Security & Compliance FAQ #17

Security & Compliance FAQ

MonitorWorkspace handles sensitive organizational data, so security is a top priority. Here are answers to common security and compliance questions.

How is data transmitted?

All data is transmitted over HTTPS/TLS 1.3. We use Google's official APIs with OAuth 2.0 and domain-wide delegation — no plaintext or insecure connections.

What data do you store?

What Google API scopes do you use?

We request only the scopes necessary for each feature:

• admin.directory.user.readonly — Read user directory
• admin.directory.group.readonly — Read group information
• admin.directory.group.member.readonly — Read group memberships
• gmail.readonly — Read email metadata and content
• chat.messages.readonly — Read chat messages
• chat.spaces.readonly — Read chat space information
• apps.licensing — Read license assignments
• mail.google.com — Required for email transfers (write access)

Can employees see that they're being monitored?

Your organization's acceptable use policy should inform employees about monitoring regardless of plan tier.

Is MonitorWorkspace SOC 2 compliant?

We are working toward SOC 2 Type II compliance. Enterprise customers can request our current security documentation.

Can I run MonitorWorkspace on-premises?

Not currently. MonitorWorkspace is a cloud-hosted SaaS application. On-premises deployment is being considered for Enterprise customers — if this is important to you, please add your vote to the Ideas category.

How do I report a security vulnerability?

DO NOT post security vulnerabilities in public discussions or issues.

Email: security@monitorworkspace.com

We follow responsible disclosure practices and will acknowledge reports within 48 hours.

Have a security question? Ask below — but remember, never post credentials, tokens, or real user data!