# The project ended. See what kept access. > See which outside apps your team allowed into Google Workspace, who allowed each one and what it can reach. Then ask who still needs it. Seeing it is free. Page: https://cybee.ai/use-cases/workspace-app-access/ (Review third party app access in Google Workspace) For small teams on Google Workspace Protection is free on every Mac. Proof is CHF 9 per Mac a month. cybee lists the outside apps in your Google Workspace and what each can reach, for free. When a client asks who can reach their files, you answer with names. Start free. One command, no account. `curl -sSf https://get.cybee.dev | sh` From get.cybee.dev, cybee’s install server. [Read the script](https://get.cybee.dev) Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. - Asks before it changes your Mac - Apple notarized - No sign up Figure: Illustration: an app called Report Builder can still read the company’s Google Drive through Ana’s account. cybee lists the four outside apps in Google Workspace, suggests asking Ana, the administrator removes the app in Google Workspace, and the team sends its client a dated accounts record. ## Someone will ask who else has access. Usually before they sign. Every app someone allowed into a work account can reach part of your company’s data. Clients and auditors now ask about those apps by name, and they expect you to know. before a deal ### A client asks which outside apps can reach their files. “Which outside apps can reach our data?” They want names, not “the usual tools”. after a project ### A reporting tool was connected for one client job. The job ended months ago. Nobody took the access back. any week ### Someone tries a new AI app with their work account. It asks to read mail or Drive. One click on Allow, and it can. on a review ### An auditor asks who allowed each app in. The account that said yes answers it. Memory rarely does. Why clients ask about outside parties 30% of the data leaks Verizon studied involved a third party, such as a supplier. That share doubled in a year. For your clients, you are that supplier. Source: Verizon DBIR 2025 4% of companies count as fully prepared in Cisco’s yearly study. Knowing which apps can reach your data already sets you apart. Source: Cisco Cybersecurity Readiness Index 2025 ## Connect it once. Then ask about it. Run one line in Terminal, a chat, your IDE or a CLI, then ask your AI assistant to connect your company’s Google Workspace. cybee reads accounts, sign ins, allowed apps, Drive download events and changes made by administrators. It never reads email or the contents of files. Tell your team before you connect it. Review Free ### Follow each app back to its purpose. Then decide if it stays. A forgotten app is rarely a mystery. Someone allowed it for a reason, and that reason may have ended. 1 See who allowed it. Start with the app and the work account that allowed it. Read what it may reach. 2 Ask the person. Which project needed it? Does anyone still rely on it? A strange name alone does not mean trouble. 3 Review what remains. If the project ended, your administrator removes the access in Google Workspace. Write down what you decided, and when. It works for forgotten reporting tools and for AI apps connected to work accounts. It is a Workspace review, not a scan of every account or key your team has ever used. 10:05 10:20 10:40 Figure: The grant says who and what. Only Ana can say why. Compare Free ### Put the account beside the Mac. Then ask a sharper question. Workspace shows sign ins, app grants, Drive downloads and changes made by administrators. Next to the alerts from your Macs, those facts help you ask a more specific question. Two events close together are a reason to ask, not proof of a cause. [See the Workspace coverage](https://cybee.ai/product/workspace/) Figure: Nine minutes apart: a reason to ask Ana, not proof of a cause. Prove Proof plan ### A sealed record for the client. Kept apart from your Macs. Seeing apps and accounts is free. The Proof plan adds sealed accounts records and offboarding evidence, for the day a client asks about company access. Use them next to the Trust Passport for your Macs. Each record says what it checked and when. Neither one certifies the company. **Q:** What does sealed mean? #### What sealed means. Sealed means the record carries a fingerprint, a short code made from its content. Your client can compare it with the copy cybee sealed and see whether anything was changed afterwards. That shows the record was not edited. It does not check the facts a second time. What it covers The Google Workspace organisation you connect. It leaves out email and document contents, personal Google accounts, organisations you have not connected and other services. Seeing an app does not mean it can be removed in one click everywhere. [Review a departure](https://cybee.ai/use-cases/team-changes/) Figure: Two records, each with its own scope. Neither is a certification. ## Start on one Mac. Then connect Workspace. Install cybee, then ask your AI assistant to connect your company’s Google Workspace. Seeing the apps and who allowed them is free. Tell your team before you connect it. `curl -sSf https://get.cybee.dev | sh` From get.cybee.dev, cybee’s install server. [Read the script](https://get.cybee.dev) Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. - Asks before it changes your Mac - Apple notarized - No sign up ## Nobody buys security. Somebody else sets a date. An agency of about ten people, all on Macs. Their insurer sent a security questionnaire. - 23:41 Found cybee. - 23:44 Installed. - 23:47 First record sealed. - 08:00 Sent to the insurer. No demo. No call. The insurance policy was issued. The first record shows what was true that night. Every day after adds history. A real customer story, shared anonymously. ## Seeing