Expense Tracking for Google Workspace (Setup Guide)

Seamless Capture - Every Way Your Team Works

📸 Camera: Snap receipts right in the browser - no app download needed
📧 Gmail: With Smart Scanning enabled, scheduled scans find likely receipt and income messages without forwarding rules
🖼️ Google Photos: Optional picker for photos the user selects to import
📄 Upload: Upload supported receipt images and PDFs
✉️ Forward: Still works if preferred - receipts@expensebot.ai

AI-Powered Processing

ExpenseBot's AI extracts available details such as amount, tax, vendor, and date, and suggests categories or GL codes. Users review uncertain and action-needed items before relying on a report. Policy comparison is a separate user-run review when a policy document is supplied.

Report Sharing and Accounting Handoffs

Create reports from reviewed rows, share them with named recipients, and use a supported accounting connection or reviewed file workflow. Team card reconciliation has its own configured review and approval flow; ExpenseBot does not infer a universal manager chain from Workspace.

ExpenseBot is a Google Workspace expense tracker that behaves the way Workspace-native tooling should: your expense data lives in a Google Sheet that you own, in your own Google Drive. When you sign up, ExpenseBot creates a single Sheet inside your Drive and writes every captured receipt, mileage entry, and supported reimbursement record to that file. The Sheet is the durable source of truth; ExpenseBot's Google Cloud services process receipts and retain limited operational records described in the privacy policy.

Because the durable spreadsheet and receipt artifacts remain in your Drive, there is no "export your expenses" migration if you ever stop using ExpenseBot. The Sheet simply stays in your Drive with all its history, formulas, tabs, and sharing permissions intact. Finance teams can pivot, filter, and build dashboards on top of it using the Google Sheets features they already know — no vendor-specific report builder to learn.

ExpenseBot uses Google's drive.file OAuth scope, which is the narrowest Drive permission available. That scope only grants access to files the app itself creates or that you explicitly pick via the Google Picker — ExpenseBot literally cannot see the rest of your Drive. This matters for IT: a rogue or compromised app with drive.file cannot enumerate your company documents.

• Per-user install: each employee signs in with Google and gets their own Sheet in their own Drive.
• Domain-wide install: Workspace admins can deploy ExpenseBot across the tenant via the Google Workspace Marketplace.
• Files in the user's Drive are subject to the Workspace controls configured for that account.
• The Sheet is the durable financial record; operational processing uses ExpenseBot's Google Cloud services.

IT and security teams at Google Workspace shops evaluate every SaaS addition against a short, sharp checklist: identity, data handling, scope of access, revocation, and auditability. ExpenseBot documents those boundaries so administrators can complete their own review.

Identity: users authenticate with Google rather than creating a separate ExpenseBot password. Each user connects their own Google account through per-user OAuth. Durable files: the spreadsheet and supporting files are created in that user's Drive, where the organization's Google Workspace controls can apply. ExpenseBot also processes data and keeps limited service records as described in the Privacy Policy.

Scopes are deliberately minimal: drive.file (files the app creates or the user picks — not the whole Drive), gmail.modify (used by the overnight receipt scanner to find receipt-shaped emails and label them as processed so they aren't reprocessed — it never sends email and never permanently deletes anything). No gmail.send, no drive (full Drive), no contacts, no calendar unless the user opts into mileage-from-Calendar. Every scope is incrementally requested at the moment of use. Administrators can restrict future access in the Workspace admin console under Security → API controls → Manage third-party app access; individual users can also revoke their Google connection.

• Google sign-in — no separate ExpenseBot password.
• Durable receipt files and expense records stay in your Drive; limited service metadata and temporary processing are disclosed in the Privacy Policy.
• Minimal scopes: drive.file + gmail.modify (labels receipts as processed; never sends or permanently deletes); incremental consent.
• 2026 CASA Tier 2 independent application-security assessment completed.
• Admin API controls plus individual Google connection revocation.

ExpenseBot's Google Workspace expense reporting flow is designed for small teams: each user connects their own account, keeps durable records in their Drive, and can share completed reports with named recipients.

A team owner purchases and assigns ExpenseBot seats, then invites users from inside ExpenseBot. Each invited user signs in and connects their own Google account. If a dedicated office manager helps with reporting, users can share completed reports with that person or invite a supported accountant role. Gmail scanning, uploads, camera capture, and optional Google Photos import feed the same review workflow.

At month-end or quarter-end, users create reports from reviewed rows. Reports include the structured data and supporting-document links needed for review, sharing, and the supported accounting handoff selected by the user. ExpenseBot does not silently merge every employee into one shared departmental ledger.

• Per-user Google connection and durable Drive-based records.
• Gmail-based receipt discovery without forwarding rules.
• ExpenseBot review before reports or accounting handoffs.
• Named report sharing and supported accountant access.
• Team seats and invitations managed inside ExpenseBot.

