RoleFlow
Now in public beta — free plan available

Sync Workspace groups to
GA4, GTM & Google Ads.

RoleFlow syncs your Google Workspace group memberships to GA4, Google Tag Manager, and Google Ads — automatically. Add someone to a group, and they have the right access everywhere. Remove them, and they don't.

Get Started Free See how it works

No credit card required. Free plan available.

Hosted on Google Cloud Google OAuth — no service accounts EU data only — Belgium GDPR-compliant Open-source sync engine

How it works

Three steps. No service accounts. No manual work after setup.

1

Connect your Google account

Sign in with your Google Workspace account. Then connect each product you want to manage — GA4, Google Tag Manager, and Google Ads — using standard OAuth. No service accounts. No shared credentials.

2

Map a group to a role

Choose a Workspace group and assign it a role in each connected product (Viewer, Editor, Admin — whatever that product supports). Set it once. RoleFlow remembers it.

3

Access flows automatically

From this point on, adding someone to the group gives them access. Removing them revokes it. On the Business plan, RoleFlow checks for changes every hour. No manual steps.

Built for teams that manage Google tools

Everything you need to keep access correct, automatic, and auditable.

One group controls everything

Map a single Workspace group to GA4, Google Tag Manager, and Google Ads in one setup. Every product reflects the same membership. No toggling between admin consoles.

Pure OAuth — no service accounts

RoleFlow connects using your own Google credentials, not a service account or delegated authority. Each product is authorized independently. Your security team will not need to review or maintain shared service account keys.

Stays in sync without reminders

On the Business plan, RoleFlow checks your group memberships every hour and applies any changes across all connected products. New hire provisioned? Done before they finish their onboarding call.

Right role, right tool, right person

Different tools use different permission levels. RoleFlow lets you specify the exact role for each product — GA4 Analyst, GTM Editor, Ads Read-only — per group mapping. One group can grant different roles in different products.

Works with the tools you already use

RoleFlow connects to Google products through official, approved APIs. Your data never passes through a third-party intermediary.

Google Analytics 4

Google Analytics 4

Manages user access at the account and property level. When a group member is added or removed, RoleFlow updates their access across every GA4 property linked to that mapping.

Supported roles

Viewer Analyst Editor Admin

Your analysts always have GA4 access. Your former employees never do.

Google Tag Manager

Google Tag Manager

Manages container-level user permissions. RoleFlow adds or removes users from GTM containers as group membership changes, with the role you specify.

Supported roles

Read Edit Approve Publish

New developer joins the team, has GTM access by the time they open their laptop.

Google Ads

Google Ads

Manages user access at the account level. RoleFlow invites or removes users from your Ads accounts based on group membership, with the access level you define per mapping.

Supported roles

Read-only Standard Admin

Marketing team access managed from Workspace, not from the Ads console.

Simple, flat pricing

No per-user fees. A team of 20 or a team of 200 pays the same price.

Free

€0 / month

Try it before you commit.

  • 1 group mapping
  • GA4, GTM, and Google Ads supported
  • Manual sync (you trigger it)
  • 1 connected Google Workspace account
  • Standard support
Get Started Free

No credit card required.

Most popular

Business

€49 / month

or €490/year — save €98 (2 months free)

For teams that can't afford gaps in access.

  • Unlimited group mappings
  • GA4, GTM, and Google Ads supported
  • Automatic sync every hour
  • Multiple connected Google accounts
  • Audit log — see every access change
  • Priority support
Start Business Plan

Cancel anytime. No lock-in.

See full plan comparison →

Frequently asked questions

What Google accounts can I use to sign in?

Any Google account that has admin access to at least one Google Workspace organization. You sign in with your personal Google account (the one with admin rights), not a service account. Personal Gmail accounts (gmail.com) without a Workspace organization are not currently supported.

Do I need to set up a service account?

No. RoleFlow uses standard OAuth — the same sign-in flow you use for any other Google app. You authorize RoleFlow to act on your behalf for each product (GA4, GTM, Ads) separately. There are no service accounts, no downloaded JSON keys, and no delegated admin setup required.

What happens when I remove someone from a group?

On the next sync, RoleFlow removes their access from every product connected to that group mapping. On the Business plan, this happens automatically within the hour. On the Free plan, you trigger a manual sync. Either way, the removal is complete and covers all connected products at once.

Is my data secure?

RoleFlow is hosted on Google Cloud (europe-west1, Belgium). Your OAuth tokens are encrypted at rest using Google Cloud KMS. RoleFlow does not store any of your analytics data, tag configurations, or ad campaign data — only the group-to-role mappings you define and the user lists required to sync them. All data stays within the EU.

What is the difference between the Free and Business plans?

The Free plan supports one group mapping and requires you to manually trigger syncs. The Business plan removes both limits: you can create unlimited group mappings, and RoleFlow runs an automatic sync every hour in the background. Business also includes an audit log and priority support.

Can I use different Google accounts for each product?

Yes. RoleFlow connects each product (GA4, GTM, Google Ads) independently. You can connect GA4 under one Google account and Google Ads under a different account, as long as both accounts are authenticated in RoleFlow. This is common in agencies or larger organizations where product ownership is split across teams.

How often does auto-sync run?

On the Business plan, RoleFlow checks for group membership changes every hour. The first sync after a membership change typically completes within 60 minutes. On the Free plan, sync runs only when you manually trigger it from the dashboard.

Can I cancel anytime?

Yes. You can cancel from the billing section of your RoleFlow account at any time. If you cancel a monthly plan, it stays active until the end of the billing period. Annual plans are not prorated on cancellation, but you can cancel auto-renewal at any time to avoid the next charge.

What permissions does RoleFlow need?

RoleFlow requests only the permissions required to manage user access in each connected product:

  • Google Workspace: Read group memberships (no write access to groups)
  • GA4: Manage user access on your accounts and properties
  • Google Tag Manager: Manage user access on your accounts and containers
  • Google Ads: Manage user access on your accounts

RoleFlow does not request access to your analytics data, tag configurations, or campaign content.

Does RoleFlow modify my Google Groups?

No. RoleFlow only reads your Workspace groups to determine who should have access to connected products. It never adds, removes, or modifies members of your Google Groups. Your groups stay exactly as you manage them in Google Admin.

Start syncing access today

Free plan. No credit card required. Set up in under 10 minutes.

Get Started Free