BeigeCheck reads only the folders your company chooses, and never writes to them.

• Only an owner or approver of your company’s BeigeCheck can connect a folder, from Company knowledge in BeigeCheck.
• For SharePoint and Notion, they sign in with their own work account, and BeigeCheck can open what that account can open in the folder or pages they choose. For Google Drive, they share the folder with BeigeCheck’s own Google address instead. Either way it reads only, so it can’t change or delete anything.
• It reads the documents in it each night, and whenever an owner or approver asks it to. Everything it finds goes to an approver first, and nothing reaches your people’s AI tools until they approve it.
• A sign-in key from Microsoft or Notion is stored encrypted, and only BeigeCheck’s servers use it. Disconnecting the folder in BeigeCheck deletes it. Removing BeigeCheck in your admin settings, below, stops it too.
• If the person who connected it leaves your BeigeCheck team, reading stops until another owner or approver connects it again.

What BeigeCheck keeps from the documents is set out in the privacy policy.

BeigeCheck is a multi-tenant app that Ghostart Ltd registered in Microsoft Entra ID. It asks only for delegated permissions, so it acts as the signed-in person and never has access of its own: offline_access, User.Read, Files.Read.All and Sites.Read.All.

To find it in Entra by its ID, search for application (client) ID 4fb35946-dba4-458a-ba39-f82690d18f3c.

If people see “Need admin approval”

Many organisations don’t let staff approve apps themselves. An administrator with the Global Administrator or Cloud Application Administrator role can approve BeigeCheck for everyone in one of two ways:

1. Connect SharePoint in BeigeCheck yourself. On Microsoft’s permissions screen, tick “Consent on behalf of your organization” and accept.
2. Or, once a colleague has tried to connect, open the Microsoft Entra admin centre, then Enterprise applications, choose BeigeCheck, then Permissions, and choose “Grant admin consent”.

Limit it to certain people

In Enterprise applications, choose BeigeCheck, then Properties, and set “Assignment required?” to Yes. Then, under Users and groups, add the people or groups who may connect it. Everyone else is turned away when they sign in, so they can’t connect it.

Remove it

In Enterprise applications, choose BeigeCheck, then Properties, and set “Enabled for users to sign in?” to No, or delete it. BeigeCheck then says the folder needs reconnecting, and it won’t read it again until it’s reconnected.

Nobody signs in with Google, so BeigeCheck never gets access to anyone’s Google account. The owner or approver connecting it shares the folder with BeigeCheck’s own Google address as a viewer, the way they’d share it with a colleague, and pastes the folder’s link into BeigeCheck. BeigeCheck can open that folder and the folders inside it, and nothing else.

Every company shares with the same address, so BeigeCheck accepts a folder only from the person who shared it, or a colleague with an address at the same company, and only one company can connect each folder.

If your organisation limits sharing outside it

If Google Workspace stops people sharing with addresses outside your organisation, an administrator can allow BeigeCheck’s address alone. In the Google Admin console, add a Drive trust rule that lets the person connecting the folder share with that one address. Don’t allow its whole domain, which Google uses for many other services. The address is shown in BeigeCheck when someone connects a folder.

Remove it

Stop sharing the folder with BeigeCheck’s address, or disconnect it in BeigeCheck. Either one stops it reading.

BeigeCheck is a Notion connection with one content capability, read content, and it can read people’s names and email addresses, so BeigeCheck can show who connected it. The person who connects it chooses the exact pages BeigeCheck may read, in Notion’s own window. Pages inside a chosen page are included.

If your workspace limits connections

On some Notion plans, workspace owners can control which connections members may add, in the workspace’s settings under Connections. If yours does, you’ll need to allow BeigeCheck there first.

Change or remove it

The person who connected it can change the pages it reads by connecting Notion again from BeigeCheck. A workspace owner can remove BeigeCheck in the workspace’s settings under Connections, and anyone can take it off a single page from that page’s Connections menu.

• The Connect button isn’t there. Only owners and approvers see it, on Company knowledge in BeigeCheck.
• “Need admin approval” in Microsoft. An administrator approves BeigeCheck once, as set out under SharePoint above.
• Google won’t let you share with BeigeCheck. Your Workspace limits sharing outside your organisation. See Google Drive above.
• BeigeCheck says the folder needs reconnecting. The person’s sign-in expired or was removed, or they left your BeigeCheck team. An owner or approver who can open the folder needs to connect it again, and it’ll carry on from there.
• A document isn’t being read. BeigeCheck reads Word, PDF and text files up to 8 MB and 10,000 words, Google Docs and Notion pages, and up to three folders deep.

Still stuck? Write to hello@beigecheck.com.