Administrator guide: Ascripto and Google Workspace

Last reviewed 19 October 2026

For the Google Workspace administrator or super admin who has been asked to allow something, and for anyone evaluating what Ascripto touches. Mechanism first, in Google’s own terms.

What Ascripto asks for, and from whom

Grant	Who gives it	Where	What it allows
Sign-in	each person who uses Ascripto	Google’s sign-in	`openid`, `email`, `profile`. Identity is keyed on the Google account’s stable subject and hosted domain, never on the email address
Directory, read-only	a Google Workspace administrator	OAuth consent reached from Ascripto (Welcome page or Settings → Connections)	`admin.directory.user.readonly` and `admin.directory.domain.readonly`: users with their names, titles, departments, phones, org unit and custom attributes; the organisation’s verified domains. Groups are not read
Signatures	a super admin	Admin console → Security → Access and data control → API controls → Manage Domain Wide Delegation	www.googleapis.com/auth/gmail.settings.basic for Ascripto’s service account, whose client ID is shown on the page. Used for `users.settings.sendAs` only

Ascripto never reads, sends or deletes mail. Its use of Google data is bound by the Google API Services User Data Policy, including the Limited Use requirements; the statement is in the privacy policy at ascripto.com/privacy/.

Why domain-wide delegation rather than a Marketplace install

Two reasons, and both would still apply after the Marketplace listing exists:

Reading or writing a send-as signature on a mailbox other than the caller’s own is only possible for a service account client with domain-wide authority. Per-user consent cannot do it.
Google has no read-only variant of gmail.settings.basic. The audit only reads, but the grant necessarily also allows writing.

Google verified Ascripto’s OAuth app (branding plus sensitive scopes) on 2026-10-17, so the consent screen for the directory grant shows no “unverified app” warning. The delegation entry for signatures is still made by hand in the Admin console, and the scopes are the ones in the table above.

Cadence and mechanics

Activity	Cadence	Mechanism
Directory changes	as they happen: Google notifies Ascripto of each one, and the person is read then, a minute later and five minutes later	Admin SDK Directory API `users.watch`, one channel per kind of change (added, changed, deleted, restored), renewed every two days and stopped with `channels.stop`; `users.get` for the person
Directory read	every hour; every 15 minutes while a notification channel is missing; and on Read it now	Admin SDK Directory API `users.list`, `domains.list`
Audit	once a day, and on Check again	`sendAs.list` per person; the primary address’s signature compared with the directory record
Deploy	on a reviewed deploy; afterwards automatically for joiners and changed records	`sendAs.patch` per person, about twenty writes a second. Each mailbox is read first and written only if it differs, unless Rewrite even where current is ticked
Import	on request	`sendAs.get` for the chosen person; values matched against their directory record

sendAs.patch is used rather than sendAs.update, so a deploy never clears a person’s display name, reply-to or alias flags.

What the audit compares

Per person, the signature Gmail uses for new messages against the directory record. Findings:

Finding	Test
no signature	the signature is empty
name missing	the person’s name is not in the text
job title missing	the directory’s title is not in the text
work phone missing	the directory’s work phone is not in the text
no logo	the signature carries no logo image
couldn’t be read	Google refused the mailbox; counted apart, never as on- or off-brand

Not examined, and said so beside the numbers: the separate signature a person may select for replies and forwards (Gmail keeps it in the web settings and no API exposes which is in use), a Mobile signature set inside the Gmail app (device-local, invisible to any API), fonts, sizes and colours, and anything a person adds beyond the deployed content.

What deploy writes

The rendered HTML for that person (images are hosted on img.ascripto.com, since a Gmail signature is an HTML string and cannot embed) and the matching plain text. Gmail applies it on web and in the Gmail apps. Deploy steps over people who are suspended in the directory, whose address is outside the organisation’s domains, or whom no signature reaches.

Leavers

A person removed from the directory is moved to Ascripto’s recycle bin (7 days by default, settable to a year in Settings → Connections) and stops being managed. Ascripto never writes to their mailbox again and does not clear the signature already there. Suspended users are not written to while suspended.

Double signatures

If an Append footer is enabled in the Admin console (Apps → Google Workspace → Gmail → Compliance), Google adds it below every user’s own signature, including the one Ascripto writes. Turn the footer off at every org unit where it is set once Ascripto carries the legal text.

Failure modes, as the product reports them

What happened	What Ascripto shows	Fix
The delegation entry is missing or was deleted	Google refused to open the mailboxes. Signature access may have been withdrawn in your Admin console. The audit or deploy stops; the counts stay as far as they got	Re-add the client ID and scope. Detected at the token endpoint (`unauthorized_client`), so no mailbox is touched in between
The directory consent was revoked or the consenting administrator lost the role	Settings → Connections: The connection was withdrawn. Reconnect to read the directory again.	Reconnect as a current administrator
Google takes a while to apply a new delegation	Not allowed yet with a re-check every 20 seconds	Wait; Google documents up to 24 hours, usually minutes
A check or read fails on Ascripto’s side	said as such, and retried	nothing

Revoking Ascripto

Signatures: Admin console → Security → Access and data control → API controls → Manage Domain Wide Delegation → the Ascripto client → Delete. Audits and deploys stop immediately.
Directory: the administrator who consented removes Ascripto under their Google Account → Linked apps (myaccount.google.com/linkedapps) (or Settings → Connections → the connection is marked withdrawn once Google refuses the next read).
Signatures already written stay in people’s Gmail; Ascripto never clears them.

Data handling

Stored: names, email addresses and the directory fields signatures use; administrators' overrides; signature designs and versions; brand images; audit findings; on paid plans, who counted towards the month’s bill and when. Images are served publicly from img.ascripto.com because recipients' clients must load them.
Not stored: mail, subjects, headers, or the Google tokens beyond their use. Directory access credentials live in Azure Key Vault.
Where: Microsoft Azure, Germany West Central (Frankfurt). Transactional mail (sign-in codes, invitations) is sent from Ascripto’s own mail server in the EU. Payments are Stripe’s.
Retention: directory fields while the person is in the directory plus the recycle bin; audit of administrator actions 13 months; signature change history 90 days; billing counts 70 days; an organisation’s data deleted within 30 days of the agreement ending, after a 30-day export window. The full table is in the privacy policy; the DPA at ascripto.com/dpa/ is Article 28 GDPR and needs no signature.
Staff access: Ascripto staff do not browse customer data. Support can see an organisation’s data only through a support grant that is time-limited, carries a reason, is recorded, and is visible to the organisation. Every staff account uses multi-factor authentication.
Browser security: the app never holds an access token in the browser; a server-side component keeps them in httpOnly cookies.

Seats

A seat on Google Workspace is anyone whose Gmail carried your current signature at some point in the month, because a deploy wrote it or a deploy or the audit found it still there. Someone suspended or removed for the whole month does not count. The month’s count so far is in Settings → Billing.