Bulk downloads
Thousands of client files pulled
in a window no task needs.
MANAGED SERVICE PROVIDERS & IT PARTNERS
You hold the keys.
Prove they're used properly.
TripWyre gives managed service providers something to sell and
something to stand on: behavioural oversight of client file activity,
and independent evidence of how your own access is used.
It watches how access is used.
Including yours.
Built for Google Workspace. Nothing to install at your clients.
TripWyre detects data exfiltration in Google Workspace by monitoring file activity — abnormal downloads, sharing, edits and access — without reading the files. For an MSP that is two things at once: a monitored service you can offer every Google client, and an independent record that your own technicians' access is being used the way you promised.
You are the third party
in somebody else's risk register.
Every security conversation on this site is about an outside provider with legitimate access to a client's files. To your clients, that outside provider is you.
Answering that with a contract clause and a promise is the weakest position available. Answering it with independent behavioural monitoring — running whether or not you report on yourself — is the strongest.
The same connection then lets you offer your clients something they cannot get from their permissions model: an alert when an account with access starts behaving like a breach.
This is what your client sees.
Unusual bulk download
02:14
- Account
- contractor@clientco.com — permitted, external
- Folder
- Client files / Payroll
- Volume
- 8,421 files in 6 minutes
- Against normal
- 37× this account's usual rate
- Also seen
- 3 folders shared to a personal address
TripWyre detected the anomaly without opening a single file.
The trust is already there.
The evidence isn't.
Your technicians have admin rights across client
tenancies because the work cannot be done without
them. Everything they do is permitted.
When a client asks how they would know if that
access were misused — by a departing staff member,
a compromised laptop, or a subcontractor — the
honest answer today is usually that they wouldn't.
TripWyre answers it independently: it watches the
behaviour around the files and alerts a named
human when the pattern breaks.
One engine, two jobs.
The same behavioural detection, pointed in two directions: outward at your clients' risk,
and inward at the access your own team holds.
Abnormal sharing
Client folders shared outside
the tenancy, or by link, at scale.
Unusual access
An account, hour or location that
has never touched these files.
What TripWyre does, and what it doesn't.
TripWyre watches file activity in Google Workspace — downloads, shares, edits, deletions, access — and alerts a human when the pattern changes.
It does not scan file contents, cover email or endpoints, cover clouds other than Google, or take action on your systems.
Everything on this page is running in production today. You can watch it fire on real file activity in the demo.
Detect behaviour —
not people.
TripWyre reads the activity record Google Workspace already keeps — opened, edited, shared, downloaded, and by whom. It does not open documents, measure productivity, or watch screens, keystrokes or hours. That matters more for you than for anyone: you are handling other people's client data.
Your clients' files stay private. TripWyre never reads file contents. Permission to open a file is never requested, so it can never be used — by us or by you.
Behaviour, not people. The alert describes what happened and when — a pattern, not a performance review.
Independent of the provider. Oversight that does not depend on the provider reporting honestly about itself is the only kind a client should accept — including from you.
Start with one client.
Connect one tenancy
A normal secure Google sign-in on
a client who would value it. No
agents, no rollout, no change
to how you work.
Point it at what matters
The folders that would hurt that
client most if they left — finance,
client data, personnel, IP.
Get told, not filed
Alerts reach whoever you
nominate — your service desk, the
client, or both.
Straight talk before you put us in front of a client.
The engine is real, running in production, and watching file activity in Google Workspace today. What does not exist yet is the thing an MSP asks for second: a single multi-tenant console showing every client at once, with your branding on it.
Today each client tenancy is connected on its own. That is genuinely enough to run a first paid client and prove the value — it is not enough to run fifty. The multi-tenant console is what we would build with a first partner, and we would rather agree that with you than let you discover it after you have sold it.
There is no partner margin published yet either. It is a conversation, not a rate card, and we will be direct about it on the call.
Talk about partnering.
Thirty minutes. We show the engine firing on live file activity, walk through what connecting a client tenancy actually involves, and be straight about what exists today and what would be built with a first partner.
No slide deck, no obligation, and we will tell you plainly if TripWyre is not the right fit yet.
Not ready for a call? Read the free field guide — what outside access to your files actually looks like, and how you would know. No meeting, no obligation.
Straight answers.
Including the ones we'd rather you heard from us first.
Is there a multi-tenant console?
Not yet, and we will not pretend otherwise. Each client Workspace is connected on its own today, which is enough to run a first client properly and not enough to run a portfolio.
A partner console is the first thing we would build with a first partner, and we would rather scope it with you than guess at it.
What does the margin look like?
It is a conversation rather than a published rate card, because you would be the first. What we can say is that the economics have to work for a partner who is putting their own client relationship on the line, and we would rather set that with you than dictate it.
How quickly do we hear about it?
TripWyre alerts your team within minutes of the activity appearing in Google's own activity record — not the next morning, and not at the next audit.
We say minutes rather than "real time" because that is what we can stand behind: the engine reads Google's activity record continuously rather than sitting in the path of your files.
Can TripWyre stop an exfiltration?
TripWyre is an early-warning system. It detects abnormal file activity and alerts your security team quickly — with the user, the files, the volume and the pattern — so your team can revoke access, disable sharing or investigate while it still matters.
TripWyre does not block, quarantine or revoke anything itself. It is the smoke alarm, not the sprinkler, and it is deliberately built that way: a monitor that cannot change your Drive is a monitor that can never break it.
Can you read our documents or our clients' data?
No — and not merely as a promise. Connecting grants exactly two read-only permissions: see file names, and see the activity record. Permission to open a file is never requested, so it can never be used.
That matters if you hold client, patient or legal material: we can help you supervise it without ever seeing it.
What do we have to install?
Nothing. No agents on machines, no network changes, no rollout to your team. It connects on the Google side and keeps working with every computer in the business switched off.
Our clients aren't all on Google Workspace.
Then those clients are not addressable yet. Google Workspace works today; Microsoft 365 and Dropbox are next. Start with your Google clients and tell us what mix you hold — it is the most useful thing a partner can tell us right now.
Who is behind it?
TripWyre was invented by Australian inventor Ric Richardson, who holds more than 200 patents, and co-invented with Dennis Groves, a partner in Deadbolt Cyber Holdings who comes from the application-security world.
It is commercialised through Deadbolt Cyber Holdings. Patent pending on the underlying method.
Prefer to just ask a person? Email max@mail.ricricho.com and a human will answer.
Your clients trust you
with the keys.
Give them — and yourself — something better than a promise.
Request a partner call