Collavate Update – Limited ‘Scope’ to address security concern and improved Post feature

When initially launching Collavate, permission is requested to access the user’s Google Drive to permit file submissions and approval process workflows.  Before this update, Collavate users were concerned that the application required too much access permission and that their personal information may be at stake.

When users grant access to Collavate, it allows Collavate to have API access to specific data such as a user’s calendar and contacts, but such access never allowed Collavate to store any of data outside of the user’s Google Drive. Collavate leverages a user’s Google Drive and Google Docs for application functionality purposes only, but all user data and account files remain safely stored in the Google Cloud Platform.

This update also extends the functionality of the Tagging feature by allowing Tagging whenever a user is mentioned in a post. Collavate users can now freely mention/tag users outside of their Google contacts and users from other domains.

  1. Google Account Access Limited to Ensure User Privacy
For Collavate Business or Enterprise users, the app is installed by the Super Admin and access permissions are granted after security review. In this case, staff users are managed by the administrator.

To address users’ concern regarding their Google account privacy and security, we have updated Collavate’s initial access permission to greatly limit  accessibility.

When launching Collavate, it will now only ask for access permission to your email address and basic profile information. These functions are required to permit file submissions and carry out approval process workflows.


Collavate will never store your personal data, and your files and work operations will always remain safely stored in the Google Cloud Platform.

To ensure users that they are in control of their account data at all times, if a user selects the “My Drive” menu tab in the Collavate application, a popup will notify the user as to which part of their Google account needs to be accessed for proper application functionality. The “My Drive” menu tab requires access permission to a user’s Google Drive to upload and submit a file via Collavate.

Access permission to Google Drive is required for full features. This link directs user to the Google account access permission screen.

Permission page for access to user’s Google Drive for Collavate’s “My Drive” menu functions.

Collavate users that do not use Google Drive related features, such as Post and workflow review, can simply continue to use the app for needed purposes with access granted  to the user’s basic account information. There is no need to grant additional access to the Google Drive.

  1. Tagging with Email in Home Feed
Before the update, Tagging was limited to a user’s Google contacts.

Now, you can tag anyone by using the “@” symbol followed by the person’s user name or email address. @ + name will auto-populate users from your Google contacts.  In addition, you can tag users outside of your Google contacts and out of your company domain by using the “@” symbol followed by a user’s email address.

Example: Sarah is not in your company domain and you have not had the time to add her to your Google Contacts. You can still use the mention/tag feature with her email address. By typing in, Sarah will receive an email notification that she has been mentioned and will be able to view your post.

When the recipient (Sarah) opens the email, Collavate will launch and ask for initial basic google profile permission access. Once the user (Sarah) grants access, she can join the post for collaboration tasks.

Tagging users feature notifies recipients and allows collaboration

We thank our Collavate users and the helpful feedback we have received. We are happy to provide responsive updates to enable our users to operate and use the application with ease and peace of mind with data security. The Collavate team is dedicated to improving and further advancing our application! For any questions or feedback, please email us at