01
Authorize
A Google Workspace administrator approves the assessment scopes. TenantOne uses them only to read assessment data.
Trust by architecture
Admin access deserves a precise answer.
TenantOne operates as a read-only assessment service: it gathers authorized Google Workspace metadata, evaluates it, and presents evidence. It does not remediate findings or change your tenant.
Read-only operating model
Google Workspace
Authorized metadata
TenantOne
Normalize and assess
Your organization
Review and decide
No agent installation. No tenant configuration changes. No automated remediation.
Read-only
Assessment behavior
TenantOne reads evidence and never applies a fix.
AES-256-GCM
Refresh token encryption
OAuth credentials receive additional protection at rest.
EU
Application data hosting
Application and database infrastructure remains in the EU.
TLS
Data in transit
Browser and API traffic is encrypted in transit.
Data flow
A bounded path from authorization to evidence.
The assessment pipeline separates data collection from scoring and keeps the remediation decision with your organization.
02
Collect
Configuration, directory, usage and audit metadata are normalized into a tenant snapshot.
03
Evaluate
A versioned check library produces evidence-backed findings, risk scores and metrics.
04
Present
Authenticated members of the owning organization see the dashboard and executive report.
Access boundaries
What the assessment reads—and what stays out.
Coverage depends on the permissions and optional modules an administrator deliberately enables.
Reads
Authorized assessment metadata
- Directory attributes such as users, groups, roles, lifecycle status and 2-Step Verification posture.
- Domain, group-setting, OAuth-grant, audit-event and aggregate storage metadata.
- Public DNS records used to evaluate email-domain controls.
- Optional Drive file and Shared Drive metadata when Domain-Wide Delegation is configured.
- Optional managed Chrome extension inventory and risk metadata when its prerequisites are configured.
Does not read or do
Content and tenant changes
- No email bodies, message content, document content or file contents.
- No user passwords and no ability to sign in as an employee.
- No automated changes to users, groups, files, policies or administrator settings.
- No customer data sale, advertising use or training of generalized AI or machine-learning models.
- No claim of visibility into browsers or systems outside the enabled Google and Chrome data sources.
Most Google permissions are explicitly named
readonly. Google requires broader scope names for certain read operations, including listing third-party OAuth grants and reading Groups settings; TenantOne uses those permissions only for reads and does not call their mutation operations.Security controls
Practical controls around sensitive assessment data.
These controls protect access to the service; they do not eliminate the customer's responsibility to manage authorized users and Google administrator permissions.
OAuth token protection
Google refresh tokens are encrypted at rest with AES-256-GCM. Access can be revoked from Google or by disconnecting the tenant.
EU application hosting
The TenantOne application and database are hosted on access-controlled infrastructure in the EU. Google API traffic still travels to and from Google's services.
Encrypted transport
Traffic to and from TenantOne is encrypted in transit with TLS. Production access is limited to authorized personnel.
Organization isolation
Tenant records are tied to an organization. Server-side membership and organization filters scope access to dashboards, reports and tenant operations.
Additional setup
Optional Drive and Chrome coverage needs administrator setup.
Domain-Wide Delegation
Drive, Shared Drive and managed Chrome extension collection use a customer-authorized service account. A Google administrator must deliberately authorize the service-account client ID and the required metadata scopes. This is separate from the standard OAuth connection.
drive.metadata.readonly
chrome.management.reports.readonly
chrome.management.reports.readonly
Chrome visibility prerequisites
The organization needs Chrome Enterprise Core and managed-profile reporting or browser enrollment. Coverage is limited to managed Chrome data reported to Google; Firefox, Safari, Brave and Opera are not visible, and Microsoft Edge generally requires a separate management ecosystem. Missing data is reported as a coverage gap, not marked as a pass.
Legal and privacy
Policies should be easy to inspect.
Review the current public documents or contact us for data-protection questions and a Data Processing Agreement.
Privacy Policy
Data categories, purposes, recipients, retention, rights and Google Limited Use.
Terms of Service
Service terms, customer responsibilities and acceptable use.
Imprint
Operator identity and legally required business information.
Cookie Policy
Necessary cookies, optional preferences and consent controls.
Privacy questions or DPA requests: privacy@tenantone.io
Start with evidence
Inspect the workflow before connecting a tenant.
The synthetic demo shows the assessment experience without Google credentials. When you are ready, review the requested access with your administrator.