Google Workspace Marketplace - Due diligence

[Koldov]

I'm surprised it took as long as it did, but I've just been hit with my first 'I've found a really cool app and I want to install it in my Google' request... the Headteacher wants a word cloud generator from a Google Doc.

 

Followed up with 'Why am I being blocked...?'

 

Bear in mind this is coming from the Headteacher, so I need quick concise answers please...

 

Any limits to be placed on allowing access to Google Marketplace and the installing of any random app they feel like?

 

Or...

 

Centrally managed by request?

 

Are these apps checked at all by anyone at Google? How do you trust an app, do you do any checks at all for GDPR/Privacy/Terms and Conditions, permissions requested, pricing,  and if so what? (I feel these requests are going to be coming thick and fast once they realise, so I need to have a plan)...

 

These app permissions are quite scary too... 'allow access to drive, can delete all contents' etc.

Edited September 25, 2025 by Koldov

[paulkerton]

Any limits to be placed on allowing access to Google Marketplace and the installing of any random app they feel like? - We stop people just installing whatever they like and they have to be specifically approved by central request.

 

Are these apps checked at all by anyone at Google? - To some degree they are, but Google aren't going to do our due diligence for us.

How do you trust an app, do you do any checks at all for GDPR/Privacy/Terms and Conditions, permissions requested, pricing,  and if so what? (I feel these requests are going to be coming thick and fast once they realise, so I need to have a plan)... - Yes. We check all of these things. Nothing gets installed without an assessment at a minimum.

[jthompson]

Allowlisted here, so users can't install whatever they like.

 

We would check for GDPR stuff, and a general smell test for how established/stable the app looks.

 

We tend to err on the side of not allowing things, since your users may end up with resources that rely on a thrid-party app which may end up abandoned, sold or switched to a differnet pricing structure.

 

We knocked up a Google Form that we use to record the details of any third-party stuff that we allowlist, so that we can record app IDs, who requested it, why, when, etc. That's helpful when periodically reviewing things.