Google Drive

Proofroom reads policy documents kept in Google Drive with a service account that can only read: each document’s revision history and the approval of its linked Proofroom policy become evidence of the yearly review, who can edit it becomes an access list to review, and a Google Doc (or a Word, PDF or text file) can be imported as a Proofroom draft. Add it on Policies → Where your policies live → Google Drive → Connect.

What each collector shows

Google says the revision list of a frequently edited Google Doc may leave out older revisions; the evidence says so. Proofroom lists Google Docs, Word, PDF, markdown and text files.

Create the service account

1. In the Google Cloud console, pick (or create) a project and enable the Google Drive API.
2. IAM & Admin → Service accounts → Create service account (“proofroom-policies”). It needs no project roles.
3. Keys → Add key → JSON. Keep the file.
4. Give it access to the policies, one of two ways:
   • Share each policy folder or shared drive with the service account’s email as Viewer (simplest; it sees only what you share).
   • Or use domain-wide delegation: in the Google Admin console, Security → API controls → Domain-wide delegation, add the service account’s client ID with the scope below, and enter the Workspace user it acts as in Subject. It then sees what that user sees.

Scopes: https://www.googleapis.com/auth/drive.readonly reads document text for drafts. Untick Read document text to use https://www.googleapis.com/auth/drive.metadata.readonly instead: history and sharing only, no import.

Connect

Test connection lists the folders and shared drives the account can see.

Then, on Policies → Where your policies live → the connection: pick the folders or shared drives (five folder levels are read below each), press Check now, tick Track for each policy and link it to its Proofroom policy (links are suggested by title; press Use suggestion or choose one), and use Import as draft to start a Proofroom draft. The folder list shows each folder’s path. Drive records edits, not reviews, so a review is recorded in Proofroom: approve each linked policy once a year (with changes, or as reviewed with no changes). A tracked document whose policy was not approved in 12 months becomes a task; editing the document in Drive does not answer it.

A service account shared as Viewer may not see everyone a document is shared with. Check the first editor list against the document’s Share dialog; if it is short, use domain-wide delegation with a user who can share the documents.

Publishing approved policies back (optional, off by default)

When a linked Proofroom policy is approved, Proofroom can replace the Google Doc’s text with the approved version as a new revision. This needs write access, so it uses a second service account:

1. Create another service account (“proofroom-publishing”) with a JSON key. Share only the policy documents with it as Editor. It signs in with the scope https://www.googleapis.com/auth/drive, which reaches only what is shared with it.
2. On the connection’s settings, tick Publish approved policies and paste its key as the publish key.
3. With domain-wide delegation, the publish key must not act as the read user (who can see far more than the policy documents). Create a separate Workspace user for publishing, give it Editor on the policy documents only, allow the publishing service account’s client ID the scope https://www.googleapis.com/auth/drive in Domain-wide delegation, and enter that user as the publish user. Proofroom refuses to publish with delegation until a separate publish user is given.

Only Google Docs are published to. The revision Proofroom writes is not counted as a change in Drive. A failure is shown on the document and retried daily.

After the first run

• Compare the revisions in the evidence with File → Version history in the Google Doc.
• Compare the editor list with the document’s Share dialog.