Saelyx for Google Workspace administrators

01 What Saelyx does with Google Workspace

Saelyx is a meeting assistant. With each user's permission, it saves the minutes to their Drive, sends them from their Gmail and posts them to a Google Chat space. If the user turns on the suite blocks, they can also ask it by voice or chat to search or draft email, look at or move their calendar, create tasks, look up people, search their Drive, look at their Chat spaces or bring in the transcript of a Meet meeting.

Always after the user confirms: Saelyx shows the draft first and does not send, post or change anything until the person confirms, with the button or with a spoken or typed "yes".

02 Client ID and permissions

Saelyx uses user OAuth: it uses no service accounts and no domain-wide delegation, and every permission acts on behalf of a signed-in user, with no more reach than theirs. Each block is requested separately, when the user turns it on.

OAuth client ID

This is what you paste into the Admin console to find the application. It is public (it shows in the address bar of Google's consent screen): it is not a secret.

—

Until the ID is published here, look the application up by its name, Saelyx.

Permissions by block

Tick the blocks you want to approve. Below, the list of permissions to paste into "Specific Google data" and the message for your administrator are prepared for you. Every permission starts with https://www.googleapis.com/auth/.

Block	Permission	What we use it for
Agenda	`calendar.events.owned.readonly`	Read the events of the user's primary calendar to know which meeting it is and who attends.
Calendar	`calendar.events.owned`	View, create, move and cancel events, only when the user confirms. It includes the Agenda permission, which is also requested.
Google Tasks	`tasks`	Read, create and complete Google Tasks, including a meeting's action items.
People	`contacts.readonly` `directory.readonly`	Look up the user's contacts (and, with an organization account, the directory, with `directory.readonly`) to fill in recipients and attendees. It includes the Agenda permission, which is also requested.
Sending email	`gmail.send`	Send the minutes, or an email the user dictates, from their account and only when they confirm. It does not read email.
Repository in Drive	`drive.file`	Save minutes and notes in a “Saelyx” folder and import the files the user picks with Google's picker. It only sees what Saelyx creates or what the user picks.
Email (Gmail)	`gmail.readonly`	Search and read email when the user asks Saelyx, never in the background. A Google restricted permission.
All your Drive	`drive.readonly`	Search by name across the whole Drive and watch the files or folders the user chooses. A Google restricted permission.
Google Chat	`chat.spaces.readonly` `chat.messages.create`	See the Chat spaces (names only) and post to one, only when the user confirms. Google Workspace accounts only.
Meet meetings	`meetings.space.readonly`	See recent meetings and bring their transcript into Saelyx. Google Workspace accounts only.

Permissions of the ticked blocks (one per line, with the three sign-in ones)

Message for your administrator

With an organization account, the People block adds the directory permission. Google Chat and Meet meetings only exist in Google Workspace accounts. The identity permissions (openid, email and profile) go with every block. If the user unticks a single permission on Google's screen, Saelyx uses only the ones they grant.

03 What Saelyx does not do

It does not read email in the background or on its own: it only searches or opens a message when the user asks Saelyx to, and only if they have turned on the Email (Gmail) block. Nothing leaves their account (an email, an event, a Chat message) without their confirmation first.
It does not crawl Drive. With the Repository in Drive block it only sees what Saelyx creates or what the user picks with Google's picker. With the All your Drive block it searches by name when asked, and only brings in the file the user picks, or what is new in a watched folder when they press "Sync now" or ask Saelyx to. There are no automatic change notifications.
It does not read Chat messages: it only lists the names of the spaces and posts when the user confirms.
It does not delete files or emails. To save minutes it creates the file or replaces the one it created itself with the same name. An event is only cancelled or moved when the user confirms.
It does not sell Google data, use it for advertising or train models with it, and nobody at Saelyx reads it unless the user authorizes it, for security, or by law. It complies with the Google API Services User Data Policy, including its Limited Use requirements.

04 What data Saelyx stores and how to delete it

The email of the connected account and the domain of its organization.
One refresh token per block, encrypted with AWS KMS.
The repository preferences (destination folder, what is saved automatically and the watched files, if any).
The state of each copy: file name and link; and, for each file brought in from a watched folder, its name and version (so it is not repeated).
The files the user imports into Saelyx, until they delete them or disconnect.

