See the service accounts before they spend the budget.
CloudGuard monitors your Google Workspace directory for compromised credentials, watches Google Cloud IAM for rogue minting bursts, and flags targeted spear-phishing with strict per-user opt-in and zero message body retention.
A compromised developer login or CI token can mint 100+ service accounts in minutes.
Attackers do not wait for business hours. When a service account key or developer session is compromised, automation scripts rapidly create secondary accounts, bind owner permissions, and spin up GPU clusters or Vertex AI jobs.
Periodic Billing Threshold Alerts
The Core Flaw:
Billing alerts notify you after money has already been spent. By the time an email reaches the finance team, hundreds of runaway instances have completed execution.
Cloud Logging Velocity Correlation
The CloudGuard Advantage:
CloudGuard evaluates the service account creation velocity heuristic every 60 seconds, placing the burst anomaly at the top of your triage queue before quota exhaustion.
Three pillars of Google Workspace and Cloud defense.
CloudGuard avoids the noise of generic security tools by focusing strictly on Google Workspace identity, Google Cloud IAM infrastructure, and opted-in phishing defense.
Directory & Breach
Core Protections
- Continuous Directory Enumeration: Syncs users, organizational units, and multi-factor status via Google Workspace Admin SDK.
- Truncated SHA-256 Lookups: Only truncated hash prefixes are sent to LeakCheck and HIBP. Passwords and full emails never leave your domain.
- Privilege Exposure Alerts: Instantly correlates breached credentials with Super Admin and GCP billing role holders.
Cloud & IAM Radar
Core Protections
- Velocity Anomaly Detection: Evaluates service account creation speed and user-managed key generation against historical baselines.
- Stale Key & Public Leak Radar: Continuously monitors for unrotated keys and unauthorized role grants (`roles/owner`).
- Runaway Compute Protection: Flags service account bursts before high-cost compute or Gemini API quota limits are triggered.
Targeted Mailbox Shield
Core Protections
- Individual Consent Architecture: Mail scanning requires explicit employee opt-in. Administrators cannot silently inspect mail.
- Zero Body Retention: Analyzes email headers and threat metadata in memory. Message bodies are never written to database or disk.
- Quarantine Without Deletion: Flags and moves malicious emails to a quarantine label, preserving message integrity and audit trails.
Built specifically for Google Workspace and Google Cloud.
CloudGuard does not attempt to be a bloated, multi-cloud generic SIEM. We specialize deeply in Google ecosystem identity, IAM heuristics, and employee mailbox boundaries.
- Google Workspace Super Admins: Teams that need continuous credential breach monitoring without sending plaintext passwords or full addresses to external breach vendors.
- GCP Platform & SecOps Engineers: Security teams monitoring multi-project IAM for rogue keys, rapid service account mint bursts, and unauthorized owner role bindings.
- DevOps & Infrastructure Leads: Teams managing CI/CD pipelines and service account quotas who need alerts before runway compute burns their cloud budget.
- Privacy-Conscious Organizations: Companies that want targeted phishing defense without archiving employee message bodies or triggering privacy pushback.
- ✕AWS-only or Azure-only stacks: CloudGuard is purpose-built for Google Cloud Platform and Google Workspace APIs. We do not support non-Google clouds.
- ✕Employee surveillance or spyware: We reject keystroke loggers, screen scrapers, or secret mailbox snooping. Mail scanning requires explicit per-user opt-in.
- ✕Uncontrolled destructive automation: We do not autonomously delete projects or purge mailboxes. Containment playbooks require human administrator approval.
- ✕Personal @gmail.com consumers: CloudGuard is built for domain-verified Google Workspace organizations and Google Cloud projects.
High-craft admin clarity: scopes, permissions, and guarantees.
Security tools must be transparent about the authority they require. CloudGuard operates with minimal, read-only permissions and enforces absolute data privacy boundaries.
| OAuth Scope / Role | Google Service | Access Level | Operational Purpose | Data Stored |
|---|---|---|---|---|
| admin.directory.user.readonly | Google Workspace Admin SDK | READ ONLY | Enumerate active domain user accounts, organizational units, and multi-factor authentication enforcement. | Email, name, OU, MFA status |
| admin.reports.audit.readonly | Google Workspace Reports API | READ ONLY | Inspect admin activity logs, third-party OAuth app authorizations, and login anomaly events. | Audit event type, timestamp, IP |
| roles/logging.viewer & roles/viewer | Google Cloud Platform | READ ONLY | Query Cloud Logging audit entries to detect rapid service account creation bursts and unauthorized key generation. | IAM method, caller ID, account count |
| gmail.modify (Restricted, Opt-In) | Gmail API (Per-user consent) | QUARANTINE ONLY | Inspect RFC 822 email headers for phishing heuristics and apply the CloudGuard/Quarantine label. Never deletes mail. | Headers only (Zero body stored) |
Zero Password Retention
CloudGuard never requests, accesses, or persists user passwords. Passwords never touch our servers or databases.
AES-256-GCM Encryption
All OAuth refresh tokens and database secrets are encrypted at rest with authenticated AES-256-GCM encryption.
Truncated k-Anonymity
Breach queries only send a 10-character SHA-256 hash prefix to third-party databases. Full email addresses remain private.
Non-Destructive Actions
CloudGuard recommends remediation and quarantines messages to labels. It never purges mailboxes or deletes cloud resources autonomously.
Straight answers to enterprise security questions.
Before connecting an organization or cloud account, security teams need hard technical boundaries rather than vague promises.
No. Invariant 1: Zero message body retention. CloudGuard inspects RFC 822 email headers (sender, SPF/DKIM/DMARC status, and Punycode spoofing) inside ephemeral RAM buffers (<50ms) and immediately discards the data. Message text is never saved to database or disk.
No. Invariant 2: Read-only fail-closed. CloudGuard connects with viewer and logging viewer permissions. Containment playbooks (disabling rogue accounts or revoking minting keys) are generated as recommended actions requiring explicit administrator execution.
Invariant 3: Zero plaintext exposure. All OAuth tokens are encrypted at rest with AES-256-GCM using per-tenant key derivation. We store zero passwords, zero keys, zero email bodies. An attacker gaining database access acquires no plaintext credentials or message content.
Under 2 minutes via Google OAuth. CloudGuard is 100% agentless. There are no Kubernetes daemonsets, virtual machine agents, or proxy hops to install or maintain. Directory sync and IAM telemetry activate immediately upon OAuth authorization.
Connect Google Workspace in under 2 minutes.
Start with a read-only verification of your organization directory and breach exposure. Mailbox scanning remains disabled until team members choose to opt in.
- 1Authenticate as a Google Workspace domain administrator.
- 2Synchronize organizational users and perform k-anonymity breach scan.
- 3Link Google Cloud projects to activate the IAM minting abuse radar.
- 4Team members connect Gmail to enable targeted phishing quarantine.
Customer Safety Matrix
Can CloudGuard leak your company data? Every risk is backed by mathematical invariants, zero-storage architectures, and open code proof.