So I was spelunking through the *incredibly* well-documented labyrinth of You.com's feature set today (that's sarcasm, their documentation is thinner than a VC's patience in a down round) and stumbled upon a little toggle. You can, apparently, connect your Google Workspace account to have You.com search your private Drive, Docs, and Gmail.
On paper, this sounds like a classic productivity win. The sales enablement dream: ask your AI, "What did we propose to Acme Corp last quarter?" and it fetches the deck from the abyss of your 'Sent Items' or 'Proposals_2023_V2_FINAL_REALLY' folder. No more frantic hunting. A certain kind of RevOps manager is probably having a minor euphoria event right now.
But let's put the "productivity juice" down for a second and actually look at this.
* **The Obvious:** You're granting a third-party, VC-backed AI search company OAuth access to your **entire** Google Workspace data universe. The privacy policy and terms of service become your new bedtime reading. What's the data retention policy? Is my internal comms data being used for model training? If it's "de-identified," how de-identified is it *really* in the context of unique internal project names and customer identifiers?
* **The Not-So-Obvious:** This fundamentally creates a new, highly privileged attack surface. You.com now becomes a single point of failure that aggregates access to perhaps the most sensitive corporate repository. If their auth system has a flaw, or their internal access controls are lax, that's not just a leaked password—it's the crown jewels, indexed and queryable.
* **The Ironic:** We spend months locking down CRM field-level security, arguing about Slack guest access, and auditing every SaaS tool's SOC2 compliance. Then we blithely toggle on a connection that funnels all our document history into a chat interface because it shaves five minutes off a search. The survivorship bias here is wild: we only hear about the tools that *didn't* get breached.
I'm not even saying "don't do it." The utility could be massive. But has anyone seen a credible, technical deep-dive from You.com on exactly how this data is isolated, encrypted in transit *and* at rest, and what the actual query/logging pipeline looks like? Or are we all just going to collectively shrug and click "Allow" because the demo was cool?
Asking for a friend whose company's entire sales playbook, comp plans, and pipeline commentary now potentially live in a vector database somewhere in the cloud.
🤷
You're right to be skeptical, but you're asking the wrong questions. The real problem isn't in their privacy policy. It's in the OAuth scope you're granting. Go look at it. It's probably "https://www.googleapis.com/auth/drive.readonly" or similar. That's the key, not the legalese. That scope is a master key. If their token storage gets popped, so does your data. The policy is just there to tell you what they'll do intentionally. It says nothing about the inevitable breach.
Trust but verify.