ExpenseBot is a Google Workspace expense tracker that works with the Google tools your team already uses. There are no new employee devices to deploy and no separate ExpenseBot password. Durable receipt files, spreadsheets, mileage logs, and reports created by ExpenseBot sit in the user's Google Drive and are subject to the Workspace controls configured for that account. ExpenseBot services still process data and retain limited operational records as described in the privacy policy.

The integration surface is intentionally narrow and minimum-scope:

• Gmail — gmail.modify to auto-detect receipts in employee inboxes overnight and label them as processed so they aren't reprocessed. ExpenseBot never sends email and never permanently deletes anything (it does add a "Processed" label so it won't reprocess the same receipt).
• Drive — per-file scope (drive.file), not full-Drive. ExpenseBot can only read or write files it created or that the user explicitly hands it via the picker.
• Sheets — the reporting layer. Every expense lands as a row in a Google Sheet your user owns, with formulas, filters, and pivot tables you can edit like any other Sheet.
• Calendar — read-only access to derive mileage from events that have addresses. No GPS app, no battery drain.
• Photos — optional access for users who select receipt photos to import.

That's the whole footprint. ExpenseBot is not a standalone expense app that happens to talk to Google — it's a Workspace-connected layer. If you turn ExpenseBot off, the durable Sheets, receipt files, and reports it already created remain in the user's Drive in familiar formats. ExpenseBot's privacy policy describes the separate operational data used to run the service.

For IT and security leads, a new vendor in the expense category requires a review of identity, requested access, data handling, subprocessors, retention, and revocation. ExpenseBot has completed a CASA Tier 2 independent assessment, and customers retain durable receipts, Sheets, and reports in their own Google Drive.

What CASA Tier 2 means. A CASA-authorized lab independently assessed ExpenseBot against the applicable Tier 2 requirements. It is useful vendor-review evidence, but it is not a Google endorsement and does not replace an organization's own review.

Guided deployment via Admin Console. Open the Google Workspace Marketplace, search ExpenseBot, choose Admin install, select the groups or organizational units, and review the requested access. If third-party apps are restricted, configure ExpenseBot as trusted under API controls. Policy changes can take time to propagate, and each user still signs in to connect their own account.

Clear data ownership and processing boundaries.Receipts and reports live in the customer's Drive, while ExpenseBot's Google Cloud services process receipt data and retain limited operational records. Security teams should review the documented scopes, privacy policy, retention practices, and subprocessors as they would for any vendor. Users authenticate with Google rather than a separate ExpenseBot password. ExpenseBot does not use domain-wide delegation or SCIM; team seats and invitations are managed inside ExpenseBot.

Each user connects their own Google account, and a team owner manages ExpenseBot seats and invitations inside ExpenseBot. Captured expenses are written to the user's Google Sheet with links to supporting files in Drive. Users review categories, tags, business use, and action-needed items in ExpenseBot before creating a report.

Reports can be shared with named recipients and moved through the report review states supported by ExpenseBot. Team card reconciliation has a separate configured review and approval flow. ExpenseBot does not create a universal manager approval chain from the Workspace directory, and changing a Sheet cell is not the product's approval mechanism.

Google Workspace expense reporting for a small team often has a specific shape: an office manager or fractional bookkeeper handling reimbursements, a founder or COO who wants to see month-end totals without learning yet another dashboard, and an outside accountant who needs clean exports at quarter-end. ExpenseBot keeps those people in a shared process without requiring a new card program.

ExpenseBot creates shareable reports from reviewed rows and supports accounting connections or reviewed file exports for systems including QuickBooks, Xero, Wave, and Sage. The exact handoff depends on the accounting product and the connection enabled on the account. The Google Sheet remains available for filters, pivots, collaboration, and accountant review.

Team owners choose and assign paid seats inside ExpenseBot; the Marketplace install controls Google availability and OAuth policy, not ExpenseBot billing. See current plans on the pricing page. If ExpenseBot is disconnected later, the durable Sheets and Drive files already created for the user remain in that Google account. See how Google Workspace expense management without a corporate card works when you keep the cards and bank you already have.

ExpenseBot is designed for teams that want receipt capture, review, and card reconciliation while keeping durable records in Google Drive.

• Keep your existing cards. Connect the company bank or upload statements instead of replacing the card program.
• Use Gmail and Drive. Discover receipt-shaped emails without forwarding rules and keep the durable artifacts ExpenseBot creates in Google Drive.
• Review before handoff. Employees resolve missing receipts and uncertain items before reports or supported accounting handoffs.
• Manage the team centrally. Owners assign seats, push supported accounting settings, assign company cards, and monitor reconciliation progress.

If you need a new corporate-card program with bank-controlled spending limits, choose a card issuer. ExpenseBot is for teams that want to keep their current bank and cards, connect them to named employees, and make missing-receipt follow-up visible in one workflow.