OAuth evidence connectors: Drive, SharePoint, GitHub, Jira

Beyond uploading files by hand, Veritome can pull proof in from the tools your teams already use. On the Evidence hub, the Bring evidence in automatically bar opens the connectors — press All connectors, or one of its chips.

The four connectors

Google Drive, SharePoint / OneDrive, GitHub and Jira — all read-only OAuth connections. Each item a connector brings in becomes a Connected evidence record pointing at the item's URL, pending review. Records are de-duplicated on organisation, connector and URL, so bringing an item in again refreshes it rather than duplicating it.

• Google Drive is picker-only: you choose the files in Google's own picker — My Drive, folders and shared drives — and only those files are read. The connection asks for access to the files you pick and nothing else in your Drive.
• SharePoint / OneDrive, GitHub and Jira sync: Sync now pulls the most recent items (about 25 per sync) — recent documents, recently updated repositories, recently updated issues.

Read-only is a design rule, not a default: the scopes requested are the providers' narrowest read scopes (Drive per-file access; Microsoft Graph file and site read; Jira work read), the connectors never write back, and tokens are stored AES-256-GCM encrypted. One caveat is GitHub's: a classic OAuth app cannot grant read-only access to private repositories, so the GitHub connector requests repository scope and only ever reads repository metadata.

Connecting

1. On the Manage or Enterprise plan, signed in as an organisation Admin, open the connectors and click Connect on a provider. Connectors are not part of the free public beta.
2. Complete the provider's OAuth consent screen. The connection flow is protected against cross-site request forgery and is tied to the admin who started it.
3. Bring items in. For Google Drive, press Choose files and pick the documents; each lands as connected evidence pending review, like any other record. For the others, press Sync now; synced items land the same way, as connected evidence pending review. A connector reading an item proves the item exists, not what it proves, so a person reviews it before it is accepted — a sync never accepts evidence on anyone's behalf, and a re-sync refreshes the title without changing a record's status or review. Either way you attach them to obligations like any other record. An Admin or a Compliance manager can bring items in once a connector is connected.
4. Disconnect any time, after a confirmation. The token is deleted; evidence already brought in stays in your library.

Access tokens are refreshed automatically where the provider supports it; a revoked grant surfaces as reconnect on the next attempt. Connecting, choosing files, syncing and disconnecting are audit-logged.

After the sync

Connected records are URLs, so the weekly link check confirms that each one still resolves. That is link health, not review: a broken link drops the record back to pending, and a resolving one is never marked accepted by the check — only a person's review does that. The evidence freshness rules apply to them as to everything else — a record with an expiry date turns expiring and then expired on its own. See The Evidence hub for coverage, uploads and freshness.

Connectors not yet available to your workspace are shown as planned rather than as a button that fails. Connecting is limited to organisation admins.

The Integrations tab

Organisation → Integrations points rather than connects: the four evidence connectors link to the Evidence hub, where they are connected; the identity providers (Okta, Microsoft Entra ID, Google Workspace) link to SSO & SCIM, where sign-in is configured; and the task tools (ServiceNow, Monday.com) are marked coming soon — planned, not connectable. For single sign-on and automatic provisioning, see Set up SSO and SCIM provisioning; for programmatic access and event push, see API keys and organisation data export and Webhooks.