How to Find Sensitive Files in Google Drive?

‍Google Drive is great for storing and collaborating on documents, but it’s easy to lose track of where sensitive information might be lurking. Whether it’s personally identifiable information (PII), financial records, or confidential project details, you need to ensure these files don’t slip through the cracks. In this post, we’ll cover:

1. Why Finding Sensitive Files Matters
2. Manual Steps to Identify Sensitive Files Across an Organization’s Google Drive
3. How Strac Finds & Remediates Sensitive Files in Google Drive
4. Next Steps

Let’s get started.

1. Why Finding Sensitive Files Matters

• Data Privacy: You don’t want personal data (e.g., Social Security numbers, birthdates, addresses) stored in places where it could be compromised.
• Regulatory Compliance: Industries like healthcare (HIPAA), finance (GLBA, PCI-DSS), or government contractors (CMMC) have strict rules on how you handle and store sensitive data. Noncompliance can lead to heavy fines.
• Minimized Risk: If employees accidentally share or store sensitive files in the wrong folders, or with incorrect sharing settings, it could lead to data leaks or breaches.
• Efficient Data Management: Locating and categorizing sensitive documents helps keep your Drive clutter-free and your data secure.

2. Manual Steps to Identify Sensitive Files Across an Organization’s Google Drive

As with publicly shared files, Google Drive does not offer a built-in tool to scan all files in a Google Drive account at scale for sensitive data. Here are some (limited) manual options in a given user account. NOTE: THIS ONLY APPLIES TO A GIVEN USER ACCOUNT.

1. Keyword Searches:
   • Type known sensitive keywords (e.g., “SSN,” “confidential,” “passport,” etc.) into the Drive search bar. This can help surface some files containing these terms.
   • This approach isn’t foolproof, as sensitive information isn’t always labeled in an obvious way.
2. Review Shared Drives and Folders:
   • If you know specific shared drives or folders that might contain sensitive content, you can review them file-by-file.
   • Still, this is time-consuming and prone to human error.
3. Rely on Individual Owners:
   • Each user can check their own files for potential sensitive info. But if you’re an admin, you don’t get a global view across all user drives.

Limitations of Manual Methods

• Time-intensive.
• Results rely on guesswork or very targeted searches.
• No automated alerts if new sensitive files are created or uploaded.

3. How Strac Finds & Remediates Sensitive Files in Google Drive

That’s where Strac comes in—an automated solution designed to scan for and safeguard your organization’s sensitive data. Here’s how it works:

Connect Your Google Drive

• Head over to the Strac dashboard and add a Google Drive connector.
• This allows Strac to securely access your Drive and begin scanning for sensitive information.

Automated Scanning & Detection

• Once connected, Strac uses built-in data classifiers (e.g., credit card numbers, SSNs, driver’s license formats, etc.) to identify sensitive data across your entire Google Drive.
• You don’t have to guess keywords or hunt manually; Strac flags potential risks automatically.

Set Alerts & Policies

• Configure alerts to notify you via Slack, Teams, or email if new sensitive files appear or if existing files become accessible to unauthorized users.
• You can also set auto-remediation policies—if Strac detects PII in a publicly shared file, it can immediately remove public access.

Dashboard Review

• The Strac dashboard lists all discovered sensitive files, along with:
  • File Type (PDF, Doc, Image, etc.)
  • Sharing Permissions (public, external members, internal only)
  • Scan Date and summary of detected data (e.g., “SSN” or “Credit Card Number”)

One-Click Remediation

• Apply labels automatically to sensitive files

Strac Benefits

• Time Savings: Quickly find sensitive files rather than manually searching or relying on user reporting.
• Real-Time Alerts: Get notified when someone uploads or shares a file containing sensitive content with the wrong audience.
• Centralized Security: Strac isn’t just for Google Drive—apply the same detection and remediation across other SaaS apps, emails, and cloud storage solutions.