Features
Everything you need to find and manage shadow AI in Google Workspace
Spot every connected app, score what it can access, steer people toward approved tools, and renew only what you keep.
Read-only access. We never read email or file contents.
Connected apps
64 apps · 9 AI tools · 2 high risk
- 3 peopleCalendar · Full accessHigh
Otter.ai
Meeting notes
- 2 peopleGmail · Full accessHigh
Superhuman
Email client
- 2 peopleCalendar · ReadMedium
Read.ai
Meeting assistant
- 2 peopleDrive · Per-fileMedium
Gamma
Presentations
- 2 peopleProfile · BasicMedium
ChatGPT
AI assistant
- 2 peopleProfile · BasicLow
Claude
AI assistant · Team plan
How it works
SpotScoreSteerRenew
Step 01
Spot
Every connected app
One read-only scan of Google Workspace.
64 apps found · 9 AI tools
- 3 people
Otter.ai
- 2 people
Superhuman
- 2 people
Read.ai
Step 02
Score
What each one can access
Scopes in plain English, rated by risk.
- High
Otter.ai
Calendar · Full access
- Medium
Read.ai
Calendar · Read
- Low
Claude
Profile · Basic
Step 03
Steer
Ask who connected it
You send it. Nothing goes out on its own.
To Maya Chen · about Otter.ai
“Still using Otter.ai? It can change every event on your calendar.”
Step 04
Renew
Catch the notice window
Upload the contract, get alerted in time.
Claude Team
40 seats · auto-renews
Drop the contract PDF
Feature by feature
A closer look
Spot · Score · Shadow AI discovery
Find every connected app and see what it can access
One read-only scan of Google Workspace lists every app people authorized, translates each scope into plain English, and separates out the AI tools. Learn more
What the scope actually allows
drive.fileNarrowOnly files the person opened or created with this appdrive.readonlyBroadRead and download every file the person can open in DrivedriveFullRead, edit, and delete every file the person can open in Drivegmail.readonlyBroadRead every email and attachment in the mailboxcalendarFullSee and change every event, including meeting links and attendees
Google OAuth scopes, translated.
Steer · Slack alerts
Ask the person who connected it, right in Slack
Get alerts in your IT channel and send a direct question to whoever connected an app. Their answer comes back to you. Learn more
Direct message · Maya Chen
AppControler App 9:41 AM
Hi Maya, your IT team asked me to check in. You connected Otter.ai to your work Google account. It can see and change every event on your calendar.
Are you still using it?
Renew · Renewal tracker
Know your act-by date for every tool you keep
Upload the contract PDF. AppControler reads the renewal date and notice period, then alerts you before the window to cancel or change seats closes. Learn more
Claude Team · renews March 1
Claude Team · 40 seats
30-day notice period · auto-renews
Act by
January 30
Last day to cancel or change seats
Alerts
Email at 90, 60, 30 days
Plus an optional last call
Ask · MCP for Claude & ChatGPT
Ask Claude or ChatGPT about your Workspace
Connect AppControler over MCP and ask plain questions about your apps, people, policies, and renewals. You can set a policy from the chat too. Learn more
Claude · AppControler connector
list_ai_apps · get_app_users
One AI app has Gmail access:
Superhuman: full access, connected by Jordan Kim and Alex Park
It’s marked Review. Want me to set it to Blocked?
Setup
One read-only connection to get started
Connect Google Workspace as an admin. AppControler only asks for read-only Admin SDK access. It doesn’t install anything on laptops, sit in your network, or need a browser extension.
Connect Workspace
Sign in as a Google Workspace admin and approve read-only access.
Run the first scan
Every connected app shows up with its access, people, and risk level.
Add Slack or MCP
Send alerts to a channel, or ask questions from Claude or ChatGPT.
See exactly which scopes we request on the security page.
See which AI tools are connected to your Workspace today.
Your first scan is free. Connect Google Workspace with read-only access and get the full list.
Read-only access. We never read email or file contents.