Security
A short summary of how StockadeAI connects. This is not a full security review.
Read-only scopes
An admin connects Google Workspace or Microsoft Entra with read-only access. StockadeAI can see names and email addresses, the third-party apps those people or an admin have allowed, and the access each app requested, such as mail or files. It does not read the mail or files themselves. It does not change or remove anything in your directory.
No email content stored
We store the list of people, apps, and requested access, the findings from each scan, and when the scan ran. We do not store email content or file contents. The connection used to scan again is encrypted. We never store your password.
Revoke any time
Disconnect deletes our copy of the connection and stops new scans. On Google, we also revoke our access so StockadeAI drops off that admin account's third-party access. On Microsoft, disconnect removes the connection stored here; there is no user refresh token to revoke, so remove the enterprise app in Entra if you want it gone there too. Findings already saved stay in StockadeAI. We do not change or remove anything in your directory.