Forgotten apps with admin
Every GitHub App you ever installed still holds the permissions you approved — including the deploy bot from two projects ago with admin over everything.
AI Governance & Accountability
When an AI agent touches your data, you're accountable. Can you prove you were in control?
In 2026, courts and regulators began holding the company that deploys AI — not just the vendor — responsible for what its agents do. 8200.dev shows you every AI agent and OAuth grant reaching your Google Workspace, and gives you the audit-ready evidence that you governed it.
No sales call. No demo gate. Connect a source and see which agents hold the keys in minutes.
The accountability shift
The question changed from “which agents can reach our data?” to “can we prove we governed that access?”
Through 2025 and 2026 the legal landscape moved. A US federal court let Mobley v. Workday proceed on an agency theory and certified a nationwide collective action; a German court found a blanket disclaimer insufficient to absolve a company of what its AI told customers; and the EU AI Act's high-risk duties began phasing in, with penalties up to €35M or 7% of global turnover.
What it means for you: if your team uses AI that can reach company data, you are increasingly the party expected to show you governed that access — with evidence, not assurances.
Read the accountability brief →- 42+
- security checks
- 5
- compliance frameworks
- 33
- languages
- 13
- connectors
- 2,000+
- automated tests
From a single personal account to a full organization
Your client work lives on a personal GitHub account — along with every bot, deploy key, and collaborator that ever touched it. Connect your own GitHub login and see exactly what still has access, free.
Deploy keys that can push
Unattended SSH keys on servers, some with write access to the repository they were meant only to read. Each one is a supply-chain path into your code.
Your full exposure inventory
Public repositories, outside collaborators with write, and the machine identities behind them — enumerated from GitHub’s own API, not from memory.
Scan your account freeNo credit card. Read-only scopes. Never your source code.The security obligations that already apply to you →
Agent Guard — governance for the access surface nothing else covers
AI agents and service accounts now hold OAuth grants, read mailboxes, query CRMs, and write to production. They are the fastest-growing — and least-governed — identities in your organization. Agent Guard treats every agent as a first-class principal: it inventories them, shows exactly what each one can reach, lets you set and document the access policy you want, scores its risk, and explains every verdict in plain language.
Agent inventory
A live roster of every AI agent and service account, what data each can reach, and how broad that reach is — discovered from the permissions you already granted, with nothing to install.
Access policy you control
Each agent carries an editable allow-list of actions, destinations, and data sensitivity. You decide the bounds — broad for a trusted agent, tight for a risky one — and every choice is deliberate and audited. If least privilege is your policy, the defaults make it easy to enforce and prove.
Risk score
Blast radius — what an agent can reach — fused with action history — what it has actually done — into one explainable risk score, so the riskiest agent sits at the top of the list.
What it can access · what it has done
A per-agent timeline of every read and write, each carrying an allow / flag / block verdict with the reason and the evidence behind it. No black-box scoring.
Discover + register every agent
Auto-discovery covers your connected platforms — and the AI Agent Registry lets you register every other agent by hand, from Google Workspace to WhatsApp to custom bots, in one unified registry with audit-ready proof of inventory.
Detective today: Agent Guard observes, explains, and scores every agent action live. Active blocking at the vendor arrives with write-scope OAuth — until then any "what would be blocked" preview is clearly labeled a simulation. We never claim enforcement we don't have.
One platform, three engines
Agent Guard leads; permission posture and data-flow governance complete the platform. Every finding and every verdict ships with a plain-language reason and the evidence behind it.
Agent Guard
Flagship · AI-agent governanceGoverns what every AI agent and service account can see and do — live inventory, a documented access policy you control, risk score, and an explained verdict on every action. The surface neither posture tools nor DLP were built to cover.
- Live inventory of AI agents and their effective access
- A documented access policy on every agent read and write
- Risk score plus a full, explained audit trail of every action
Posture Guard
Permission postureFinds over-broad permissions, public shares, and misconfigurations before they become an open door — continuous, prioritized by blast radius, every finding explained.
- Permission & sharing misconfiguration detection
- Catches the open door before data walks out
- Every finding explains itself: what, why, evidence
Flow Guard
Contextual DLPContext-aware data-loss detection — who is moving what, where, and whether that flow makes sense for your organization, each movement carrying an explained verdict.
- Contextual classification, not regex rules
- Flags risky data movement with a written reason
- Learns your org's normal, surfaces the abnormal
THE COMPLETE PLATFORM
Built deep, not just wide
Permission posture is the start. 8200.dev now spans discovery, detection, governance, compliance, integrations and access security — every capability explainable and self-serve.
