Google Drive Integration

Which Drive content is scanned?

Cremit uses the authorizing Google account’s OAuth access. It discovers that account’s My Drive and shared drives visible to it, then creates separate scan targets. My Drive listing currently filters to files owned by the connected account; it is not a scan of every file shared with that user. A shared drive must be visible to the account and enabled as a target. Discovering a drive does not prove that every file was inspected.

The worker exports Google Docs, Sheets and Slides as text or CSV and reads supported text-like uploaded files. It excludes media and unsupported Google file types, and may skip files because of format, size, scan rules, download or permission errors. It does not extract the contents of every uploaded PDF, Office file, archive or image. A job processes at most 500 listed files and saves progress for later work. Incremental checks use Drive modification times only after the initial scope has completed cleanly.

Connect and select targets

In Cremit Platform, open Configuration → Scan Sources → New, choose Google Drive, enter a label and start the OAuth connection. Review the requested read scope on Google’s consent screen. The current creation form does not choose a shared drive, My Drive or a folder subtree. After authorization, review the discovered drive targets and enable only the ones you intend to scan.

You do not need to upload a service-account key for this connection. A Workspace super-admin account is not inherently required; access depends on the account that grants OAuth consent and on Workspace policy. If an intended shared drive does not appear, check that account’s membership and visibility before assuming the scan covers it.

Verify coverage and respond

Put a harmless test string matching an enabled rule in a small, supported text file on an enabled drive. After a scheduled job completes, inspect the target status, finding location and skipped or failed items. Remove the test string afterward. A Connected label, recent timestamp or initial finding is not proof that all files or future edits have been checked.

For a real exposed credential, identify the workload owner and rotate or revoke it at the issuer after checking dependencies. Removing the file or text from Drive does not invalidate the credential.

Primary documentation

Google shared-drive listing

Google Drive download and export

Cremit scanning flow