Stop Silent Gmail Leaks & Reclaim Wasted Workspace Licenses in One Click.
Google Workspace bills you 100% full price for suspended users and buries employee filter-forwarding, personal POP3 mailbox pulls, and cross-department inbox delegations across Admin menus. WorkspaceGuard audits your entire domain in 60 seconds — natively inside your Google Workspace Add-on sidebar in Gmail, Google Drive, and Google Calendar.
Calculate How Much Google Workspace Is Overbilling Your Domain
On average, 9% to 14% of Google Workspace seats belong to suspended former employees (which Google still bills at 100%) or dormant contractors. Adjust the sliders to calculate your instant savings:
Built for Workspace Super Admins, Security Leads & FinOps Teams
6-Vector Gmail Exfiltration & Delegation Auditor
Standard admin scripts only inspect global auto-forwarding. Departing salespeople and insiders bypass that using Gmail Filters, POP3 pulls, or `Reply-To` spoofing. WorkspaceGuard inspects all 6 vectors:
- 1. Global Auto-Forwarding (`users.settings.autoForwarding`): Detects active mirroring to `@gmail.com`, `@icloud.com`, `@yahoo.com`, or external domains.
- 2. Silent Filter Forwarding (`users.settings.filters`): Catches hidden filters forwarding `subject:(invoice OR contract OR stripe)` to personal accounts.
- 3. Dormant Verified Addresses (`forwardingAddresses`): Flags verified personal emails sitting 1 click away from activation.
- 4. Cross-Department & Stale Delegates (`delegates`): Detects contractors or former teammates with full inbox read/send access.
- 5. External POP3 Mailbox Pulling (`users.settings.pop`): Blocks personal Gmail accounts from pulling work mail via POP3.
- 6. Send-As / `Reply-To` Hijacks (`users.settings.sendAs`): Detects external `replyToAddress` diversions.
Multi-Signal Dormant & "Suspended-Still-Billed" Reclaimer
Admins hesitate to delete suspended or inactive accounts because they don't want to lose Google Drive files or bounce incoming customer emails. Our 1-Click Safe Reclaim Playbooks automate the entire lifecycle:
- Multi-Signal True Last Active Engine: Combines Web Login + SSO + Gmail Interaction + Drive Edit + OAuth Token activity so mobile-only executives are never falsely flagged.
- Playbook 1 (Transfer Drive + Delete Seat + Create $0 Free Alias): Automatically transfers all Drive & Calendar files to the user's manager via `admin.datatransfer.v1`, deletes the paid seat, and attaches their email as a $0/mo Free Alias on the manager's inbox in 2 seconds.
- Playbook 2 (Swap to $4/mo Archive User SKU): Preserves Google Vault legal holds while cutting seat cost by up to 85%.
- Playbook 3 (Quarantine OU & Strip Add-Ons): Strips costly Gemini/Voice add-on SKUs.
How WorkspaceGuard Compares
| Capability | WorkspaceGuard | GAT+ (GAT Labs) | BetterCloud | GAM CLI Scripts |
|---|---|---|---|---|
| 6-Vector Gmail Exfiltration (Filters + POP3 + Reply-To) | ✓ Included Out-of-the-Box | Partial (Complex manual queries) | Requires custom workflow build | Manual CLI commands only |
| 15-Minute Admin Audit Log Delta Alerts | ✓ Automated Background Daemon | Batch delayed | ✓ Enterprise tier | × None |
| 1-Click Drive Transfer + Convert Seat to $0 Free Alias | ✓ 1-Click Playbook | Requires separate GAT Flow license | ✓ Multi-step setup | Requires 4 separate scripts |
| Signed SOC 2 / ISO 27001 Evidence Certificate | ✓ 1-Click PDF & CSV | Raw CSV exports | Custom reports | × Raw terminal text |
| Pricing & Contract Flexibility | $39 – $119/mo (Cancel anytime) | Annual quote required | $5,000 – $25,000+/yr contract | Free (High IT maintenance cost) |
Pay Per Domain — Not Per User. Reclaiming 2 Seats Pays for the Entire Tool.
Processed securely by Dodo Payments (Merchant of Record) with automatic global GST/VAT/Sales Tax invoicing.
Starter
For domains up to 75 users
- ✓ Weekly 6-Vector Gmail Exfiltration Scan
- ✓ Multi-Signal Dormant & Suspended Seat Detector
- ✓ 1-Click Gmail Forwarding & Delegate Revocation
- ✓ CSV Audit Export
Growth
For domains up to 250 users
- ✓ Everything in Starter
- ✓ 15-Minute Real-Time Audit Log Delta Watcher
- ✓ 1-Click Drive Transfer + $0 Free Alias Playbook
- ✓ Signed SOC 2 / ISO 27001 Evidence PDF
- ✓ Monthly CFO License Savings Receipt
Scale
For domains up to 1,000 users
- ✓ Everything in Growth
- ✓ 1-Click Employee Self-Attestation Emails
- ✓ Annual Contract Renewal Cliff Optimizer
- ✓ Real-Time Slack / Google Chat / SIEM Webhooks
- ✓ Priority 4-Hour Support SLA
Frequently Asked Questions
Can WorkspaceGuard read our employees' emails?
No. WorkspaceGuard never requests `gmail.readonly`. We strictly use `gmail.settings.basic`, which only exposes configuration metadata (forwarding addresses, filter criteria, delegates, and POP3 status) and has zero access to message bodies or attachments.
Does Google really bill us for Suspended users?
Yes. Suspending a user in Google Workspace blocks their login but continues charging 100% of their monthly license fee. Our Playbook 1 transfers their Drive files to their manager, deletes the paid seat, and converts their address into a $0/mo Free Alias.
How does billing & tax invoicing work?
All subscriptions are processed by Dodo Payments, our Merchant of Record, which automatically issues compliant GST, VAT, and US Sales Tax B2B invoices. See our Pricing Overview and Refund Policy for full details.
How is WorkspaceGuard deployed?
Natively inside Google Workspace. Once installed by a Super Admin via the Google Workspace Marketplace, WorkspaceGuard runs directly in the Gmail, Google Drive, and Google Calendar Add-on sidebars.