KeyvaciIntegration · Google Workspace
The team vault that opens
with your Google identity
If your organisation runs Google Workspace, your team already has its Keyvaci sign-in. No new passwords to distribute, no user list to upload, and nothing to install in your domain.
What the integration does
Domain-verified, on your own DNS
Authorised on the record
Anyone signing in from your Workspace can create the organisation, and they must first confirm, on the record, that your organisation authorised them to. The confirmation is written to the audit log with their name and verified Google identity, because whoever creates it becomes the keeper of the recovery kit.
Your domain, proven over DNS
An administrator publishes the single TXT record we issue and the domain is settled: a verified tick appears beside your organisation’s name, and nobody else with an address at that domain can create a separate one. Colleagues join yours by invitation, never by holding an address that ends the right way.
Personal Gmail is refused
A sign-in without a Workspace domain is rejected at the door. Without a directory there is nothing to attach an organisation to, so those accounts take the email route instead, with identical encryption. The rule lives in one place, not scattered across the service.
SSO without weakening encryption
Google answers who you are. What you can decrypt still comes only from your master password, derived on your device. The two systems are separate by design, so adding SSO never dents the zero-knowledge property.
Your identity policy rides along
Whatever your Workspace enforces at sign-in applies to Keyvaci, because sign-in is your directory. Where the directory says nothing about a second factor, Keyvaci treats that as unproven and answers with its own step-up rather than assuming.
A stable identity, not an email address
Members are anchored to the permanent identifier Google issues, not to the address on it. Someone can be renamed or married or move team without becoming a stranger to their own vaults.
Setup, in full
Three steps, no ticket to IT
Sign in with Google
Whoever will administer the vault clicks "Sign in with Google" and consents, exactly as with any Workspace app. Nothing is written to your directory.
Create the organisation
They confirm they are authorised to act for your organisation, then your browser generates its signing and recovery keys locally, shows them once, and never sends them to us. Verifying your domain afterwards reserves the name.
Invite by email
Members sign in with their existing Google account and are recognised automatically. Each sets a master password, gets countersigned by an admin, and starts receiving vaults.
Already using Keyvaci with email accounts? Nothing has to be migrated. Sign-in and cryptography are separate systems, so linking a Google identity leaves keys and vaults exactly where they are, with no re-encryption.
Workspace questions
Asked by every Workspace admin so far
Does this require changes to our Workspace?
No. Users consent at first sign-in as they would for any Workspace application, and nothing is written back to your directory. We ask Google for nothing beyond the identity you sign in with: no directory read, no administrative permission.
Could a colleague create a separate organisation for our domain?
Until you verify your domain, yes, and that is a deliberate trade: a team can start on its own without waiting for a ticket, and separate organisations stay separately encrypted, so neither can read the other. Verifying closes it. Publish the TXT record we issue and nobody else at that domain can create one; they can only be invited into yours. Either way, one work address belongs to one organisation at a time.
What about contractors who are not in our Workspace?
They join by email with mandatory verification, and are countersigned by an administrator before they can receive any vault, exactly like directory members. The encryption is identical either way.
Can we use Google sign-in in the browser extension and the mobile apps?
Not yet. The extension and the mobile apps support Microsoft Entra ID and email accounts today, and Google is being brought to both next. In the meantime everyone in a Workspace organisation can use those clients through email sign-in, with the same encryption and the same audit trail. Where each client stands today.
Do we lose anything by starting on email accounts?
No security property, no. Client-side encryption, countersigned keys, admin recovery, rotation, and audit are identical. What you gain by moving to Google sign-in is one fewer password for people to manage, and a joiner-leaver process that follows the directory you already run.
Your domain is the hard part. It's done.
Everything else takes minutes. Fourteen days, every feature, no card.