Your security team will actually approve this one
ShareWatch gives Claude scoped access to Google Docs, Sheets, and Slides with a complete audit trail, granular permissions, and zero content retention. Infrastructure-level enforcement — not prompts.
This is what your auditor gets
Live tailLive tail, search, filter, CSV export, or streamed to your SIEM in real time.
User, file, MIME type, bytes, duration — every read, write, and create.
Claude Cowork, Claude Code, Browser, API — identified and badged per row.
Expand a row for the policy decision, who set it, and a reference ID for the admin.
Approve AI without approving your whole Drive
Org defaults, group policies, per-user overrides, deny-wins. Revoke a file mid-conversation. Export the evidence.
READ THE CONTROLS →drive.file scope, Zanzibar-inspired RBAC, no cache layer
Per-user OAuth tokens, SHA-256 hashed at rest. Structured events over Pub/Sub. Two minutes to a working connector.
READ THE DOCS →Four answers to the questions that kill AI adoption
“Can it read everything in Drive?” No.
Claude sees only files created through ShareWatch or explicitly picked by the user. No browsing, no shared drives. Google enforces it at the API layer — not us.
“Who decides who can write?” You do, three levels deep.
Everyone can read, Engineering can write, but not Jeff — Jeff deleted last month's financials. Deny wins, and the full evaluation chain is visible to admins and users.
“Can we pull it back?” Instantly, mid-conversation.
Block a file and it's gone from the session. Disable a user and every session is revoked. Re-enable with one click. Blocked attempts are logged with an audit reference.
“Where does our content sit?” Nowhere.
Content passes through and is never cached, stored, logged, or written to disk. Per-user OAuth tokens, no shared service accounts. An architectural constraint, not a config flag.
Up and running in 2 minutes
One URL in Claude. No config files, no API keys.
ShareWatch requests only drive.file — the most restrictive file scope Google offers — and every scope it requests is non-sensitive under Google's classification.
Create docs, read spreadsheets, build decks. Everything logged, scoped, auditable.
Security by architecture, not by policy
No amount of prompt engineering bypasses an OAuth scope restriction. Enforcement lives at the infrastructure layer, where it can't be talked around.
ShareWatch is a few weeks old and does not have a SOC 2 report yet. It's on the roadmap — Type I first, then Type II — and we won't claim either until an auditor signs. Until then the controls above are the whole story, and they are verifiable today: read the audit schema, check the requested scopes on the Google consent screen, and see for yourself that nothing is cached.
“Give me a clean refusal over a quiet hope. A denied API call is unambiguous. My judgment, under adversarial pressure, is not.”
— Claude, in an unedited review of the tools that constrain it
Full audit log and scoped access at no cost. Team and org plans add group policy, per-user overrides, SAML/OIDC SSO, and SIEM export.
SEE PLANS →Ready to let your team use AI — safely?
The security controls your CISO requires. The AI access your team wants.