Last week an AI meeting assistant exposed 181,874 meeting records. The uncomfortable question that followed, for most organisations, was not "how did that happen" but "wait — which AI tools can see our data?" Very few teams can answer that quickly. This guide is how to find out.

Why this is harder than it sounds

AI tools rarely arrive through procurement. Someone connects a notetaker to their calendar because it is genuinely useful. A developer authorises an assistant to read a repository. A marketer links a writing tool to shared documents. Each decision is small and reasonable, and none of them appear on any list.

The result is an access map nobody drew. And unlike a downloaded application, these connections are invisible on the device — the permission lives in a cloud account, silently valid until revoked.

Step 1: Check your identity provider first

This is the highest-value step, and most people skip it. Nearly every AI tool connects using "Sign in with Google" or "Sign in with Microsoft", which means both providers keep a list of what has been authorised.

  • Google Workspace: the admin console lists third-party apps with account access, and shows which data scopes each was granted.
  • Microsoft 365: enterprise applications and consented permissions are listed in the Entra admin centre.
  • Individuals: your personal Google or Microsoft account security settings show the same information for your own account.

Read the scopes, not just the app names. There is an enormous difference between an app that can see your calendar's free/busy status and one that can read every event, attachment and attendee.

Step 2: Check the meeting platforms

Zoom, Google Meet and Microsoft Teams each maintain their own app marketplaces with separate permissions. A notetaker may be authorised at the meeting-platform level even if it does not appear in your identity provider's list. Check the installed-apps section of each platform your organisation uses.

Step 3: Check code and document repositories

GitHub, GitLab and similar services list installed OAuth apps at both the personal and organisation level. Pay particular attention to organisation-level installations, which can carry read access across every repository.

The same applies to document storage. An AI writing assistant with drive-wide read access has a broader reach than most people assume when they click Allow.

Step 4: Ask people

Technical audits miss tools that never touched a corporate account — a personal AI subscription being used to summarise work documents, for example. A short, blame-free survey finds these. Frame it as "help us build the list", not "confess". People hide tools when they expect to be punished for using them.

Step 5: Decide, then revoke

For each tool you find, ask three questions:

  • Is it still used? Dormant integrations carry all the risk and none of the benefit.
  • Is the access proportionate? Many tools request more than they need.
  • Where does the data go? Check retention and whether content is used for training.

Revoke anything that fails. Revocation is instant and reversible — if something breaks, the owner will say so, and you can reauthorise with narrower scopes.

Step 6: Make it repeatable

A one-off audit decays within months. Three habits keep it current:

  • Schedule a quarterly review of connected applications.
  • Require admin approval for new third-party app connections where your platform supports it.
  • Publish a short approved-tools list so people have a sanctioned option. Bans without alternatives produce shadow usage.

Why it matters

Every connected AI tool is another copy of your data governed by someone else's engineering standards. That is not an argument against using them — they are genuinely useful — but it is an argument for knowing the list. As tools move toward agentic behaviour with standing permissions to act, the consequences of an unaudited connection grow.

It is also the cheapest security work available. Unlike most improvements, this one costs nothing but attention, and it is exactly what turned an ordinary access-control bug into 181,874 exposed meeting records for the organisations affected.

Key takeaways

  • Start with Google Workspace or Microsoft 365 admin consoles — most AI tools connect through them.
  • Read the permission scopes, not just app names; the difference between them is large.
  • Check meeting platforms and code repositories separately, as they hold their own app permissions.
  • Ask staff directly to find tools that never touched a corporate account.
  • Revoke dormant and over-permissioned integrations, then review quarterly.

The bottom line

You cannot protect data you do not know is being shared. An afternoon spent listing which AI tools hold access to your calendars, documents and code is the highest-return security work most teams can do this month — and it requires no budget at all.