Over time, staff often connect random third-party apps to their Google account for calendar syncing, scheduling tools or note-taking apps, each of which is granted some level of access to your data. Review connected apps periodically (Admin console > Security > API controls, or an individual's Google Account > Security) and remove anything nobody remembers authorising.
Coach's tip: treat "Sign in with Google" the same way you'd treat handing over a password — check what access it's actually asking for before clicking allow.
Book a free tech audit. A 45-minute call and a written summary, no obligation.