access is free. You pay when you need to prove it. Connecting Workspace and seeing accounts and app grants cost nothing. The Proof plan adds sealed accounts records and offboarding evidence, next to the Trust Passport for your Macs. The price is per Mac, not per Google account. ### Free Free Forever. Unlimited Macs and people. - Stops bad software while it runs - Alerts in macOS, Slack, Teams and SMS - 118 safety checks on each Mac - Apps, extensions and AI agents listed - “Am I safe?” answers in your AI assistant - Google Workspace account activity - Email support within one working day [Start free](https://cybee.ai/docs/install/) ### Proof plan CHF 9 per Mac per month, or 90 a year Everything in Free, plus: - Weak settings fixed and kept fixed - The sealed Trust Passport - Security training, completion recorded - Incident response plan - Chat support [Install, then start the 14 day trial](https://cybee.ai/docs/install/) The 14 day trial starts in your AI assistant, after cybee is installed. Ask for a Proof plan feature, such as the Trust Passport. The link arrives in the chat and leads to Stripe, the payment service. Per Mac, excluding tax. The same number in CHF, EUR, USD and GBP. Runs on Macs with an Apple chip, M1 or newer. Macs with an Intel chip are not supported. To check a Mac, open the Apple menu and choose About This Mac. [All plan details](https://cybee.ai/pricing/) ## Sees account activity, never content. What is in your files never leaves your Mac. ### Stays on your Mac - The contents of your files - Saved passwords and app tokens - Detection, checks and fixes ### Leaves your Mac - Security events, such as a program that was stopped - Which settings are on - Which apps, extensions and AI agents are installed, and what the agents are connected to - What AI tools did, as cybee recorded it. This can include commands and file paths - What gets stopped is decided on your Mac, not by an AI model on our servers. - If cybee disappeared, the app on your Macs would keep protecting them. cybee AG, Zürich. A Swiss company, hosted in Europe. [Security and privacy details](https://cybee.ai/security/) Figure: Your team sees one icon. Nobody has to learn security. ## A few practical questions. **Q:** What does cybee not do? It does not read email or the contents of documents. It sees only the Google Workspace organisation you connect: not personal Google accounts, not client organisations you have not connected, not other services. It does not scan every account or key your team has used, and seeing an app does not mean one click removes it everywhere. It is not a certification. **Q:** Is it really free? Yes. Connecting Google Workspace and seeing accounts, sign ins and app grants cost nothing, and so does protection on every Mac. The Proof plan adds sealed accounts records and offboarding evidence, next to the Trust Passport for your Macs. It costs CHF 9 per Mac per month, or 90 a year, excluding tax, with a 14 day trial. The price is per Mac, not per Google account. **Q:** Who removes an app’s access? Your Google Workspace administrator, in Google Workspace. cybee shows the grant, the account that allowed it and what it can reach, so the person who decides has the facts in front of them. **Q:** What does it change on my Mac or in Workspace? On the Mac, the install asks for its password and for Full Disk Access. cybee then stops bad software by itself, and a setting changes only after the person who uses that Mac says yes. In Google Workspace it reads accounts, sign ins, allowed apps, Drive download events and changes made by administrators. It does not remove an app or change an account on its own. **Q:** What does my client see? Only what you send. On the Proof plan that is the accounts record for your Google Workspace and the Trust Passport for your Macs. Each one carries its date and lists what it leaves out, such as email and file contents. Your client decides whether it is enough. **Q:** Does this replace SOC 2 or ISO 27001? No. cybee is not an audit or a certification, and its records say so. If a client asks for SOC 2 or ISO 27001, you still need them. What cybee gives you is dated facts about your Macs and your Google Workspace. An auditor still looks at your policies, your people and the rest of your cloud. **Q:** Can we also handle someone leaving? Yes. When someone leaves, cybee proposes the step for their Google Workspace account, and nothing changes until you confirm. Review client services and keys separately. Removing the company account does not erase copies of files that already exist. [Review a departure](https://cybee.ai/use-cases/team-changes/). **Q:** What about the AI tools on the Mac itself? That is a separate check. cybee lists the AI tools on each Mac and the connections they have set up. [Check the AI setup on your Macs](https://cybee.ai/use-cases/ai-tool-sprawl/). **Q:** Does it work with Microsoft 365? Not yet. Microsoft 365 is in build. [See the roadmap](https://cybee.ai/product/roadmap/). ## Where to go next. [Google Workspace Everything cybee reads in Workspace, free and on the Proof plan.](https://cybee.ai/product/workspace/) [Team changes When someone joins or leaves: the Mac, the account, the client services.](https://cybee.ai/use-cases/team-changes/) [Forgotten AI tools See what the AI tools on your Macs are still connected to.](https://cybee.ai/use-cases/ai-tool-sprawl/) [Check app access by hand A guide to the outside apps in your Google Workspace.](https://cybee.ai/blog/google-workspace-app-access/) [Your AI assistant Set up /cybee and ask your first question.](https://cybee.ai/docs/assistant/#first-question) [Pricing and the trial Every plan detail, and how the 14 day trial starts.](https://cybee.ai/pricing/#trial) ## Start with one forgotten app. It is free. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)