Google Workspace Analyzer
A browser-based compliance and inventory tool for Google Drive at enterprise scale.
The Problem
Enterprise Google Drive environments are messy. Shared folders accumulate files with inconsistent permissions, stale external shares, and no visibility into who owns what. For legal ops and compliance teams, answering a simple question like "what files in this shared drive are accessible outside the organization?" can take days of manual work.
IT and legal teams need a tool that can inventory Drive at scale, surface sharing anomalies, and produce reports without requiring a full DLP deployment.
Approach
Google Workspace Analyzer is a single-file HTML application that authenticates against the Google Drive API (with optional domain-wide delegation for admin-level access) and traverses folder hierarchies to produce structured inventory data.
Key capabilities built across versions:
- Folder inventory — recursive traversal of shared drives and My Drive with file metadata, owner, last modified, and sharing settings
- Sharing analysis — flags files shared externally, with "anyone with link" permissions, or with unexpected domains
- Compliance reporting — structured output suitable for legal hold analysis and regulatory response
- Export — CSV and formatted reports via SheetJS
The UI uses a tabbed interface grouping related views, with Chart.js for visual summaries of sharing distribution and file age.
Outcome
Currently at v8.3 and in active use for Drive compliance analysis in enterprise Workspace environments. The next planned session is UI refinement Step 2: tab bar grouping for improved navigation across the report views.
Stack
Single-file HTML with vanilla JavaScript for maximum portability — no dependencies to install, no server required. Google Drive API for data access. SheetJS for Excel/CSV export. Chart.js for visualizations.
What I Learned
Domain-wide delegation in Google Workspace requires careful scope management — it's easy to request more access than needed and trigger security reviews. Scoping to the minimum required permissions from the start avoids that friction.