WorkspaceGuard — Gmail Exfiltration Auditor & License FinOps Reclaimer

Multi-Signal Dormant & "Suspended-Still-Billed" Seat Reclaimer

Combines Web Login, SSO, Gmail Interaction, Drive Edit, and OAuth token timestamps. Reclaims seats with zero data loss by transferring Drive/Calendar to the manager and converting the departed email into a $0/mo Free Alias.

Waste Category	User & Manager	License SKU & Cost	Multi-Signal True Last Active	Safe Reclaim Playbook	Execute

Reclaimed License Savings & Data Transfer Ledger

brian.ostrom@acme-corp.com → Saved $27.00/mo ($324.00/yr)

Completed (1,420 Drive files & Calendar transferred) • brian.ostrom@acme-corp.com -> alias on vp-eng@acme-corp.com ($0/mo)

2026-10-04 16:12 UTC

Real-Time Email (Resend/SMTP) & Slack Alert Outbox

Sends instant 15-minute exfiltration alerts to Slack, 1-click employee self-attestation emails, and the monthly CFO savings receipt that keeps customer churn below 1.8%.

SLACK_WEBHOOK 15-Min Audit Log Delta Alert → #security-alerts

Detected new silent Gmail filter forwarding on marcus.vance@acme-corp.com -> mvance.personal88@gmail.com

2026-10-10 02:15 UTC

Powered by Dodo Payments (Merchant of Record)

Zero-Touch Global SaaS Billing & Tax Compliance

Dodo Payments handles global VAT, GST, US Sales Tax, B2B invoicing, and subscription webhooks (`Standard Webhooks / Svix`) with $0.00/month idle cost. Finding just 2 suspended or dormant seats pays for the entire subscription.

Starter

Up to 75 Google Workspace Users

$39 /month

✓ Weekly 6-Vector Gmail Exfiltration Audit
✓ Multi-Signal Dormant & Suspended Seat Audit
✓ 1-Click Rule Revocation

Growth

Up to 250 Google Workspace Users

$69 /month

✓ Everything in Starter
✓ 15-Minute Real-Time Audit Log Delta Watcher
✓ 1-Click Drive Transfer + Free Alias Conversion
✓ Signed SOC 2 / ISO 27001 Evidence PDF

Scale

Up to 1,000 Google Workspace Users

$119 /month

✓ Everything in Growth
✓ Automated Employee Self-Attestation Emails
✓ Annual Contract Renewal Cliff Optimizer
✓ SIEM / Slack Real-Time Security Webhooks

Domain Security & FinOps Policy Configuration (acme-corp.com)

Configure approved external partner domains, Slack/Google Chat alert webhooks, and dormancy thresholds.

Approved External Partner Domains (Comma-separated)

Forwarding rules to these domains will not be flagged as CRITICAL.

Slack / Google Chat Incoming Webhook URL

Receives 15-minute real-time exfiltration alerts.

Dormant License Threshold (Days Inactive)

Auto-revoke CRITICAL consumer email forwarding (`@gmail.com`, `@icloud.com`) on detection

Tawk.to Live Chat Property ID (`dashboard.tawk.to`)

Embeds `https://embed.tawk.to/{PropertyID}/{WidgetID}` across Website & `/app`.

Tawk.to Chat Widget ID (Default: `default` or `1i...`)

Webhook URL for Tawk.to Dashboard: `https://workspaceguard.novabyte.in/webhooks/tawkto`

Live Add-on Sidebar Card

WorkspaceGuard Add-on

acme-corp.com • Gmail / Drive / Admin Sidebar

Connected Google Workspace Domain

acme-corp.com

Plan: GROWTH (ACTIVE)

Gmail Exfiltration

0 Active

0 Critical

License Waste

$0/mo

0 Seats

Active Gmail Exfiltration Rules

✓ All 6 Gmail Exfiltration Vectors are clean across your domain.

Suspended & Dormant License Waste

✓ Zero wasted licenses! All seats are active or converted to $0 Free Aliases.

Synced with /app View Raw Card JSON →

Google Workspace Marketplace SDK

HTTP Add-on Deployment Manifest (`/addon/manifest.json`)

Paste this manifest into Google Cloud Console → Google Workspace Marketplace SDK → App Configuration to publish WorkspaceGuard as a Domain-Wide Google Workspace Add-on.

Open /addon/manifest.json

Homepage & Contextual Trigger Endpoint

POST https://workspaceguard.novabyte.in/addon/homepage

1-Click Action Endpoints

POST /addon/scan • /addon/revoke • /addon/reclaim

{
  "addOns": {
    "calendar": {
      "homepageTrigger": {
        "enabled": true,
        "runFunction": "https://workspaceguard.novabytelab.in/addon/homepage"
      }
    },
    "common": {
      "homepageTrigger": {
        "enabled": true,
        "runFunction": "https://workspaceguard.novabytelab.in/addon/homepage"
      },
      "layoutProperties": {
        "primaryColor": "#4f46e5",
        "secondaryColor": "#4f46e5"
      },
      "logoUrl": "https://img.icons8.com/fluency/96/shield.png",
      "name": "WorkspaceGuard",
      "universalActions": [
        {
          "label": "Open Interactive Security Console",
          "openLink": "https://workspaceguard.novabytelab.in/addon/sidebar-ui"
        },
        {
          "label": "Download SOC 2 Evidence Certificate",
          "openLink": "https://workspaceguard.novabytelab.in/reports/soc2-certificate"
        },
        {
          "label": "Manage Plan \u0026 Billing",
          "openLink": "https://workspaceguard.novabytelab.in/subscription"
        }
      ]
    },
    "drive": {
      "homepageTrigger": {
        "enabled": true,
        "runFunction": "https://workspaceguard.novabytelab.in/addon/homepage"
      }
    },
    "gmail": {
      "contextualTriggers": [
        {
          "onTriggerFunction": "https://workspaceguard.novabytelab.in/addon/homepage",
          "unconditional": {}
        }
      ]
    },
    "httpOptions": {}
  },
  "oauthScopes": [
    "https://www.googleapis.com/auth/userinfo.email",
    "https://www.googleapis.com/auth/userinfo.profile",
    "https://www.googleapis.com/auth/gmail.addons.execute",
    "https://www.googleapis.com/auth/drive.addons.metadata.readonly",
    "https://www.googleapis.com/auth/calendar.addons.execute",
    "https://www.googleapis.com/auth/admin.directory.user",
    "https://www.googleapis.com/auth/admin.directory.group",
    "https://www.googleapis.com/auth/admin.reports.usage.readonly",
    "https://www.googleapis.com/auth/admin.reports.audit.readonly",
    "https://www.googleapis.com/auth/apps.licensing",
    "https://www.googleapis.com/auth/admin.datatransfer",
    "https://www.googleapis.com/auth/gmail.settings.basic",
    "https://www.googleapis.com/auth/gmail.settings.sharing"
  ]
}

6-Vector Gmail Exfiltration & Stale Delegation Risk Map