OAuth Integration, Data Handling and Access Revocation

Step-by-Step Guide | Client User Flow

This section explains the end-to-end process for configuring the Integration Engine to connect to your Google Workspace environment using OAuth integration. It outlines the user authorization flow, the permissions requested, how data is accessed and handled, and the steps to review or revoke access when required. The process is designed to ensure secure, read-only access aligned with security and compliance best practices.

Audience: Client Administrators with knowledge of Google Workspace credentials

Purpose: Step-by-step guide for secure OAuth integration, data handling, and access revocation

OAuth Connection Flow (Step-by-Step)

1. Start Connection

   • Go to Integrations → Configurations.

   • Click on Google Workspace (GWS) under Technologies.

   • Click Add Connection.

2. Redirect to Google Login

   • You are sent to Google’s secure login page.

3. Sign In

   • Enter your Google credentials (your password is never seen by the platform).

4. Review Permissions

   • Google shows a list of permissions requested. See list of permissions under Google Workspace Permissions section.

5. Consent & Authorize

   • Click Allow to grant access.

6. Redirect Back

   • You are redirected back to the platform and see a confirmation message.

7. Connection Active

   • Your Google account now appears in Connected Services.

What Data is Collected

 Why This Data is Collected

• Access/Refresh Tokens: Enable secure, passwordless API access and background operations (e.g., key management, document encryption)

• User Email/ID: Associate the connection with your account for audit, support, and access control

• Scopes: Limit the platform to only the permissions you approve

• Metadata: Ensure correct tenant and compliance context

How Data is Secured

• Encryption at Rest: All tokens and sensitive data are encrypted using AES-256 in isolated, tenant-specific databases.

• Encryption in Transit: All communications use HTTPS/TLS 1.2+

• Access Control: Only automated systems (not staff) can use your tokens for authorized operations.

• Audit Logging: Every access, refresh, and revocation is logged for compliance.

• Multi-Tenant Isolation: Your data is never mixed with other organizations.

How to Revoke Access

Option 1: From COMPASS

1. Go to Integrations → Configurations

2. Under Original Equipment Manufacturers (OEMs) page, click GWS.

3. Under Actions column, click Delete.

Option 2: From Google Account

1. Go to Google Account Permissions

2. Find the relevant app

3. Click Remove access

   • Google notifies the platform and access is revoked

What Happens After Revocation?

• All tokens are deleted, and access is stopped

• Scheduled operations are cancelled

• You can reconnect anytime