CSE: QSE
Quantum Secure Encryption Corp.
Book an assessment

QAuth · Google Workspace (formerly G Suite)

QAuth for Google Workspace

Decide who reaches your Workspace data, from where, and what can leave.

Google Workspace makes it easy to work from anywhere. QAuth adds the controls that are left to you: where and when people can sign in, which devices and browsers they use, and what can be shared, downloaded or emailed out of Drive and Gmail.

Talk to the QAuth team See 20 Workspace case studies

Where data leaks

Most Workspace data loss starts with an ordinary day.

  • Someone stays signed in on a shared or public computer

  • A document is shared with the wrong person outside the company

  • Files are moved to a personal Drive or sent from personal Gmail

  • A link in a phishing email gives away a password

  • A third-party app signed into with a work account asks for Drive and calendar access

  • Business documents reach a competitor

Access control

Sign-in on your terms, per user or OU.

Each policy applies to the whole organisation, one organisational unit (OU) or a single user, so Finance can be held to the office network while a sales team works from anywhere.

Every control explained

IP restriction

Allow sign-in only from the addresses you define, such as the office or VPN.

Device restriction

Bind people to approved machines by MAC address.

Browser restriction

Allow only the browsers IT approves.

Time restriction

Limit access to working days and hours, across time zones.

Geo-fencing

Allow access only from the countries or cities you choose.

Session timeout

Sign out idle sessions and cap how long a session lasts.

Personal Gmail block

Stop personal Google accounts on company networks and devices; company Gmail keeps working.

Third-party app block

Only apps you’ve whitelisted can be signed into with a work account.

Google Drive DLP

Two ways to control Drive. Use either, or both.

An agent gives inline control on company machines. The agentless mode works through the Google Drive API with nothing to install. Policies can differ for each group of users, and set-up takes hours.

Agent-based

Inline control on company devices.

  • OUStop documents being shared across departments, such as Finance to Operations.
  • EXTTrack or block sharing with blacklisted domains, such as personal or competitor domains.
  • DLTrack or block downloads to unapproved devices.
  • DELTrack or block deleting documents.
  • GMAILBlock personal Gmail on the company network and devices.
  • COPYBlock copying from Drive documents into other apps or websites.

Agentless

Nothing to install, action in near real time.

  • ORGSpot sharing outside the organisation, for example with a competitor.
  • PERSpot sharing with personal addresses such as gmail.com or outlook.com.
  • KEYSpot documents that contain your keywords or regular expressions.
  • REVThen revoke every permission except the owner’s.
  • MGRNotify the user’s reporting manager.
  • ADMNotify the super admin.

The agent acts as a web proxy for the applications you monitor only. Other traffic goes straight to the web, and the agent stores nothing it inspects.

Gmail DLP

An outbound gateway for company mail.

QAuth becomes the gateway for outgoing mail from the users you choose. It is configured on your Workspace domain within hours, with different policies for different groups.

Detects mail…

  • To personal domains such as gmail.com, outlook.com or aol.com
  • To domains your people shouldn’t be writing to
  • Containing keywords, using PII and PHI policies or your own regular expressions
  • Carrying attachment types you’ve marked restricted

Then…

  • Rejects it and tells the sender
  • Tracks the conversation
  • Notifies the sender’s reporting manager
  • Notifies the super admin

Chromebook

The same controls on Chrome OS fleets.

Chromebooks are built for defence in depth, but what users do with company data is still your responsibility. QAuth brings the same agent-based and agentless DLP to Chromebooks, and browser restriction is rolled out through the Chrome management console.

  • Stop documents being shared across departments
  • Track or block deleting documents and sharing with blacklisted domains
  • Block personal Gmail on company-owned Chromebooks
  • Block copying from Drive documents into other apps or websites
  • Device and browser restriction for each OU

Active Directory

Keep Active Directory in charge of identity.

Use the directory you already run as the identity provider for Google Workspace. People keep one password, and the policies you set in AD still apply after the move to the cloud.

Identity provider
On-premises Active Directory, or Azure AD (now Microsoft Entra ID)
Architecture
The QAuth SSO server sits in the same domain as Active Directory and acts as the authentication agent inside your network
Complex directories
Multiple forests, with each location’s users bound to their own domain controller
Mixed users
Staff authenticate against AD, while people outside it, such as vendors, can use QAuth as their identity provider
Passwords
A password changed in Active Directory is synchronised to Google Workspace

Education

One sign-in for schools and universities.

Schools, colleges and universities use QAuth single sign-on to connect Microsoft Active Directory to Google Workspace for Education. Students and staff get one set of credentials, and the sign-in page carries the institution’s own name and logo instead of the generic Google page.

About the custom login page

From the case studies

Get started

Add QAuth to your Workspace domain.

The QAuth team will help you with:

  • Choosing agent-based, agentless or both for Drive
  • Setting access policies for each OU
  • Connecting Active Directory
Talk to the QAuth team