Integrations

This page explains the Integrations page: connecting your Google Workspace so RiskFlow can check it for you, and what to do when the connection needs attention.

The idea in one minute

Today the Risk Assessment page asks whoever is signed in to log in to Google in their own browser tab. That login belongs to that person: it can't run on its own overnight, and it stops working when they leave.

An integration moves that login to your team. An admin connects Google Workspace once, and RiskFlow keeps using the connection without anyone being signed in.

Who can do what

Role	Integrations
ORG Admin	See, connect, reconnect and disconnect
ORG Auditor	See the status. Read-only
Other ORG roles	No access

Each team sees only its own integrations.

Connecting Google Workspace

1. Open Integrations.
2. On the Google Workspace card, select Connect.
3. Sign in to Google in the pop-up with a Workspace admin account on your organization's domain, and approve the read-only access.

RiskFlow asks for read-only access only: Cloud Identity policies and organizational units. It checks that the account can read your policies before saving anything.

The card then shows Connected, your domain, and who connected it and when.

Connect with an account that is meant to stay

RiskFlow keeps working if the person who connected leaves RiskFlow. It stops if their Google account is suspended or deleted, because Google then rejects the saved login. Connect with a long-lived admin account.

Statuses

Status	Meaning	What to do
Connected	Working	Nothing
Needs reconnect	Google rejected the saved login (password reset, account suspended, access revoked)	An admin selects Reconnect
Error	The last check failed for another reason	See the error on the card; it retries on the next run
Disconnected	You disconnected it	Select Connect to start again

Disconnecting

Disconnect tells Google to revoke RiskFlow's access (if Google can't be reached, RiskFlow still disconnects), erases the saved login, and records who did it in the audit log. Past results are kept.

For whoever deploys RiskFlow

Saved logins are encrypted with INTEGRATION_ENCRYPTION_KEY (AES-256-GCM).

• Generate it once: openssl rand -base64 32.
• It is required in production. The API refuses to start without a valid key (32 bytes, base64), so set it on the API project before deploying this version. Locally it is only needed to connect an integration.
• Set it with the Vercel REST API or dashboard, not vercel env add piped non-interactively (that stores an empty value), and check the value has no trailing newline.
• Do not change or lose it. Credentials encrypted with the old key can't be read with a new one; every team would have to reconnect. Keep a copy in the team password manager.
• Google OAuth must already be configured (GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, GOOGLE_OAUTH_REDIRECT_URI). Integrations reuse the same Google client and redirect URI as the Risk Assessment login.

See ADR 008 for the design.