Polara Labs Logopolara labsBack to Home
Read-only integration

Connect Google Cloud to Polara

Read-only OAuth connection. Nine evidence types collected automatically across every accessible project: IAM bindings, service accounts, org policies, audit-log config, logging sinks, storage encryption, KMS keys, and Compute instances.

One connection covers both. Google Cloud and Google Workspace share a single Polara connection. Connecting either grants both. If you only use Google Cloud, untick the Workspace scopes on the consent screen and Polara skips the Workspace-only evidence.

Go to dashboard to connect

What we collect

Nine evidence types map to the AICPA Common Criteria controls in your SOC 2 report. Same set every sync, no extras.

EvidenceWhat it showsSOC 2 controls
IAM members
gcp:iam:members
Project-level IAM policy bindings, showing which roles are granted to which members.CC6.1, CC6.3
Service accounts
gcp:iam:service_accounts
Privileged non-human inventory: service accounts per project, with disabled status.CC6.1, CC6.3
Org policies
gcp:org:policies
Organization policy constraints in effect on each project.CC6.1, CC6.6
Audit logs config
gcp:audit_logs:config
Cloud Audit Logs configuration per project, covering admin-read / data-access log types.CC7.2
Logging sinks
gcp:logging:sinks
Log sinks per project, with centralized log export destinations and filters.CC7.2
Storage buckets
gcp:storage:buckets
Cloud Storage buckets with default encryption (CMEK vs Google-managed).CC6.7, CC6.8
Cloud KMS keys
gcp:cloudkms:keys
Customer-managed Cloud KMS crypto keys across every key ring and location.CC6.7
Compute instances
gcp:compute:instances
Compute Engine VMs per project with shielded-VM and disk-encryption status.CC6.6, CC6.7
2SV status (Cloud Identity)
gcp:org:2sv_status
Cloud Identity 2-Step Verification posture, used when Workspace is not connected.CC6.1, CC6.2

Permissions we request

All scopes are read-only.

Polara never writes to your projects, IAM policies, or resources. No modifications, no deletions, no admin actions. Polara only reads the configuration needed for your SOC 2 evidence.

OAuth scopeWhy we need it
cloud-platform.read-onlyRead IAM bindings, service accounts, org policies, audit-log config, storage buckets, KMS keys, and Compute instances across your projects.
logging.readRead Cloud Logging sink configuration to evidence centralized log export.
cloud-identity.groups.readonlyRead Cloud Identity groups to evidence 2-Step Verification posture when Workspace is not connected.

The same consent screen also requests three Google Workspace scopes. If you don't use Workspace, untick them. Polara only collects the GCP evidence above.

How to connect

Three steps. About a minute start to finish.

  1. 1

    Click Connect in Polara

    On your Integrations tab, click Connect on the Google Cloud card. A disclosure modal lists exactly what Polara will read, for both Google Cloud and Workspace.

  2. 2

    Authorize with Google

    Google opens a new tab with the consent screen. Sign in with an account that has read access to your Google Cloud projects. If you don't use Google Workspace, untick the Workspace scopes. Polara will skip the Workspace-only evidence.

  3. 3

    Click Allow and come back

    Review the read-only scopes, click Allow, and Google redirects you back to Polara. The Google Cloud card flips to Connected and the first sync starts automatically.

How to disconnect

Disconnecting in Polara revokes the Google OAuth grant and stops future evidence pulls. Because Google Cloud and Workspace share one grant, disconnecting either one revokes the shared token. If you have both connected, you'll need to reconnect the other.

  1. In Polara: dashboard → Integrations tab → Google Cloud card → Disconnect.
  2. Optionally, also review and revoke at myaccount.google.com/permissions under Google Account → Security → Third-party access.

Note: previously collected evidence stays attached to your assessment for audit reproducibility. Future syncs simply stop once the grant is revoked.

Troubleshooting

Polara shows "waiting" for more than 2 minutes after I clicked Continue.▾
Make sure you finished the consent in the other tab and clicked Allow. Then click Refresh in the Polara modal. If the card still doesn't flip, close the modal and click Connect again. The OAuth flow is idempotent.
Some of my projects show no evidence.▾
Polara collects evidence for the first 100 accessible projects per sync, and only for projects where the connecting account has read access and the relevant APIs are enabled. If a project is missing, confirm the account's IAM role and that Cloud Resource Manager / IAM / Storage / KMS / Logging / Compute APIs are enabled on it.
The consent screen warns the app is unverified.▾
Polara's Google integration uses a restricted scope (Workspace audit logs) that goes through Google's verification review. If you see an "unverified app" warning, verification is still in progress. Contact founder@polaralabs.com and we'll confirm status.

Ready to connect?

About a minute from here. Polara handles the rest.

Go to your dashboard
polara labs

Polara Labs builds both sides of the audit: the readiness platform startups use to earn a SOC 2 report or an ISO 27001 certificate, and the practice OS audit firms use to run the examination. Every price is published on the page it belongs to.

© 2026 Polara Labs Inc. All rights reserved.Contact: founder@polaralabs.com

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms in our network; the audit opinion is theirs alone and is not regulated by Polara Labs. We generate custom policies, evidence checklists, and remediation guidance. You remain responsible for implementing controls and owning audit outcomes. Replace placeholders with your actual controls and have final documents reviewed by qualified professionals before your audit.