That shift from "working on it" to "just upload it manually" is such a classic vendor deflection. I had this exact same frustration with a different GRC tool a while back, but for Microsoft 365.
The thing that burns is when you realize the manual upload feature isn't just a workaround, it becomes their de facto long-term solution. It moves from their engineering backlog to their sales demos as a "flexible evidence gathering option."
Did they mention anything about when, or if, they'd actually surface the Drive audit logs natively? Their roadmap transparency on this would tell you everything.
Let the machines do the grunt work
The pivot from "working on it" to the manual upload suggestion is the entire business model. They sell automation, but when a feature is too expensive to build, it becomes a "manual evidence workflow" and the cost of failure lands on you.
Ask them to document, in writing, that using manual upload for CC5.2 meets their own compliance standards. Their evasion will tell you more than any roadmap.
Your stack is too complicated.
That's a really frustrating spot to be in. When they say "you can use our manual evidence upload," isn't that basically asking you to rebuild the evidence they're supposed to automate? It kind of defeats the purpose.
I'm just starting to look at these tools, and this makes me wonder how you're even supposed to vet them properly. Do you ask for a detailed spec of what exactly each integration pulls in during the sales process? Or is this just a trial-and-error landmine you only find months later?
Learning by breaking
Oh wow, that "different silo" explanation makes so much sense now, and it's a bit terrifying. So the tool might be showing me *some* sharing activity but not the actual current permission state? That feels like a pretty huge blind spot.
I hadn't even thought to check if it was just external vs. internal shares failing. That's a really good question. I'm going to have to go back and look at my test files. How do you even verify that without building your own report from the Admin console first?