How to Disconnect an AI Tool You Stopped Using
Cancelling an AI tool and revoking its access are two different systems, and doing the first often leaves the second running against your calendar or repository.
Deleting your account on an AI tool does not revoke its access to your data. Those are two separate systems, and cancelling the first frequently leaves the second running. The tool keeps a valid token against your Google Workspace, your Slack, your repository or your calendar, and that token goes on working long after you stopped thinking about the product.
Revoking properly takes about ten minutes and has to happen in a particular order, because doing it the obvious way leaves the thing you most wanted to remove.
Why cancelling is not revoking
When you connected the tool, you granted it an OAuth token at the provider, not at the tool. The grant lives in Google's account settings, in your Slack workspace's app list, in GitHub's authorised apps page. The vendor's own account page may have a disconnect button, and it may even work, but it is the vendor asking themselves nicely to stop.
If the vendor's disconnect is broken, or their account deletion is a soft delete, or the company is acquired and the infrastructure changes hands, the grant at the provider is what still governs access. That grant is the thing to kill.
The same applies in reverse for keys you issued. An API key you pasted into a tool two years ago is a credential you created, sitting in a system you no longer monitor, and no amount of account deletion on their side retires it.
Do it in this order
The order matters because each step removes a way the next one could be undone.
Revoke the grant at the provider. Google: Account, Data and privacy, Third-party apps and services. Microsoft: My Account, Apps and services. Slack: workspace Manage apps. GitHub: Settings, Applications, Authorized OAuth Apps. Remove it there first. This is the step people skip and it is the only one that is definitive.
Rotate or delete any API keys you gave it. In the provider's console, not in the tool. If a key was shared with other integrations, rotate it and update the others rather than deleting. Anything the tool holds stops working immediately, which is the point.
Delete webhooks and callback URLs. These survive OAuth revocation in several systems, and a live webhook keeps pushing your events to an endpoint you no longer control. Check your repository settings, your payment processor, and anywhere you set up a notification.
Remove scheduled jobs and automations that call it. A cron job or workflow step that posts to a now-dead integration fails quietly and can keep sending payloads outward while it does.
Now request data deletion from the vendor. Only now, because asking first gives a vendor with sloppy processes a window in which they are deleting records while their integration is still pulling new ones.
Remove the user accounts. Yours and anyone else's on the team. On a team plan, your own departure does not remove colleagues who connected their own accounts, which is how an integration you believe is gone keeps reading somebody else's inbox.
The ones that are easy to miss
Five places access hides after a tidy-up:
Browser extensions. Installed once, still running, often with permission to read every page. Check the extension list, not just the tool's website.
Email forwarding rules and filters. Some tools set one up during onboarding. It persists after the integration is removed and it is almost never noticed.
Calendar meeting bots. A notetaker that was invited by a rule rather than by a person will keep joining meetings from whatever account created the rule.
Shared drive permissions. A service account added as a viewer on a folder does not appear in your app list at all. It is in the folder's sharing settings.
Connected accounts inside other tools. Chained integrations, where tool A has access via tool B, do not appear under the provider's app list for A.
That last category is the one worth a deliberate look, and it is the same blind spot that makes broad OAuth scopes expensive later. The permission you granted once is not the permission you are living with now.
Check that it actually stopped
Do not assume. Two cheap verifications:
Look at the access logs on the provider side a day later. Google Workspace, Microsoft 365 and GitHub all expose recent access by application. If the tool still appears after you revoked, something was reconnected or there was a second grant, which happens when more than one person connected it.
Check your own billing. A tool still charging you is a tool with a live account, whatever the cancellation page said.
Keep a line in your records of what you removed and when. If a vendor later has a breach, the question "did we still have an active connection in March" is one you want to answer from a note rather than from memory. Our guide on keeping an audit trail of AI use covers a format that takes no real effort to maintain.
Do it on a schedule, not on an incident
The reason zombie integrations accumulate is that connecting is a thirty-second decision and disconnecting is a task nobody owns. Two habits fix it at low cost.
Once a quarter, open the third-party app list on each major provider you use and remove anything you do not recognise or no longer use. It takes ten minutes and it is usually surprising the first time. Pair it with an audit of what you are paying for, because the two lists overlap heavily and you will find tools you are funding and not using.
And when someone leaves, run this process for their connections, not just their account. Offboarding from AI tools misses the grants they made from personal sessions unless you look for them specifically. The same applies when a contractor's engagement ends.
None of this is dramatic. It is the unglamorous half of managing AI risk, and it is the half that actually reduces the number of systems that can leak.
FAQ
If I delete my account, is my data deleted too?
Not necessarily, and not usually straight away. Most vendors retain data for a stated period after deletion, and backups commonly persist longer. Ask for deletion explicitly and check the retention policy rather than assuming.
Does revoking OAuth delete the data the tool already collected?
No. Revocation stops future access. Past data is governed by the vendor's retention policy and by any deletion request you make, which is why step five exists and why it comes after revocation.
What if the tool has no disconnect option?
Revoke at the provider. You never need the vendor's cooperation to withdraw a grant you made, which is the main argument for doing it in that order.
How do I find integrations I have forgotten about?
Start with the third-party app list on each identity provider you use, then your password manager, then your card statement. Between those three, very little hides.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
