Terms and conditions

GWS AI Security Agent ("the service") is provided by GWS ToolBox (UNEL). It reads a company's Google Workspace audit logs, looks for signs that an account has been taken over or that data is leaving the company, explains what it finds in plain words, and tells the company's admins. These terms are between GWS ToolBox and the company that connects its Google Workspace ("you").

An administrator who is authorised to act for your company agrees, on the setup page, that the service may read what is listed there and on What we store. They can withdraw that consent at any time on the same page; collection stops at once.

• It only reads. It cannot sign anyone out, reset a password, block a sign-in, remove an app or change who can open a file. It tells your admins what to do; they make the change in Google Admin. The only things it changes are its own lists (approved apps, trusted domains, things marked as expected), and only when one of your admins presses Confirm.
• It never reads the contents of an email or a file.
• It helps your admins; it does not replace them, your other security measures, or Google's own protections.

Please read this section. Most limits come from what Google records, and when.

4.1 Delays - mostly at Google's end

• Sign-ins, admin changes, file sharing and Google's security alerts are collected every 15 minutes. Google makes them available within a few minutes, so an urgent alert normally reaches you 15 to 30 minutes after the event - not the moment it happens.
• Account-security changes (password, recovery email or phone): Google records these tens of minutes late.
• Apps given access to an account: Google records these a couple of hours late, so a new app is seen 2 to 3 hours after it was granted.
• Mail delivery records - used to spot automatic forwarding and unusual mail leaving the company - are collected once a day, in the evening check. Forwarding or a burst of outgoing mail is therefore seen up to a day after it starts, not within 15 minutes.
• Devices (phones and tablets with your company's accounts) are collected once a day.
• The full list of files shared outside is rebuilt once a week. A new outside share is still seen within 15 minutes through the sharing log; the weekly check is the complete inventory.
• The daily check runs once a day and covers the previous day; the morning summary reports the latest check.
• If the service or Google is unavailable for a while, collection catches up afterwards, as long as Google still holds the records (about six months).

4.2 What Google makes visible

• Your Google edition decides which logs exist. Some editions (for example Business Starter) may not provide every log, such as mail delivery records. Settings shows which logs your company has; a check that needs a missing log does not run.
• History: Google keeps audit logs for about six months, so the first assessment looks back at most 180 days.
• Mail rules: filters a person sets in their own mailbox are not in the log Google provides. Automatic forwarding is seen only by its effect - once a message is actually forwarded. A forward that is set up but has not forwarded anything yet is not seen.
• Single sign-on (SSO): if your staff sign in through another service (for example nCapsule, Okta or Microsoft), failed and blocked sign-ins happen there, not at Google, and are not seen until a connector for that service exists.
• Password guessing: Google records failed sign-ins, not the passwords tried. "Password spray" is worked out from the pattern of failures.
• Locations come from internet addresses. VPNs, mobile networks and cloud services can make a sign-in appear in the wrong country, so "new country" and "impossible travel" can be false alarms.
• It cannot see what someone read inside a mailbox or a file, or anything outside Google Workspace (laptops, phones, other services).

4.3 The AI

• Findings are written with the help of AI models. They can be wrong - a false alarm, or a real incident missed. Every finding shows the evidence it rests on; check it before acting.
• The models run outside India, reached through OpenRouter, on condition that what is sent is neither used for training nor kept. Details: What we store.
• Each company has a monthly AI allowance, normally US$10 (about ₹900). If it is used up, collection and the rule checks carry on, but AI investigations pause until the next month or until the allowance is raised. Questions to the assistant have their own, smaller allowance, normally US$2 (about ₹180).
• At most 25 accounts are investigated per company per day, worst first; any beyond that are listed, never dropped silently.

4.4 Detection

• No detection is complete. A quiet day means nothing matched the checks - it is not proof that nothing happened.
• Most checks compare an account with its own history. For roughly the first week after connecting, and for new accounts, "unusual for this account" has little to compare with.
• Something you mark as expected is not raised again until the mark ends.

4.5 Alerts and messages

• Alerts go by email (through Google's mail service) and/or Google Chat, to the addresses and Chat space you set. Delivery depends on those services.
• At most 20 urgent alerts are sent per company per day; anything more is on the website.

4.6 Availability

• The service currently runs on a single server. Short interruptions can happen during updates; there is no guaranteed uptime during this early period. Nothing collected is lost - collection resumes where it stopped.
• Your company's own logins use a password without a second step until GWS ToolBox's common sign-in is connected. Staff logins at GWS ToolBox need a code from an authenticator app.

• What is kept, what goes to the AI and who at GWS ToolBox opened your data is on What we store.
• Records are kept for 1 year unless your admin chooses longer (2 years or 3 years) in Settings; older records are deleted every night.
• If you stop using the service, ask us and your company's data is deleted.

• Keep your admins' logins safe, and act on what the service reports.
• Keep the service's Google key and its domain-wide delegation in place; without them it stops reading.
• Tell your staff, as your policies and local law require, that their account activity is monitored for security.

The service helps you find problems; it does not promise to find every one. As far as the law allows, GWS ToolBox is not responsible for losses caused by an incident the service did not detect or report in time, or by actions taken on its findings. Nothing in these terms limits a responsibility that the law does not allow to be limited. These terms are governed by the laws of India.

If these terms change, your admin is shown the new version and asked to agree again. The date of this version is at the top of the page.

Questions about these terms: contact@gwstoolbox.com.