Saelyx makes no lasting copies of your email, events or chats. What it reads when the user asks (the text of an email, an event, a task) becomes part of their conversation with the assistant, and the retention periods of each place where it ends up are in the privacy policy. The action the user has not confirmed yet is kept for 10 minutes at most. The infrastructure is in the European Union (AWS, Ireland).

How to delete it

The user, in Saelyx > Account > Connections > Google Workspace: Disconnect on one block or Disconnect all. That deletes the tokens and the connection data of those blocks and, if they choose, what they imported too. They can also delete their Saelyx account.
In Google: disconnecting a single block does not remove the permission in Google. The user removes it at myaccount.google.com/connections (Security > Your connections to third-party apps and services). Disconnect all does revoke Saelyx's access in Google.
What Saelyx already saved to their Drive (minutes and transcripts) or sent from their Gmail is in the user's own account, and is not deleted on disconnect.

05 Approve Saelyx in your organization

Google does not offer an administrator consent link like Microsoft's: approval is done in the Admin console, by adding the application by its client ID. You need an administrator with access to API controls.

A · Add Saelyx by its client ID

Sign in as an administrator to the Google Admin console.
Open Security > Access and data control > API controls.
Under Manage Third-Party App Access, press Add app and choose to search by OAuth client ID.
Paste the client ID from section 2, search and select Saelyx.
Choose who it applies to: the whole organization or specific organizational units.
Choose the access to Google data (the three states, below) and confirm.

B · The access states

State	What it allows	With Saelyx
Trusted	All the Google data the app asks for, restricted permissions included.	All ten blocks work. It is the simplest.
Limited	Only unrestricted services: the app cannot ask for restricted permissions.	Every block works except Email (Gmail) and All your Drive, which ask for restricted permissions. If you choose it, those two will fail with the error in section 6.
Specific Google data	Only the permissions you tick, sign-in ones included.	Tick the ones in the list in section 2 (plus `openid`, `email` and `profile`). It is least privilege, and what we recommend.

There is also Blocked, which stops anyone in that unit from connecting Saelyx.

C · Apps pending review

If your organization blocks third-party apps that are not configured, the user can ask for a review from Google's own screen (it is on by default). Those requests show up in API controls > Apps pending review. Open Saelyx's, review it and set its access as in part A. The user only has to connect the block again.

D · Domain-wide delegation (optional, with a warning)

Saelyx neither needs nor asks for it: it works with each user's consent. Google offers that delegation as a pre-approval (letting users use OAuth client apps without seeing the consent screen). Only a super administrator sets it up, and it gives access to the data of every user it covers. If you use it, limit it to the blocks you really want and to the organizational units that need it; we do not recommend it as the default path.

06 If a user is blocked: admin_policy_enforced

When your organization's policy does not let Saelyx ask for those permissions, Google cuts the connection with the admin_policy_enforced error (Google's exact text changes with the language and the policy). Saelyx turns it into this message:

"An administrator in your organization has to approve Saelyx." With two buttons: Open the administrator guide (this page) and Copy message for my administrator, the same one as in section 2.

The usual causes are that unconfigured third-party apps are blocked, that Saelyx is on Limited and the block asks for a restricted permission, or that the administrator has restricted the service (Gmail or Drive). The fix is part A of section 5; then the user connects the block again from Saelyx.

07 Block and revoke

The whole organization or one unit: in API controls > Manage Third-Party App Access, open Saelyx and change its access to Blocked. It stops new connections under that policy.
What a user already granted is revoked by them at myaccount.google.com/connections or by disconnecting in Saelyx (Account > Connections).
Each user can disconnect one block or everything. What they imported stays in their Saelyx account until they delete it. See section 4.

08 Contact

Security or approval questions: info@saelyx.ai. We answer on working days, by hand. The app's verification with Google is pending: until then, the consent screen may show "Google hasn't verified this app".

Saelyx for Google Workspace administrators.