OAuth evidence connectors: Drive, SharePoint, GitHub, Jira

Beyond uploading files by hand, Veritome can pull proof in from the tools your teams already use. Open the Evidence hub and click Connectors.

The four connectors

Google Drive, SharePoint / OneDrive, GitHub and Jira — all read-only OAuth connections. A connector pulls the most recent items (about 25 per sync) and turns each into a Connected evidence record pointing at the item's URL. Records are de-duplicated on organisation, connector and URL, so a re-sync refreshes rather than duplicates.

Read-only is a design rule, not a default: the scopes requested are the providers' read scopes (Drive read-only; Microsoft Graph file and site read; Jira work read), the connectors never write back, and tokens are stored AES-256-GCM encrypted. One caveat is GitHub's: a classic OAuth app cannot grant read-only access to private repositories, so the GitHub connector requests repository scope and only ever reads repository metadata.

Connecting

1. On the Manage plan, signed in as an organisation Admin, open the connectors panel and click Connect on a provider.
2. Complete the provider's OAuth consent screen. The flow is protected with a signed state parameter, and the callback checks that the same organisation admin came back.
3. Run Sync now to bring in recent items as evidence. They arrive as Verified URL records — the connector's read of the item is the verification — and you attach them to obligations like any other record.
4. Disconnect any time. The token is deleted; evidence already synced stays.

Access tokens are refreshed automatically where the provider supports it; a revoked grant surfaces as reconnect on the next sync. Connecting, syncing and disconnecting are audit-logged.

After the sync

Connected records are URLs, so the weekly link check re-verifies that each one still resolves, and the evidence freshness rules apply to them as to everything else — a record with an expiry date turns expiring and then expired on its own. See The Evidence hub for coverage, uploads and freshness.

A connector only appears as connectable when this deployment has that provider's OAuth app configured. Otherwise it is shown as "planned / needs setup" rather than as a button that fails. Connecting and syncing is limited to organisation admins.

Directory integrations

The Integrations page under Organisation lists the broader roadmap — identity providers (Okta, Azure AD, Google Workspace), document storage, and task tools (Jira, ServiceNow, Monday.com). Everything there is planned, not yet connectable; the live connectors are the four OAuth evidence connectors above, in the Evidence hub. For single sign-on and automatic provisioning, see Set up SSO and SCIM provisioning; for programmatic access and event push, see API keys and organisation data export and Webhooks.