This page describes what SCOUTz reads from your Google Workspace when your administrator approves a connection, what it never reads, and how that data is handled. It supplements the SCOUTz Privacy Statement and Terms of Use.
1. Who we are
SCOUTz is operated by SCOUTz LLC, Phoenix, Arizona. Your technology provider (your "provider") uses SCOUTz to review the security configuration of your Google Workspace. Your provider is responsible for its relationship with you; SCOUTz processes data on your provider's behalf and on your approval.
2. What you approve
A Google Workspace super administrator in your organization approves the connection on Google's own consent screen. The connection is read-only: SCOUTz cannot change any setting, account, group, device or policy in your Workspace.
SCOUTz asks Google for the following permissions. Every one of them reads settings, structure and activity records, not the contents of anyone's work.
Accounts and organization
- Account details for each user: name, email address, administrator status, whether the account is suspended or archived, organizational unit, and 2-Step Verification enrollment
- Email aliases on accounts
- Custom account attributes your organization has defined (names and values of the attributes, not documents)
- Your Workspace customer record, your domains and whether each is verified
- Your organizational unit structure
- Personal Google accounts that use your domain but are not managed by your organization (so they can be reported to you)
- Contact delegation settings
- Shared resources such as meeting rooms (names and settings)
Groups
- Groups, their members and how many members each has, including members from outside your organization
- Group settings: who can join, post and view
Administrators and sign-in
- Administrator roles and who holds them
- Whether sign-in is handed to an outside identity provider, and for whom
- Security settings recorded in Workspace policies
Devices and Chrome
- Managed mobile devices, ChromeOS devices and managed Chrome browsers: model, operating system and browser versions, last sync, encryption and compliance state
- Chrome and ChromeOS policies in force, such as password manager, extension rules and Safe Browsing
- Browser and extension inventory reports and device telemetry
- Google Meet hardware (names and status)
Activity, usage and licenses
- The administrator activity log (who changed which setting, and when)
- Usage reports (totals such as active users and storage, as Google reports them)
- License assignments
- Data transfers from departed users' accounts (whether a transfer was completed, not the data itself)
Sharing and retention
- The list of outside domains your organization allows for sharing
- Google Vault retention and hold settings
Three permissions with no read-only version. Google offers the permissions for group settings, license assignments and (if later enabled) security alerts only in a form that could also allow changes. SCOUTz uses them only to read. Our software refuses to send anything but a read request to those services, and this is tested on every release.
3. What SCOUTz never reads
Email messages, files and documents, Drive contents, calendar events, chat messages, contacts, voicemail, or passwords. If Google ever offered SCOUTz a broader permission than listed here, SCOUTz would refuse to run.
4. How the data is used
Only to produce your security review: findings, scores, reports and recommendations for you and your provider. The data is not sold, not used for advertising, and not used to train AI models.
5. Detail about individual people
Totals are always shown (for example, how many accounts lack 2-Step Verification). Detail about individual accounts is shown only if your administrator chooses it on the consent page.
6. Where the data is kept, and for how long
- Hosting: the United States, on infrastructure operated by Railway Corporation.
- Review findings: kept for 30 days after the review completes, then deleted, unless your provider pins the review as a baseline for comparison.
- Consent, revocation and review activity records: kept permanently in an append-only log, so there is always a record of what was approved and when.
- The Google connection credential: one per approval, stored encrypted, used only to run reviews that you or your provider start, and no longer usable once you remove access or it expires.
7. Sub-processors
- Google LLC (the source of the data you approve)
- Railway Corporation (hosting)
The public-domain part of the review (DNS, email authentication, certificates, exposed services) also consults outside sources that receive only your domain name or public IP address, never Workspace data; they are listed in the Terms of Use.
8. Ending the connection
You can remove SCOUTz at any time, and it takes effect immediately:
- Google Admin console: Security → Access and data control → API controls → Manage third-party app access → SCOUTz → Remove access; or
- the approving administrator's Google account: myaccount.google.com → Security → Third-party apps with account access → SCOUTz → Remove access.
Your provider can also disconnect it from SCOUTz. Once removed, no further reads happen.
9. Changes to this disclosure
If SCOUTz asks Google for any new permission, this page's version number changes and your administrator is asked to approve again before anything new is read.
10. Contact
Privacy questions: privacy@scoutzsecurity.io
Security contact: security@scoutzsecurity.io
Read the SCOUTz Privacy Statement and Terms of Use.