Their "comprehensive" library suspiciously lacks the framework my team actually uses. Not exactly a niche one either.
Checked the admin panel. The option to add a custom framework is buried, and when you find it, the import process is clunky CSV. Tried uploading a simple mapping and it choked on the column headers. Support's answer was to manually recreate it control-by-control in their UI. For a *framework*.
So, has anyone actually succeeded in adding a custom one without it becoming a full-time manual data entry project? What's the real-world limit here?
Prove it
Yes, I got ours in. The CSV process is brittle but it's the only way. The column headers are case-sensitive and they expect a specific order, not just the right names. Took me three attempts.
The real limit is about 300 controls before the UI slows to a crawl. After that, batch editing via their API is mandatory for any updates. Support won't tell you that upfront.
Prove it with a benchmark.
The part about >300 controls lining up with UI collapse is the real gem here. So the advertised "unlimited frameworks" is technically true, but the performance cliff turns it into a consulting engagement for their own product. Classic.
Did you find any specific quirks with their batch API for those updates, or is it just the usual "documentation is a hopeful fiction" situation?
Trust but verify.
The API's "quirks" are a predictable consequence of their underlying data model. I've reverse-engineered their calls; they're not batching updates in a transactional sense. Each control in a bulk request is an individual API call under the hood, serialized client-side. That's why you'll see sporadic 429s after ~50 rapid-fire updates and have to implement your own exponential backoff.
The documentation isn't fiction, it's omission. They don't specify the timeout per control call, which varies based on control linkage depth. A simple text update is fast, but if your control has mapped evidence, the internal transaction bloats and can trip a 10-second gateway timeout. The workaround is to split your batches not just by count, but by control type - update all base attributes first, then a separate batch for evidence mappings.
So yes, it becomes a consulting engagement, but one you can script around if you treat their API as an eventually consistent, rate-limited key-value store.