The beauty of cloud is that users can easily download and install lots of cool applications — from a variety of app stores. The danger of cloud… is also that users can easily download and install lots of cool applications from a variety of app stores. That freedom of choice is a nightmare for IT shops in this bring-your-own-device (BYOD) era.

The company says CloudLock Apps Firewall can help guide organizations to discover, classify and safely enable third-party mobile and web apps that require access to users’ Google Apps data. It can assess existing applications and categorize them as trusted, not trusted or banned. Then it can automate the remediation of those applications.

Google Apps for Business is getting traction both in startups and in more established larger companies even as Microsoft pushes its rival Office 365 suite. Last week, Cloud Sherpas, a systems integrator and VAR, said its revenue from Google Apps-related business more than doubled last year

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• What Enterprise Software Vendors Could Learn from the Consumer Space
• A near-term outlook for big data
• Quality of the cloud: best practices for ISVs

CloudLock CEO Gil Zimmermann

CloudLock, the Waltham, Mass.-based startup specializing in cloud security, says it’s bringing PCI compliance to Google Drive storage with a service that scans data as it flows into and out of the data repository.

The growing popularity of cloud-based storage services such as Google Drive  worries IT professionals. Their concern is not only about the security of the storage repository itself but about the sort of information employees put in it. Obviously, credit card numbers and personally identifiable information (PII) top the list of the types of sensitive data they don’t want flowing into and out of the public cloud. PCI is the standard for handling credit card transactions securely.

CloudLock CEO Gil Zimmermann says the company’s new scan, available as a service, uses its own pattern recognition engine to help put these fears to rest.

“We address the customer access piece of the puzzle. What is being shared, how it’s being shared both outbound and inbound. And we provide a single-pane view of all the organizational data that lets administrators set policies,” Zimmermann said in a recent interview.

Using its pattern recognition expertise,  CloudLock scans the information flowing into and out of Google Drive, flagging instances where it includes credit card or social security numbers.  Business customers can set policies to prevent that from happening.

CloudLock reaches into the customer’s Google Drive account using Google APIs. “The data streams to us, we analyze and flag it, and the data never leaves the App Engine. Since our application is built on Google App Engine, think of our app as running on top of the customer’s environment. That way, we use Google’s APIs to analyze data without it ever leaving App Engine,” according to a spokesman.

Competitors include BetterCloud’s Domainwatch and offerings from the big legacy security vendors like Symantec and McAfee.

The company targets larger enterprises and  claims 1 million end-users under license and an average deployment size of 2,200 seats per customer. CloudLock closed $8.7 million Series B funding in March to build out its cloud security solutions, which already covered the Google Apps productivity applications.

Given what’s going on in public cloud storage — with Microsoft Azure, Amazon and Google duking it out for consumer and business users alike — the need to bolster security across the entire process will only grow.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A field guide to cloud computing: current trends, future opportunities
• Microsoft Azure: What It Is, What It Costs and Who Should Care
• Who Owns Your Data in the Cloud?