Google Workspace
Know who can get in. Even after they leave.
cybee shows who can get into your team’s Google Workspace: the accounts, when they sign in and the apps people have let in.
Step by step, for your Mac. By AirDrop, message or email.
curl -sSf https://get.cybee.dev | shFrom get.cybee.dev, cybee’s install server. Read the script
Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started.Press Command and C to copy.
Noor’s project ended. What can she still get into?
Used cybee
Noor’s account is still open.
- Account
- Active
- Last sign in
- Yesterday
- Apps she let in
- 1
Campaign Reports can still read Drive.
Allowed through Noor’s account. Is it still needed?
Ask next
Close Noor’s Workspace access.
Which apps can read our Drive?
account record a-0926-1005Show the account
Access outlives the project. Then a client asks about it.
In a small team, people and apps come and go with each client. Their accounts and permissions often stay open after the work ends, until someone outside the company asks who can reach their files.
-
when someone leaves
A freelancer’s project ends.
Their work account still opens the shared folders. Nobody has closed it, because nobody was sure whose job it was.
-
any week
Someone tries an app with their work account.
An app tried for one job can still have permission months later.
-
before a deal
A client sends a security questionnaire.
“Who at your company can reach our files?”
They want a date and a record, not a promise.
-
on a review
A partner asks who can reach shared work.
They want the accounts and the apps, with dates, for the company they are about to trust.
See it. Close it. Show the record.
Connect your company’s Google Workspace once, after you have read the permissions it asks for. Then ask about it in the same assistant you use for your Macs.
SeeFree
Every account and what it let in. Next to the Macs.
cybee lists the accounts in your connected Workspace and their security settings, when each one signed in, the apps given access through an account, Drive downloads and changes to how the organisation is managed.
Luca’s account and Mac26.09.2026
- 09:12
Luca’s work account signed in.sign in · Google Workspace
- 09:30
Moodboard Sync may read Drive, allowed through his account.app access · Google Workspace
- 09:36
Three files downloaded from Drive.Drive download · the event, never the file
- 09:41
Luca’s MacBook Pro is protected. No open alerts.Mac · dated record r-0926-0941
CloseFreeProof plan
Someone leaves. Close their access, with a date.
Ask cybee what the person can still reach. It finds their Workspace account and shows the step it proposes. You read it first, and nothing changes until you confirm.
Noor leaves the team26.09.2026
- 10:05
cybee finds Noor’s Workspace account.Still active. Last sign in Fri 18:04.
- 10:14
Ana reads the proposed step and confirms it.Nothing changes before she says yes.
- 10:15
Noor’s Workspace account is closed.Proof plan: sealed in account record a-0926-1015
ProveProof plan
When a client asks, send the right record. Each says what it covers.
Your Workspace gets its own account record: the accounts and events of the organisation you connected. Your Macs have the Trust Passport: the settings cybee checked on each Mac it assessed.
The two stay apart, so neither claims more than it saw. Each one says what was checked and when, and neither certifies the company.
account recorda-0926-1015
10:15
Google Workspace. Noor’s account closed.
- Active accounts3
- RemovalConfirmed by Ana
Only the connected Workspace.
Trust Passportsha256 9f3c…b71e
09:45
Four Macs. 118 of 118 checks hold.
- Disk encryptionSince 12.03.2026
- ProtectionSince 12.03.2026
Only the Macs it assessed.
Nobody buys security. Somebody else sets a date.
An agency of about ten people, all on Macs. Their insurer sent a security questionnaire.
- Found cybee.
- Installed.
- First record sealed.
- Sent to the insurer.
No demo. No call. The insurance policy was issued.
The first record shows what was true that night. Every day after adds history.
A real customer story, shared anonymously.
Seeing it is free. The sealed record is the Proof plan.
Connecting Workspace and seeing who can get in costs nothing. The sealed account record and the offboarding evidence come with the Proof plan. Your Google Workspace subscription stays separate.
Free
Free
Forever. Unlimited Macs and people.
- Stops bad software while it runs
- Alerts in macOS, Slack, Teams and SMS
- 118 safety checks on each Mac
- Apps, extensions and AI agents listed
- “Am I safe?” answers in your AI assistant
- Google Workspace account activity
- Email support within one working day
Proof plan
CHFEURUSDGBP9per Mac per month, or 90 a year
Everything in Free, plus:
- Weak settings fixed and kept fixed
- The sealed Trust Passport
- Security training, completion recorded
- Incident response plan
- Chat support
The 14 day trial starts in your AI assistant, after cybee is installed. Ask for a Proof plan feature, such as the Trust Passport. The link arrives in the chat and leads to Stripe, the payment service.
Per Mac, excluding tax. The same number in CHF, EUR, USD and GBP. Runs on Macs with an Apple chip, M1 or newer. Macs with an Intel chip are not supported. To check a Mac, open the Apple menu and choose About This Mac.All plan details
Accounts and events. Never your email or your files.
cybee sees the security side of the Workspace you connect. It does not read what people write or store there.
-
what cybee sees
The security events of the organisation you connect.
- Accounts and their security settings, including what is available about extra sign in checks.
- When a work account was used to sign in.
- Which apps were given access through a work account.
- Drive download events, without the documents.
- Dated changes to how your organisation is managed.
-
outside it
What it never reads, and what it does not cover.
- The contents of email.
- The contents of documents.
- Personal Google accounts.
- Client organisations you have not connected.
- Other services, such as client tools and API keys.
Before you connect it.
What does cybee not do in Workspace?
It does not read email or document contents. It covers only the Google Workspace organisation you connect, not personal Google accounts, client organisations or other services. Closing an account does not rotate keys or erase copies someone already made. It is not a certification. Microsoft 365 is in build.
Does cybee read our emails or documents?
No. Workspace visibility covers accounts and security events, including Drive downloads. It does not read email or document contents.
Which accounts are included?
The Google Workspace organisation you connect. Personal Google accounts, client organisations you have not connected and unrelated services are outside that connection. A connected Mac does not connect its owner’s accounts on its own.
What about Microsoft 365?
It is in build, so you cannot connect it yet. Follow it on the roadmap.
Is Google Workspace itself part of cybee?
No. You keep your own Google Workspace subscription. cybee connects to it and does not replace it.
Where to go next.
Your next client will ask. Be ready.
curl -sSf https://get.cybee.dev | shPress Command and C to copy.
Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started.