Google Workspace: manage and delete your data

When you connect Google Workspace, Jutsu reads your domain's sign-in and admin audit activity and the security alerts Google raises for your domain. It reads Gmail activity only if you select it, and basic user directory information only if you turn on compliance posture. Jutsu does not read the content of email messages, files, calendars, or chats. For the full detail, see section 3.9, Google Workspace Data, in our Privacy Policy.

You can end this in two places, and you can do both:

  • In Google Workspace, remove Jutsu's access. Jutsu can't read new data after that.
  • In Jutsu, delete the connection. That deletes the data Jutsu collected through it, with the exceptions listed below.

Doing one doesn't do the other. Deleting the connection in Jutsu doesn't change anything in your Google Workspace, and removing access in Google doesn't delete what Jutsu already collected.

Remove Jutsu's access in Google Workspace

A super administrator does this in the Google Admin console.

  1. Open Domain-wide delegation. From the Admin console menu, it's Security → Access and data control → API controls → Manage Domain Wide Delegation.
  2. Find Jutsu's entry and delete it. For a One-click connection it's listed as Jutsu Inc. If you also authorized response actions, delete that entry too.
  3. If you connected with a service-account key instead of One-click, also delete that key in Google Cloud, under IAM → Service accounts → Keys.

If another Jutsu connection still uses the same Workspace, it shares the delegation entry, and deleting the entry stops that connection too.

If your organization installed Jutsu from Google Workspace Marketplace, uninstall it there too.

Archive or delete the connection in Jutsu

There are two options:

  • Archive stops collection and keeps the events and alerts already collected, so you can still search them. Unarchive resumes collection.
  • Delete permanently removes the connection and the data collected through it.

Archive and Unarchive need the Responder, Admin, or Owner role in your Jutsu organization. Deleting needs the Admin or Owner role. Other roles don't see the delete options.

Delete the connection

  1. Go to Connections and open the Google Workspace connection.
  2. Go to Configure → Danger zone and select Delete asset…. You can also select Delete permanently… in the connection's ⋯ menu. You don't need to archive the connection first. An archived connection is listed under Archived connections on Connections, with its own Delete permanently button.
  3. Type the connection's name exactly as shown, then select Delete asset.

The dialog also shows the cleanup step for your Google Workspace, with an Open Domain-wide delegation button. That's the same step as in the section above. Jutsu can't do it for you.

What happens next

  • Collection stops straight away.
  • Deletion begins about 15 minutes later. Until then you can cancel it, and nothing has been removed. If the connection was archived more than 15 minutes earlier, deletion begins as soon as Jutsu picks it up.
  • Once Jutsu starts removing data, the deletion can't be cancelled or undone.
  • Deletion runs in the background and can take hours. By default, Owners and Admins get an email when it finishes.

What is deleted

  • The raw and normalized events collected through the connection.
  • Alerts built from those events, and the incidents built from those alerts. An alert that also includes events from another connection is kept, with this connection's events removed from it.
  • Response actions taken against those alerts.
  • The connection's compliance check history.
  • Jutsu's internal records for the connection: failed deliveries, collector telemetry, and usage records.
  • The connection's own record.

What is kept

  • The connection's name can still appear in event search filters for up to about 7 days. The filters refresh on their own.
  • Behavior analytics (UEBA) entity records: activity records until they expire after 90 days, and the record of when an entity was first seen, with no expiry.
  • Reports that were already generated keep the names inside them.
  • The audit log entry for the deletion, and the deletion record itself. Jutsu keeps these on purpose, as the evidence that the deletion happened.

Data requests

For questions about your data, or a data request this page doesn't cover, email legal@jutsu.ai with the subject line "Privacy Request."

To set up the connection again, see Google Workspace.