I've been running Secureframe for our SOC 2 Type II audit preparation for about eight months now. Overall, the platform does an adequate job of corralling the usual evidence collection chaos, but I've hit a rather significant and frankly baffling gap that makes me question the depth of their so-called "automated" compliance.
The specific issue is with the Google Workspace integration. It dutifully pulls in user accounts, group memberships, and even some calendar sharing settings. However, it appears to be completely blind to the actual file-sharing audits for Google Drive. This is not a minor oversight. The entire point of evidence collection for access controls (CC5 series, anyone?) is to demonstrate that you can review and attest to who has access to what sensitive data. Knowing user lists is trivial. Proving you have a process to audit who outside the organization can read a financial model in Drive or a design spec in Sheets is the meat of the control.
When I reached out to support, the initial response was the standard "our engineering team is aware and working on it." After pressing, the conversation shifted to, "you can use our manual evidence upload for those reports." Let's dissect that for a moment. The primary value proposition of a platform like Secureframe is to reduce manual toil. If I am required to log into the Google Admin Console, navigate to the security center, run the Drive log exports, filter them, and then manually upload a CSV every month, I have just re-invented a manual process and paid a premium for the privilege. The total cost of ownership calculation starts to look rather poor when core evidence for a critical control requires a full manual workaround.
This leads me to a broader concern about vendor lock-in and integration depth. It's easy for these platforms to claim hundreds of integrations, but if they are only scraping surface-level API data and missing the operational audits that actually matter, you're left with a false sense of security. You might pass an audit once with manual uploads, but you've failed to build a sustainable, automated process. I'm now evaluating whether we need to build our own scripted audit for Drive and use Secureframe merely as a document repository, which would be a significant devaluation of the service.
So, my question to the community: is this a known limitation for others? Has anyone gotten a straight answer from Secureframe on if and when true file-sharing audit trails will be part of the Google Workspace integration, or is this a fundamental architectural oversight? I'm particularly interested if those undergoing or who have completed their audits had to manually supplement this evidence and how an auditor reacted to a mix of automated and manual evidence within the platform.
Just my two cents
Skeptic by default
Oh, I absolutely feel your pain on this one. That shift in support responses, from "we're aware" to "just upload it manually," is such a classic deflection move. It basically turns their "automated" feature into a glorified folder structure where you're still doing all the heavy lifting.
For a SOC 2 audit, especially Type II, the audit trail *is* the control. Manually exporting those Drive sharing reports and uploading them monthly is a huge, fragile process that defeats the entire purpose. You're right to question the depth - if they can pull calendar sharing, why is Drive sharing, which is arguably more critical, a blind spot?
Have you noticed if this gap also applies to external shares via Google Groups? I've seen that trip people up, where a file is shared with a group email, and the integration only sees the group, not the nested member access. It makes proving least privilege a nightmare.
test everything twice
That pivot from "we're aware" to "just upload it manually" is the precise moment a compliance tool stops being a platform and becomes a liability. The manual upload workaround creates a separate, unsynchronized evidence chain that most auditors will immediately flag, as it's now your word that the uploaded report is current and complete, not a system of record.
The core problem is likely the Admin SDK API data gap. The Reports API provides activity logs, but the Drive audit data for *current permissions* resides in a different silo, requiring separate scopes and handling for shared drives versus My Drive. It's a known, tedious integration challenge many vendors gloss over.
Have you verified whether the missing audits are just for external user shares, or does it also fail to capture internal sharing changes? That distinction often points to which specific API calls their connector is neglecting.
Measure twice, cut once.