Shadow AI discoveryfor Google Workspace
See every app connected to your Workspace, what data it can reach, and who added it. Built for IT managers who also own security.
Read-only access. We never read email or file contents.
Demo with sample data — nothing is scanned
A read-only scan of a sample Google Workspace, right here on the page. Watch what turns up.
The problem
AI tools get connected in one click, with no review step
50–80% of employees already use AI tools their employer hasn’t approved. Most of them connected with a work Google account.
01
Nothing to install, nothing to catch
A "Sign in with Google" connection never touches a laptop or the company network.
02
Access hides in the scope
drive.readonly reads every file. drive can also edit and delete them. Both look the same on a consent screen.
03
Nobody owns the full list
IT, Finance, and team leads each approve some tools. Nobody sees all of them.
Employee AI use figure: Teramind Shadow AI Report 2026
How teams handle this today
None of these is built for one person doing it alone
Google Admin console
Gets right: The raw list of connected apps is already there.
Falls short: Scope strings, no translation. Checking it every week becomes a part-time job.
A spreadsheet
Gets right: Free and fine for contracts you already know about.
Falls short: Only knows what someone remembered to type in.
A written AI policy
Gets right: Customers ask for one in security questionnaires.
Falls short: No way to tell if anyone follows it.
Enterprise SaaS governance
Gets right: Deep coverage for companies with a security team.
Falls short: About $750 a month to six figures a year, run by security staff.
How it works
SpotScoreSteerRenew
One read-only connection to Google Workspace. No agents, no proxy, no browser extension.
Step 01
Spot
Every connected app
One read-only scan of Google Workspace.
64 apps found · 9 AI tools
- 3 people
Otter.ai
- 2 people
Superhuman
- 2 people
Read.ai
Step 02
Score
What each one can access
Scopes in plain English, rated by risk.
- High
Otter.ai
Calendar · Full access
- Medium
Read.ai
Calendar · Read
- Low
Claude
Profile · Basic
Step 03
Steer
Ask who connected it
You send it. Nothing goes out on its own.
To Maya Chen · about Otter.ai
“Still using Otter.ai? It can change every event on your calendar.”
Step 04
Renew
Catch the notice window
Upload the contract, get alerted in time.
Claude Team
40 seats · auto-renews
Drop the contract PDF
Also works from Slack, Claude, ChatGPT, and the API. Setup guides
What we believe
You can’t approve or block what you don’t know is connected.
Two years of working with IT managers taught us this: the teams that get shadow AI under control start with an accurate list.
Write the policy after you know what's connected
A policy written before you have the list is a guess.
Blocking everything moves AI onto personal accounts
Nearly half of workers say they would keep using personal AI tools even if banned.
Ask the person before you revoke the app
A short message gets a faster, more honest answer than a help desk ticket.
Connect your tools
Ask Claude or ChatGPT what is connected
Ask “which AI apps have full Drive access?” from your assistant over MCP, or automate reports with n8n and Zapier.
Boundaries
What AppControler doesn’t do
No network blocking and no software on employee devices.
No visibility into personal accounts, browser extensions, or personal API keys.
Google Workspace only for now. Microsoft 365 and Okta are not supported yet.
Not a replacement for an enterprise security suite.
No device agents
Nothing installed on laptops
Personal stays out
Only company sign-in
Not a suite
Just the loop you need
Pricing built for one admin, not a department
Free to see what’s connected. Renewals tracks your contracts. Pro adds Shadow AI discovery — flat monthly prices, no per-seat billing.
Free
$0
See what is connected. Manual sync, email alerts, 2 admin seats.
Renewals
$39/ month
Track contracts, domains, and certificates with email + Slack alerts. No workspace connection needed.
Pro
$99/ month
Everything in Renewals, plus Shadow AI discovery for your workspace.
FAQ
Questions IT managers ask us
New to the topic? Read what shadow AI is and how to find it. Something else? Book 20 minutes with us.
What is shadow AI?
Shadow AI is any AI tool employees use for work without IT or security review. In a Google Workspace company, the most common form is an AI app connected with "Sign in with Google": a meeting recorder, writing assistant, or coding tool that was granted access to company email, files, or calendars.
How is shadow AI different from shadow IT?
Both enter the same way, through a work account sign-in nobody reviewed. The difference is what happens next. Most shadow IT stores data people put into it. Many AI tools read company data to do their job, and send it to the vendor to process. A broad grant to an AI tool exposes more data, faster.
How do I find shadow AI in Google Workspace?
Every app a user authorizes leaves an OAuth grant in Workspace. You can see the raw list in the Admin console under Security → API controls → Manage third-party app access. Finding shadow AI means going through that list for every user, picking out the AI tools, and translating each scope into the access it gives. AppControler does that for you and keeps the list current.
What access does AppControler need?
Read-only Google Workspace Admin SDK scopes: to list users, read the domain, and list the third-party apps people authorized. We do not read Gmail message bodies or Drive file contents, and we do not change or revoke grants on your behalf. The full list is on our security page.
Does it see AI tools people use with personal accounts?
No. AppControler sees apps connected through company Google sign-in. A tool someone uses in a browser with a personal account, a browser extension, or a personal API key is outside what it can see.
Should we block AI tools instead?
Blocking a few high-risk apps is reasonable. Blocking everything tends to push the same tools onto personal accounts, where you lose sight of them completely. We suggest getting the full list first, approving the tools people actually need, and following up on the rest one by one.
Does it support Microsoft 365 or Okta?
Not yet. AppControler works with Google Workspace today. If you need Microsoft 365, tell us. It helps us decide what to build next.
Who is AppControler built for?
Companies on Google Workspace with one person responsible for what software the company uses (an IT manager, ops lead, or technical CTO) and no dedicated security team behind them.
Design partners
See what’s connected to your Workspace.
We’re looking for a handful of IT managers and ops leads to connect their real Workspace and tell us honestly what’s useful and what’s missing. It’s free while we build it with you. We want your feedback more than your money right now.