder and spreadsheets in the signed-in administrator's My Drive and writing scan results and the administrator's notes there when the administrator clicks the save button, and reading them back at the next scan, limited to files the tool created (drive.file); and, only if the administrator adds it, removing one permission at a time that the administrator selected and confirmed (drive). File content is never read; calls that download or export file content are blocked by the app's network allow-list. Files are never deleted and ownership is never transferred.

Use, storage and sharing. All Google data is processed only in the administrator's browser and is never sent to or stored on UTNOA's servers; there is no UTNOA server that receives scan data. Access tokens are kept in memory only; no refresh tokens or service account keys are used. Scan results stay in memory and disappear when the page is closed, unless the administrator saves them to spreadsheets in the administrator's own Google Drive, which the customer controls. The browser's local storage keeps only non-secret settings (the service account email, project ID, numeric client ID for delegation, the record folder ID and the inspection rules), which can be deleted with "Delete from this computer". To check the 14-day trial and the subscription, the app sends the Google ID token received at sign-in (which identifies the administrator's email address and the organization's domain and grants no access to Google data) to UTNOA's licensing endpoint on Google Cloud (Cloud Run and Firestore). UTNOA stores only the domain, the email addresses of administrators who signed in, the trial start date, the plan and payment method, the contract period and Stripe customer and subscription IDs; it does not store the ID token or any scan data. Card payments are processed on Stripe's pages; card details never reach UTNOA. Google data is never sold, shared with third parties, used for advertising, used to train AI models or used for credit decisions.

Protection. The app restricts network access to specific Google endpoints with a Content-Security-Policy and an allow-list in code, renders all text from Google as plain text, neutralizes formulas in exported CSV files, and loads no third-party analytics, ads or CDNs.

Deletion. Deleting the dedicated Google Cloud project and the domain-wide delegation entry removes all access. Access can also be revoked from the Google Account's third-party apps page. UTNOA stores no Google user data, so there is nothing to delete on UTNOA's side.