( How we connect )
Integrations. How YellowForce connects to Google Workspace, Google Cloud, Microsoft, AWS, GitHub and Cloudflare, read-only by default, to detect attacks and risky settings.
On this page
How YellowForce connects to your systems.
YellowForce runs your security for you. To do that, our software and our security engineers need to see what’s happening in the tools you already use. Your administrator connects us with the official method each platform offers, read-only by default, and can remove our access at any time.
What we do with that access: detect attacks and risky settings, investigate alerts, help you respond, and show you what’s going on in your YellowForce dashboard. Nothing else.
Read how we handle data in our Privacy Policy and our Data Processing Addendum.
Google Workspace and Google Cloud.
What the YellowForce app does: it reads your Google Workspace security data and Google Cloud settings so we can spot threats like account takeovers, suspicious sign-ins, risky sharing, admin role changes and misconfigured cloud resources.
How you connect it: your Google Workspace super admin authorizes our service account with read-only scopes (domain-wide delegation), and your Google Cloud admin grants read-only roles. No passwords or keys are shared.
What it reads: users, groups, admin roles, domains and devices (Admin SDK, read-only), audit and login activity (Reports API), security alerts (Alert Center), and Google Cloud configuration, IAM policies, logs and Security Command Center findings. Gmail and Drive data only if you add email or file coverage.
What we never do with Google data: we never sell it, never use it for ads, never use it to train AI or machine learning models, and never use Google APIs to create, generate or share any images or media, including AI-generated non-consensual intimate imagery. YellowForce’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft (Entra ID, Microsoft 365, Defender, Azure).
What the YellowForce app does: it reads your directory, sign-in and audit logs, security policies, Defender alerts and Azure settings to detect threats and weak configurations.
How you connect it: a Global Administrator approves the “YellowForce” app once for your tenant. Azure access is delegated through Azure Lighthouse with Reader and Security Reader roles.
AWS.
How you connect it: you deploy our public CloudFormation template. It creates a read-only role that only YellowForce can use, protected by an external ID unique to you. Delete the stack and our access is gone.
GitHub.
The YellowForce GitHub App (github.com/apps/yellowforce) is read-only. It looks for leaked secrets, vulnerable dependencies, risky workflows and weak organization settings. It can’t change your code or settings.
Cloudflare.
How you connect it: a read-only API token from your Cloudflare account, so we can review DNS, firewall, WAF and Zero Trust settings and security events.
Questions.
Security: . Privacy: .