During a recent compliance audit preparation, my team encountered a significant workflow bottleneck with OneTrust's evidence locker. While mapping our data retention requirements to the platform's capabilities, we discovered that the attachment feature for linking evidence to control assessments has a hard limit of 50MB per file.
This limit is not prominently documented in the standard user guides for the module we use. It only surfaces as an error when attempting to upload. For context, several of our evidentiary items—such as archived system audit logs, consolidated training completion reports, or video recordings of team training sessions—routinely exceed this size.
The immediate impact includes:
* Increased administrative overhead, as we now must segment large files or find alternative, external storage solutions.
* A broken audit trail, as the "official" evidence in OneTrust must then reference externally stored files, adding complexity and risk.
* Potential for non-compliance if the external storage link is broken or access permissions change over the multi-year retention period.
From a TCO perspective, this forces a reassessment. The cost isn't just the license fee; it's the labor for workarounds and the risk of audit findings. I'm curious if others have hit this ceiling and what their strategies have been. Has anyone successfully negotiated a change to this limit in their contract, or is this a fixed architectural constraint of the platform? Benchmarking against other GRC tools on this specific operational detail would be valuable for our upcoming renewal.
Buy once, cry once.
Oof, that sounds painfully familiar, just with a different platform. We hit a similar snag in our SOC2 prep with our GRC tool's 25MB limit.
That "broken audit trail" point is the real killer. It turns a managed compliance function into a manual file-wrangling exercise, and those external links *will* rot over a 3-5 year retention period. You start needing a separate system just to track where your evidence actually lives, which defeats the whole purpose.
It forces a messy choice: compress and split files, losing some fidelity, or pay for an entirely separate evidence repository that integrates back in. Suddenly that TCO calculation gets a lot more complicated.
K8s enthusiast
Exactly. The external link decay is the silent cost that never makes it into the initial vendor spreadsheet. We learned this the hard way after a Salesforce Files migration broke years of linked "evidence" in our instance.
The real metric isn't just the attachment limit, it's the platform's object storage durability and its actual API for bulk export. If you can't get a clean, verifiable dump of all attachments with their original metadata intact, you're building on sand. Suddenly your audit prep includes a side project to validate your own tool's integrity.
Show me the query.
That broken audit trail is such a critical pain point, and it's always underestimated. We hit this with a different vendor and ended up building a parallel registry in Airtable just to track where the actual, oversized evidence lived. It added so much manual sync work.
One thing we learned the hard way: before you commit to an external storage solution, you have to check if the GRC platform's API even allows you to *update* attachment links in bulk. If an external file moves and you have to manually re-link a thousand records, you're sunk. The integration has to be two-way.
Also, watch out for file type restrictions on top of the size limit - some platforms block certain archives or video formats even under 50MB. The TCO really does spiral when you factor in the middleware needed to keep it all glued together. 😩
Integration Ian
50MB is huge for a compliance artifact. That's a signal your evidence isn't granular enough.
> consolidated training completion reports
Why is this 50MB+? That's a data aggregation problem, not a storage problem. You should be attaching a sample and a query to regenerate the full dataset, not a monolithic blob. Same for logs - attach the log collector config and a query.
If you're storing video as direct evidence, you're doing it wrong. Store the attendance record and a hash of the video file. The video goes in durable cold storage.
The real issue is treating the GRC tool like a file dump. It's a metadata and verification system.
Least privilege is not a suggestion.