Why Google Workspace or Microsoft 365 connects first
Every Stackleaks scan starts from one question: who actually works here? The only trustworthy answer lives in your identity directory — Google Workspace or Microsoft 365 — because that's the system HR actually maintains when someone leaves.
The rule
Your directory is the source of truth. Tools like Slack, Jira, or HubSpot are checked against it, never the other way around. A Slack account can never mark someone as an active employee — Slack accounts of ex-employees are precisely the ghosts we hunt. That's also why headcount for billing is measured from the directory alone.
What we read
Names, email addresses, account status (active, suspended, archived), and last sign-in times. Read-only, revocable any time, exact scopes on What we can see. Suspended and archived directory accounts count as offboarded people — if one of them still holds a live seat somewhere, that's a finding.
No directory? No problem, mostly
The upload route works without any OAuth: upload a users list as CSV or Excel (email, first name, last name — that's all) and get a lighter report. You lose the automatic nightly cross-check, but the math is the same.