--- title: SpySecure® | Which apps and AI tools can read your company data? description: Employees connect AI tools to work e-mail and files with one click. How to check which apps have access in Microsoft 365 and Google Workspace. image: https://www.spysecure.nl/hubfs/B8_featured_image_EN-1.png --- ✓ Trusted by **100+** businesses★★★★★ **5.0** on Google[View our plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) - Cybersecurity for businesses - All-in-one cybersecurity - Who it's for - Our approach - Pricing [NL](https://www.spysecure.nl/kennis/ai-tools-gekoppelde-apps-bedrijfsgegevens)[EN](https://www.spysecure.nl/en/knowledge/ai-tools-connected-apps-company-data) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq?hsLang=en) NIS2 Does NIS2 apply to your business? Read what the law requires and how to show your security is in order. [Go to NIS2 →](https://www.spysecure.nl/en/nis2?hsLang=en) [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Plans From €9.99 per licence per month. Fully managed, including all the security software you need. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Customer stories ★★★★★ Trusted by 100+ businesses Read how business owners placed their security with us. [Read the customer stories →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Google reviews ★★★★★ 5.0 on Google Our customers rate us 5 stars. [What our customers say →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) Cybersecurity for businesses - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq?hsLang=en) All-in-one cybersecurity [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Who it's for Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Our approach - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Pricing - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) [NL](https://www.spysecure.nl/kennis/ai-tools-gekoppelde-apps-bedrijfsgegevens)[EN](https://www.spysecure.nl/en/knowledge/ai-tools-connected-apps-company-data) AI security Cloud security # Which AI tools can read your company e-mail and files? Employees connect AI tools to work e-mail and files with one click. How to check which apps have access in Microsoft 365 and Google Workspace. 16 October 2026 ![SpySecure](https://www.spysecure.nl/hubfs/icon%201%20-%20no%20white%20-%20resized.png) SpySecure [![Diagram: company e-mail and files connected to AI tools and other apps. Two apps have been checked; one unknown AI tool, added by an employee, can read all e-mail and files and has not been checked.](https://www.spysecure.nl/hubfs/B8_featured_image_EN-1.png)](https://www.spysecure.nl/hubfs/B8_featured_image_EN-1.png?hsLang=en) Click to enlargeTap to enlarge An employee tries a new AI tool that summarises e-mails and documents. They sign in with their work account and click "Accept". From that moment, the tool can read their company e-mail and files. Often nobody else knows. AI assistants, note-takers and calendar apps all ask for access to work accounts. Some are useful. Some keep access long after anyone uses them. This article explains what that click gives away and how to check which apps have access in Microsoft 365 and Google Workspace. **Jump to:** [What "Accept" does](https://www.spysecure.nl/en/knowledge/ai-tools-connected-apps-company-data#accept) [What an app can see](https://www.spysecure.nl/en/knowledge/ai-tools-connected-apps-company-data#see) [How to check](https://www.spysecure.nl/en/knowledge/ai-tools-connected-apps-company-data#check) [5-step checklist](https://www.spysecure.nl/en/knowledge/ai-tools-connected-apps-company-data#checklist) ## What happens when an employee clicks "Accept"? The employee lets the app use their work account. The app does not get the password, but its own key. That key keeps working in the background. 1**Sign in** The employee signs in to an AI tool with their work account. 2**Permission** The tool asks: "Read your mail" or "See your files". 3**Access** After one click, the tool can read that data, also when the employee is offline. Both Microsoft 365 and Google Workspace allow this by default. In Microsoft 365, an employee can approve any permission that does not need an administrator, such as reading their own mailbox. In Google Workspace, employees can connect apps unless an administrator has blocked this. In an earlier article, we explained [how to tell AI agent activity from an attacker](https://www.spysecure.nl/en/knowledge/ai-agent-activity-employee-or-attacker?hsLang=en). This article is about the step before: which tools have access at all. ## What can a connected app see? That depends on what the employee approved. Common permissions are:   ### E-mail Read, send or delete messages, including attachments such as invoices.   ### Files Open documents in OneDrive, SharePoint or Google Drive.   ### Calendar and contacts See your meetings and the details of customers and suppliers.   ### Lasting access Keep access to the data after the employee closes the app. The risk is also the company behind the app. If it is hacked, criminals can use its keys to reach your data. This happened in August 2025. Criminals stole the keys of Drift, a chat app that many sales teams had connected to Salesforce and to their e-mail. According to Google, they used those keys to export data from the Salesforce systems of many companies. Through the e-mail connection, they also read e-mail in Google Workspace accounts that were linked to Drift. They did not need a single password. ## How do you check which apps have access to company data? Both Microsoft 365 and Google Workspace keep a list. It also includes apps that a single employee approved.   ### Microsoft 365 **Where to look:** the Microsoft Entra admin center, under Enterprise applications. **What you see:** every app that an employee or an administrator approved. Per app, the Permissions page has a separate User consent tab. It shows which employees approved the app and what it may do.   ### Google Workspace **Where to look:** the Admin console, under Security, Access and data control, API controls, Accessed apps. **What you see:** the apps that employees connected to their work account, how many employees use each one, and which data it uses, such as Gmail or Drive. These lists do not show e-mails or files that employees copy into a personal AI account. That needs clear agreements (step 4 below). Then ask four questions for every app: **Who uses it?** If nobody can explain why it is there, remove it. **What may it do?** Reading all e-mail is very different from only seeing someone's name. **Who makes it?** Microsoft and Google mark checked publishers as verified. Look closer at unknown names. **Is it still in use?** Old trials and apps of former employees often keep access. ## Checklist: 5 steps to control AI tools and connected apps You do not need to ban AI tools. You need to know which ones have access, and decide who may approve new ones. 1 ### Make a list of connected apps Export the list from Microsoft 365 or Google Workspace. Note per app who uses it and what it may access. 2 ### Remove what nobody needs Revoke access for unknown apps, old trials and apps with more rights than they need. 3 ### Limit what employees may approve In Microsoft 365, allow only verified publishers and low-impact permissions, and let employees request the rest. In Google Workspace, mark apps as trusted, limited or blocked. These settings do not remove existing access. 4 ### Agree which AI tools are allowed A short list of approved tools gives employees a safe choice. Also agree that company e-mail and files do not go into personal AI accounts. 5 ### Watch for unusual behaviour An app that suddenly downloads large amounts of e-mail or files must be noticed and stopped, also at night. ## In short - With one click, an employee can give an AI tool access to company e-mail and files. - That access keeps working in the background. If the app's supplier is hacked, criminals can use it too. - Check the list of connected apps, remove what nobody needs and decide who may approve new ones. SpySecure can take this off your hands. Our [cybersecurity plans](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) monitor Microsoft 365, Google Workspace and your cloud apps 24/7 for unusual behaviour. See which [security layers your SME needs](https://www.spysecure.nl/en/security-layers-smes?hsLang=en). Contact ## Want to know which apps can read your company data? Leave your details and we will get in touch to look at your situation together.   Sources - [Microsoft Learn: Configure how users consent to applications](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent) - [Microsoft Learn: Review permissions granted to enterprise applications](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions) - [Microsoft Learn: Configure the admin consent workflow](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow) - [Google Workspace Admin Help: Control which third-party and internal apps access Google Workspace data](https://support.google.com/a/answer/13152743) - [Google Threat Intelligence: Data theft from Salesforce instances via Salesloft Drift](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift) [AI security](https://www.spysecure.nl/en/knowledge/tag/ai-security) [Cloud security](https://www.spysecure.nl/en/knowledge/tag/cloud-security) In this article [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%20white%20(bold)%20-%20transparent%20-%20sized.png?width=200&height=34&name=logo%20white%20(bold)%20-%20transparent%20-%20sized.png)](https://www.spysecure.nl/en/?hsLang=en) Fully managed cybersecurity, training and compliance for scale-ups and SMEs. - 24/7 monitoring, detection and response - Monthly reporting ### Solutions - [Managed Security](https://www.spysecure.nl/en/managed-security?hsLang=en) - [Compliance](https://www.spysecure.nl/compliance?hsLang=en) - [Security Awareness Training](https://www.spysecure.nl/training?hsLang=en) - [NIS2](https://www.spysecure.nl/nis2?hsLang=en) - [Domain protection](https://www.spysecure.nl/domeinbescherming?hsLang=en) - [For IT partners](https://www.spysecure.nl/partners?hsLang=en) ### Pricing - [All-in-one plans](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual services](https://www.spysecure.nl/en/security-services?hsLang=en) ### Resources - [Events and webinars](https://www.spysecure.nl/events?hsLang=en) - [Blog](https://www.spysecure.nl/kennisbank?hsLang=en) - [FAQ](https://www.spysecure.nl/en/faq?hsLang=en) - [Customer stories](https://www.spysecure.nl/en/our-customers?hsLang=en) ### Contact - [Book an introduction](https://www.spysecure.nl/en/contact?hsLang=en) - [contact@spysecure.nl](mailto:contact@spysecure.nl) - [+31 20 261 2897](tel:+31202612897) ### Newsletter Once a month: the key threats and tips for your business. Ask AI about SpySecure®[ChatGPT](https://chatgpt.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Claude](https://claude.ai/new?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Gemini](https://gemini.google.com/app?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Perplexity](https://www.perplexity.ai/search?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Copilot](https://copilot.microsoft.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Grok](https://grok.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.) © SpySecure® 2026. All rights reserved. [Privacy](https://www.spysecure.nl/privacy-policy?hsLang=en)[Cookies](https://www.spysecure.nl/cookie-policy?hsLang=en)[Terms](https://www.spysecure.nl/en/terms?hsLang=en)