Most sensitive data outside a cloud account sits in SaaS. These sources are
configured separately from cloud accounts because none of them appear in a cloud
provider’s inventory — there is no account to assume a role in.
Each source takes a bearer token plus whatever locator that product needs, and
the same 269 classifiers run against the content they return.
File and document stores
| Source | Scans | Notes |
|---|
| Microsoft 365 | SharePoint sites, OneDrive, Teams files | One Graph token. Each site and drive is enumerated separately, because each is separately permissioned and a finding has to name which one. |
| Google Workspace | Google Drive, shared drives, Gmail | Shared drives are enumerated separately from personal drives. Gmail is per-mailbox: there is no tenant-wide message API, so a Workspace sweep is one store per mailbox. |
| Box | Files and folders | |
| Dropbox | Files and folders | |
| SMB / CIFS file shares | Windows and NAS shares | NFS is not supported: v3 has no real authentication and v4 requires Kerberos, which is a different security model rather than a variation. |
Messaging and ticketing
| Source | Scans | Notes |
|---|
| Slack | Files, and channel messages | Message scanning is separate from file scanning; name the channels to scan. |
| Microsoft Teams | Channel messages | Needs the ChannelMessage.Read.All protected API, which Microsoft grants only after a manual application-access review. Teams files need no such review — they are drives, covered above. |
| Atlassian | Jira issues, Confluence pages | One site plus token. |
| Zendesk | Tickets and attachments | |
| ServiceNow | Records and attachments | |
| Salesforce | Objects and attachments | |
Warehouses and databases
These are reached directly rather than through a cloud account’s inventory:
| Source | Notes |
|---|
| Snowflake | Key-pair authentication. Account, user, role, warehouse and database. |
| Databricks | Host plus token. An empty warehouse ID degrades to catalog-only coverage rather than failing — column names alone drive real findings. |
| MongoDB | Credentials travel in the URI, as Mongo connection strings do. |
| Azure Cosmos DB | Content requires the Built-in Data Reader role, which cannot be assigned from the portal — only via az cosmosdb sql role assignment create or ARM. |
| Kafka | Samples topics on your cluster, configured separately from TigerGate’s own message bus. |
Retained AI provider logs
Prompts and completions retained by an AI provider are a data store like any
other, and one that rarely appears on an asset inventory.
| Source | Notes |
|---|
| OpenAI | Requires an admin key scoped to the organization. A project key returns 401. |
| Azure OpenAI | Only has anything to read when stored completions are enabled on the resource. |
Scope and cost
Every source is opt-in. A source with no credential configured is reported as
not scanned, never as clean — the same rule that governs cloud accounts.
SaaS sources are rate-limited per provider. A large Microsoft 365 or Google
Workspace tenant is scanned incrementally across runs rather than in one pass,
so the first complete picture may take several scheduled scans. Coverage
counters show progress.