AI Governance
See every AI tool touching your org — sanctioned or shadow. One dashboard for shadow-AI discovery via OAuth grants, agentic platforms holding delegated access, vendor AI-training posture, and key/seat hygiene across your connected AI vendors. Point-in-time, read-only — never traffic interception.
Discovery & scanning
42+ checks, Shared Drive scanning, OAuth-app and Workspace-config audit, DLP patterns and no-code custom rules.
AI-Built Application Governance
Detect the OAuth apps built with AI builders — Lovable, Base44, Bolt.new, Cursor — see what data each can reach, and prove you governed the apps you deployed but didn't hand-write.
Visualize & detect
Flow Guard data-flow graph, Agent Guard AI risk matrix, UEBA anomaly detection, awareness scores and benchmarking.
Govern & prevent
External-sharing governance, smart alerts, prevention rules, incident tracking and auto-remediation.
Compliance & reporting
SOC 2, ISO 27001, GDPR, HIPAA and NIST CSF mapping, auto-generated evidence packages and executive reports.
Integrations & API
Slack bot, Jira/Linear/GitHub/Asana ticketing, signed webhooks, SIEM export and a REST API.
Access & security
SSO/SAML, MFA, custom RBAC, IP allowlisting, session policies and a full audit log.
Experience
A 24/7 AI product expert, asset inventory, 33 languages, dark mode, multi-org and self-serve billing.
Your proof layer
8200.dev is the system of record that demonstrates responsible AI governance.
Visibility, control, and audit-ready evidence — the proof you were in control. It supports your compliance posture; it is not a legal shield and does not guarantee any outcome.
See every agent
A live inventory of every AI agent, service account, and OAuth grant that can reach your data — including the shadow AI nobody approved.
Govern access
Make every access grant a deliberate, documented decision — not an accident — and enforce the rules you choose. Governance you can demonstrate, not just dashboards you watch.
Generate evidence
Audit-ready logs, SIEM export, and a compliance evidence package mapped to SOC 2, ISO 27001, and GDPR controls — the documentation reviewers request.
Enterprise value
Audit-ready evidence for your access controls
SOC 2, ISO 27001, and GDPR all oblige you to prove control over who — and what — can reach your data. 8200.dev generates that evidence automatically from the sources you already connected.
Auditors and regulators don't accept "we're careful" — they ask for evidence: who can reach sensitive data, which permissions are over-broad, which AI agents hold the keys, and what changed since the last review. 8200.dev produces that record continuously from your connected Google Workspace, each finding carrying a dated, plain-language reason and the evidence behind it.
SOC 2 — logical access controls
Continuous evidence for the Common Criteria around logical access (CC6): who can reach sensitive data, documented and governed access for AI agents, and an append-only audit trail of every change.
ISO 27001 — access-control monitoring
Findings aligned to access-control and monitoring controls, with dated evidence you can hand an auditor instead of assembling spreadsheets by hand.
GDPR — demonstrable accountability
Evidence that personal data isn't over-exposed and that access is governed — the demonstrable accountability Article 5(2) and the security obligation of Article 32 call for.
8200.dev produces the audit-ready evidence and reports that prove your access controls to auditors and regulators. It is not a certification body and does not grant SOC 2, ISO 27001, or any other certification — the certificate comes from your auditor; we make the proof easy to produce.
The hybrid the market is missing
Posture vendors stop at the door. DLP vendors start at the data. Nobody governs the agents.
| Capability | 8200.dev | Aryon | Orion |
|---|---|---|---|
| Posture management (preventive) | ✓ | ✓ | ✗ |
| Data-loss prevention (contextual) | ✓ | ✗ | ✓ |
| AI-agent governance | Native | ✗ | Exploring |
| Explainability | Every block | Partial | Black-box |
| Self-serve | ✓ | Sales-led | Sales-led |
| Agentless deployment | ✓ | Partial | Endpoint agent |
How we build
Explainable by default
Every finding and every block ships with a plain-language reason and its evidence. No black-box verdicts.
Self-serve
Sign up, connect, see findings. Pricing is public. There is no sales gate anywhere in the product.
Agentless
OAuth and API connectors only. Nothing to install on endpoints, nothing to deploy in your network.
Honest claims
We say what we detect, what we block, and what we don't cover yet. Comparison claims cite public materials.
For MSSPs & IT partners
Manage every client from one account
MSSPs, IT consultancies and managed service providers run all their clients' Google Workspace security from a single partner account — a consolidated dashboard, portfolio reports, white-label, and self-serve onboarding.
Start managing your clients' securitySee your first findings today
Free tier. One source. Real findings with real explanations.
Start freePlans from $0/mo — no credit card required.