What it does.
ArpSentry Connect is the step in which a client connects its Google Search Console and Google Analytics, optionally its Bing Webmaster Tools, and with Manage also its Google Tag Manager, to ArpSentry. It is used by clients of ArpSentry who receive a link from us. After connecting, there is nothing else for the client to do in it: ArpSentry staff use the data in ArpSentry’s internal tools, and the results reach the client as audits, reports and, with Manage, the configuration changes agreed with the client.
Two access levels.
The client chooses the level when it connects.
Read, the default: ArpSentry can see the client’s Search Console and Google Analytics data, and its Bing Webmaster Tools data if the client connects it. It cannot change anything.
Manage: everything in Read, plus Google Tag Manager. ArpSentry staff can make the changes listed below, such as submitting a sitemap, creating a key event or publishing a Tag Manager version, each one only after a confirmation step and recorded in a change log. Manage never includes adding or removing Search Console properties, users or owners, managing Google Analytics or Tag Manager users, or deleting Tag Manager accounts or containers.
How connecting works.
Connecting takes one sign-in with Google. Connecting Bing Webmaster Tools is optional at either level and takes a separate sign-in with Microsoft:
The client opens the link ArpSentry sends.
The client chooses Read or Manage. Read is the default.
The client signs in with the Google account that has access to its Search Console and Google Analytics properties and, with Manage, its Tag Manager container.
Google’s consent screen lists the permissions for the chosen level, described below. The client reviews and approves them.
Optionally, at either level, the client also signs in with the Microsoft account that has access to its site in Bing Webmaster Tools and approves the permission on Microsoft’s consent screen.
Data it accesses and changes it can make.
ArpSentry Connect asks Google and Microsoft for these permissions only. Access covers the sites, properties and containers the connected account can see; we use only those that belong to the client’s engagement.
Read
These permissions are read-only. With Read, ArpSentry Connect cannot change settings, add or remove users, submit or remove URLs or sitemaps, or change any data in the client’s Search Console, Google Analytics or Bing Webmaster Tools.
Google Search Console, read-only (
https:/). Data accessed: the list of sites the account can access and its permission level on each; search analytics, meaning clicks, impressions, click-through rate and average position by query, page, country, device and date; and URL inspection results, such as index status, last crawl and canonical URL, for specific pages. Changes: none./ www. googleapis. com/ auth/ webmasters. readonly Google Analytics, read-only (
https:/). Data accessed: GA4 reports, such as users, sessions, traffic sources, landing pages and key events, and account and property details, such as names, IDs, time zone and currency. Changes: none./ www. googleapis. com/ auth/ analytics. readonly Sign-in (openid, email). Data accessed: the email address of the Google account used to connect, so we know which account granted access. Changes: none.
Manage
Manage includes the Read permissions above and adds the Google permissions below; for Bing Webmaster Tools, if the client connects it, Manage asks for webmaster.manage instead of webmaster.read. ArpSentry staff make each change only after the confirmation step, and each change is recorded in the change log. ArpSentry Connect does not ask for the permissions needed to manage users or to delete Tag Manager accounts or containers.
Google Search Console, manage (
https:/). Data accessed: the Search Console data listed under Read, plus the sitemaps submitted for each site and their status. Changes: submitting and deleting sitemaps, and nothing else. ArpSentry does not add or remove Search Console properties, users or owners./ www. googleapis. com/ auth/ webmasters Google Analytics, edit (
https:/). Data accessed: the Google Analytics data listed under Read, plus the property configuration: key events, custom dimensions and metrics, data retention, the enhanced measurement settings of web data streams and Google Ads links. Changes: creating and deleting key events, and marking an event as a key event; creating and archiving custom dimensions and metrics; setting event data retention; turning enhanced measurement settings on or off for a web data stream; and creating Google Ads links. ArpSentry does not add, remove or change users or their permissions./ www. googleapis. com/ auth/ analytics. edit Google Tag Manager, edit containers (
https:/). Data accessed: the client’s Tag Manager accounts and containers, with their workspaces, tags, triggers and variables. Changes: creating, editing and removing tags, triggers and variables, only in a workspace named “ArpSentry” that ArpSentry creates in the container./ www. googleapis. com/ auth/ tagmanager. edit. containers Google Tag Manager, edit versions (
https:/). Data accessed: the container’s versions, to list and compare them. Changes: creating a container version from the ArpSentry workspace./ www. googleapis. com/ auth/ tagmanager. edit. containerversions Google Tag Manager, publish (
https:/). Data accessed: nothing beyond the Tag Manager data above. Changes: publishing a container version, which makes it live on the client’s website, and rolling back by publishing the previous version./ www. googleapis. com/ auth/ tagmanager. publish Bing Webmaster Tools, manage (webmaster.manage, Microsoft), optional, instead of webmaster.read. Data accessed: the Bing Webmaster Tools data listed under Read, plus the site’s sitemaps and blocked URLs. Changes: submitting URLs, within Bing’s daily quota; submitting and removing sitemaps; and blocking or unblocking URLs.
How changes are made.
Read is the default level, and with it nothing can be changed. With Manage, every change is made by ArpSentry staff in ArpSentry’s internal tools, and only after an explicit confirmation step in which the staff member reviews the change and confirms it.
Each change is recorded in a change log with who made it, when and what changed. Nothing is changed automatically or on a schedule.
What the data is used for.
Only for the services agreed with the client, listed below. ArpSentry staff may use an AI assistant (Claude, by Anthropic) to analyse the data for these tasks. We do not sell the data, use it for advertising or use it to train AI models.
SEO audits of the client’s website.
Ranking and traffic reports.
Alerts about changes that need attention, such as a drop in clicks or pages dropping out of Google’s index.
The reports ArpSentry delivers to the client.
With Manage, the configuration work agreed with the client: submitting sitemaps and URLs, setting up key events, custom dimensions and metrics and enhanced measurement, creating Google Ads links, and editing, publishing or rolling back the Tag Manager container.
Revoking access.
The client can revoke access at any time, at either level, in any of these ways. After that, ArpSentry can no longer fetch data or make changes, and we delete the stored tokens. On request, we also delete the data already retrieved.
Google: on its Google Account permissions page, at myaccount.google.com/permissions, by removing ArpSentry Connect. This ends access to Search Console, Google Analytics and Tag Manager.
Bing Webmaster Tools: in the Bing Webmaster Tools settings, by removing the access granted to ArpSentry Connect.
ArpSentry: by asking us to disconnect it, through the contact page or on WhatsApp.
Privacy.
Our privacy policy describes how ArpSentry Connect accesses, uses, stores and shares Google user data at both levels, including the change log, and how it complies with the Google API Services User Data Policy, including the Limited Use requirements. For client data, ArpSentry acts as data processor under the written data processing agreement with each client.
Contact.
ARP SENTRY S.R.L. · CUI 55602852 · J2026054884003
Working remotely from Bucharest, Romania.