Web application · Google Workspace · read-only ES

Vigía

Vigía is a web application that reviews the security configuration of a Google Workspace domain in read-only mode and delivers a report of what should be fixed, ordered by priority.

It is run by Diego Fariña in a personal capacity. The analysis is free and you can repeat it whenever you like. Vigía does not modify any setting in your Workspace: there is no route in the program capable of writing to your organisation.

What it does

  • It checks around 50 posture controls of the tenant against the CIS Google Workspace Benchmark: administrators without 2-Step Verification, third-party OAuth applications with dangerous permissions, dormant accounts, automatic mail forwarding, Drive sharing settings and password policy, among others.
  • It reviews the domain's email authentication in public DNS: SPF, DKIM, DMARC and MTA-STS.
  • It works out a posture score and a prioritised list of fixes, with a report downloadable as PDF and CSV. When something cannot be verified with certainty, it is marked as not verified rather than assumed to be fine.

What permissions it asks for, and what for

Six Google permissions in total: four that read your organisation, all read-only and none restricted, plus openid and email, which only identify the administrator who connects.

  • admin.directory.user.readonly — List the accounts and their security metadata: 2-Step Verification enrolment, administrator role, last sign-in, suspension state, creation date, recovery details and organizational unit.
  • admin.directory.domain.readonly — List your verified domains, so SPF, DKIM, DMARC and MTA-STS can be checked for each one through public DNS.
  • admin.reports.audit.readonly — Read the audit log: which third-party applications have been authorised, recent administrative changes, and sign-in events.
  • cloud-identity.policies.readonly — Read the settings configured in your Admin console (Drive sharing, Gmail forwarding, password policy, session length, Marketplace and Groups) so they are checked automatically instead of by hand.

Vigía never requests access to the contents of Gmail, of Drive, of the calendar or of any other personal data, and it cannot read your messages, their subjects, their attachments or your files. You can withdraw access whenever you like, which deletes your data.

Get started and find out more

Contact: diego@diegofarina.com