hookguard
FAQ
// OUR ZERO-TRUST CONTRACT

We don't participate in the extraction economy.
We build immutable governance.

Trust is not a marketing tagline; it is a cryptographic architecture. When you connect hookguard to your Google Workspace, you are protected by a strict API-first, keyless boundary. We never read your emails. We never scan your document contents. We never install agents on employee laptops.

01. Keyless DWD

No Stored JSON Keys

We never ask you to generate, download, or upload highly-privileged Service Account JSON keys. hookguard relies entirely on short-lived, ephemeral OAuth assertions signed directly by the Google Cloud IAM API.

02. Metadata Only

Zero Payload Access

We inspect the envelope, never the letter. We read OAuth client IDs, granted scopes, file sharing permissions, and modification timestamps. We are cryptographically restricted from reading email bodies or Drive document contents.

03. Zero Endpoints

No MDM / No Agents

No software to install on employee MacBooks. No battery drain, no privacy violations, and no deployment friction. Our API-to-API engine audits your entire domain cloud-side in exactly 90 seconds.

// THE BLIND SPOTS

What Google Admin Doesn't Tell You

VULNERABILITY
The Password Fallacy

When an employee connects an AI tool (like ChatGPT) or a workflow automation (like Zapier) to their corporate Google account, it generates a persistent "refresh token."

The Reality: If that employee's account is compromised—or if they leave the company—resetting their password or enforcing 2FA does not revoke those third-party tokens. That machine-to-machine backdoor remains wide open until explicitly severed via the API.

VULNERABILITY
The Shared Drive Trap

Google Drive makes it trivial for an employee to set a folder to "Anyone with the link" or invite an external contractor's personal Gmail to a Shared Drive.

The Reality: Two years later, that contractor still has full read access to financial statements, internal pricing sheets, and proprietary CAD files. hookguard automatically crawls every Shared Drive and user account, surfacing external collaborators and public gateways so leadership can revoke access instantly.

VULNERABILITY
The Vendor Supply Chain Backdoor

Years ago, your team authorized a SaaS backup tool, a project management plugin, or an email migration service. You stopped using the vendor, but nobody revoked the OAuth application ID.

The Reality: When that external vendor suffers a breach, threat actors abuse those lingering, high-privilege API credentials to pivot laterally into your domain—completely bypassing passwords and MFA. hookguard's ghost token reconciliation surfaces every forgotten integration and lets you sever dormant vendor access in 90 seconds.

VULNERABILITY
The Zombie SaaS Tax

Offboarded employees, disabled accounts, and untouched contractors leave behind digital footprints consisting of thousands of gigabytes of stale files and active license assignments.

The Reality: You are paying Google monthly for pooled storage overages and suspended seats. hookguard's ROT (Redundant, Obsolete, Trivial) analysis finds exact file duplicates and data stale for >365 days, yielding immediate ROI by shrinking your monthly Google invoice.

// DELIVERABLE-AS-A-SERVICE

Executive Intelligence, Delivered.

You have a business to run. You do not have time to learn a new dashboard, interpret raw API scopes, or configure alert thresholds. That's why we operate as a concierge service.

1. Connect in 90 Seconds Authorize our Client ID in your Google Admin console. No software deployments.
2. We Analyze (Aurelius AI) We map your exposure, translate complex developer permissions into plain English, and isolate risks.
3. Receive Your Audit Dossier You receive a forensic governance ledger documenting every exposed file, every third-party integration, and exact remediation instructions. Keep it as immutable documentation for your annual insurance renewals, client security reviews, and upcoming compliance audits.

// FREQUENTLY ASKED QUESTIONS

Can't I just do this myself in the Google Admin Console? +
Google Admin is a directory, not an audit engine. To find rogue third-party apps natively, an admin must click into individual users one-by-one, open their security tabs, decipher raw OAuth URL scopes, and manually cross-reference if the app is still needed. hookguard aggregates your entire fleet instantly and translates developer jargon into plain business risk.
What happens if hookguard gets breached? +
Blast radius minimization is our core design philosophy. Because we store zero private keys, zero user passwords, and zero document payloads, an adversary compromising our infrastructure gains zero static credentials to access your Google Workspace. We rely entirely on dynamic, short-lived tokens that expire within 60 minutes.
We don't hold sensitive consumer data or code. Why do we need this? +
You don't need HIPAA or military-grade encryption to care about governance. You have employee payroll records, internal pricing models, vendor agreements, and supplier lists. When files are shared broadly across internal folders or left open to outside personal Gmail accounts, you lose control of your operational IP. hookguard gives you a clean balance sheet of your file security without forcing you to become an IT specialist.
Will this spam my inbox with meaningless alerts? +
No. We do not believe in heuristic "risk scores" or alert fatigue. hookguard operates on deterministic boundary facts. You only receive an alert or ledger update when a factual event occurs: a file is exposed to the public web, a new non-human integration requests mailbox authority, or an external contractor is granted access to a Shared Drive.
How long does deployment take? Does it require downtime? +
Deployment takes exactly 90 seconds. There is zero downtime, zero DNS record modification, and zero end-user impact. You copy our registered Client ID, paste it into your Google Admin Security panel, and authorize our metadata-only audit and token-revocation scopes (zero document or email content access). We handle the rest.
Secure Your Workspace in 90 Seconds