DoControl Reviews & Product Details

Some background: we’re roughly 2,500 employees at an insurance company, and most of our data lives in Google Workspace, Slack, and Salesforce. We assumed our sharing hygiene was pretty decent, but DoControl’s initial scan showed otherwise—around 10,000 files were shared outside the company, with some of those shares untouched since 2019. We even found files still being shared by employees who left in 2019, and those links were still live. That was honestly the wow moment. You connect Google Workspace and, about an hour later, you’re looking at every overshared file across the company, sortable by owner, department, and sensitivity. Review collected by and hosted on G2.com.

The first dashboard view is a lot to take in. Honestly, without the onboarding sessions, new admins tend to flail for about a week before they find their footing. In our case, the per-user model also means that every hiring wave pushes the bill up, so it’s something to keep in mind. My one tip is to plan for that during the budget cycle so it doesn’t catch you off guard. Review collected by and hosted on G2.com.

We’re roughly 850 employees in consumer electronics, and most of our data lives in Microsoft 365, Salesforce, and Teams. Within a weekend of connecting Microsoft 365, Salesforce, and Teams, DoControl surfaced exposure we’d been guessing about for years. The guessing is over. The numbers were a lot worse than we assumed. The exposure query builder is the standout: I can ask, “Show me everything Customer Success shared externally last quarter,” and get an answer right away not a ticket. Review collected by and hosted on G2.com.

In our case, it won’t manage SaaS licenses or handle IT lifecycle work. For us, that falls into a different tool category, but people keep asking about it. Review collected by and hosted on G2.com.

Measured outcome: in the last quarter, 52% of our sharing-policy violations were resolved by the employee who caused them, after the Slack bot asked them to confirm or undo the action. My analysts never touched those tickets. The bot also collects business context when someone genuinely needs the share, which gets attached to the event for our records. Security awareness went up as a side effect, because people learn the policy at the moment they break it, not in an annual training video nobody watches. Review collected by and hosted on G2.com.

Bot message templates need more localization options for our non-US offices. And when an employee ignores the bot, escalation logic works but the reporting on those escalations could be clearer. Review collected by and hosted on G2.com.

We ran BetterCloud for IT automation and it did that job fine, but when leadership asked who could see our sensitive files and what random apps were connected to our domain, BetterCloud's answers were shallow. DoControl answers those questions in depth: per-file exposure, per-user behavior, per-app risk scores, plus the context from Okta and our HRIS to tell an accident from a threat. The workflows aim at security outcomes, not admin busywork. Migration of our policies took about three weeks. Review collected by and hosted on G2.com.

It will not manage licenses or offboard a user across 40 apps the way an SMP does, so do not expect that. We kept a lighter tool for lifecycle work. Also, the pricing conversation required executive involvement; this is not a swipe-the-card purchase. Review collected by and hosted on G2.com.

Automated remediation. We can create policies that detect risky sharing or access and automatically remove permissions instead of creating another ticket for someone to investigate manually. Review collected by and hosted on G2.com.

It doesn't have a completely built out misconfigurations module compared to some other more traditional SSPMs on the market. My account manager told me this feature is newer and it was an added part of the product so just be aware of that if that is important to you. Review collected by and hosted on G2.com.

Provides excellent visibility into how data is shared and accessed across different SaaS applications. It has made it much easier to identify unnecessary permissions and monitor external sharing. Good at detecting potential security risks. In addition, automated remediation capabilities help us resolve access related issues without extensive manual intervention. The centralized dashboard has made monitoring and managing data security much more efficient. Review collected by and hosted on G2.com.

No worries less a bit of a learning curve when getting familiar with the different features and configuration options. I think some settings could be more intuitive. Also they can work on reporting capabilities enhancement to provide more flexibility and detailed insights. Review collected by and hosted on G2.com.

Within a single morning of connecting Google Workspace and Slack, DoControl surfaced exposure we’d been guessing at for years. The guessing is over. It was honestly a real wow moment: you connect Google Workspace, and about an hour later you’re looking at every overshared file in the company, with the ability to sort by owner, department, and sensitivity. Review collected by and hosted on G2.com.

UI updates have now wiped out my saved filters twice. Review collected by and hosted on G2.com.

DoControl was developed to assist organizations in gaining increased insight into the use of cloud applications and access to data. DoControl provides organizations with an opportunity to see what types of third-party applications have been utilized by employees, what types of OAuth permissions are currently being used, and when employees share files externally without need. These features provide a good option for organizations to use when trying to gain greater visibility into the use of cloud applications and how employees are accessing data. Review collected by and hosted on G2.com.

The platform may be able to increase the transparency of the risk scoring methodology, allowing customers to gain a greater understanding of how applications are assessed. Some customers have expressed concerns about limited integration options with small-scale SaaS applications, as well as deficiencies in the scope of the compliance framework. A streamlined dashboard and additional documentation regarding the onboarding process would enhance the user experience. Review collected by and hosted on G2.com.

The push into governing AI tools and non-human identities has been the biggest positive for us recently. We had a ton of employees jumping into Google Workspace AI features and custom gems, and DoControl rolled out discovery and posture controls for that pretty much right away, so we could see if custom prompts or sensitive drive context were being exposed externally without having to block the tools entirely. Also really liking the updates they made to the data scanning engine within workflows. It used to feel a bit too reliant on basic regex triggers which gave us false positives on internal spreadsheets, but the newer contextual inspection handles sensitive data flags much better. The end-user bot notifications in Slack have also gotten smoother—our users can actually confirm or expire their own external shares directly instead of filing a helpdesk ticket with SecOps every single time, which saved us a ton of back-and-forth noise. Review collected by and hosted on G2.com.

The initial policy builder and alert threshold tuning definitely took longer than expected to dial in. When we first turned it on, the volume of alerts for routine sharing was pretty overwhelming, and we had to spend a solid three or four weeks tweaking regex patterns and building out exclusions so we weren't drowning in notifications. The workflow canvas is powerful, but the UI can get a bit clunky and unintuitive when you're trying to chain together multi-step branching logic or complex conditions across different departments. Another thing is the disparity between supported connectors. Their depth for Google Workspace, Slack, and Salesforce is super thorough, but coverage for smaller, niche SaaS tools or more granular misconfiguration checks on secondary apps feels a bit shallow by comparison. Also, while the risk scoring is generally solid, it can occasionally feel like a bit of a black box where it's hard to tell why one specific action triggered a high-severity score over another similar one without digging into the raw event logs. Review collected by and hosted on G2.com.

Speed to value was the big win for us. We connected Google Workspace on a Tuesday, and by Thursday we already had a full inventory, exposure numbers, and our first workflows running. There were no agents, no proxies, and no six-week professional services engagement to get started. We’re a consumer brand with a tiny security team, and the pre-built playbooks cover our main risks: external shares, public links, departing employees, and sketchy OAuth apps. The Slack bot also takes care of the long tail of employee mistakes, which helps the two of us stay focused on the real threats. Review collected by and hosted on G2.com.

The pricing feels geared toward larger companies than ours, and I had to push hard to get the budget approved. Some of the dashboards also seem to assume you have a SOC running in shifts, which we don’t. Still, these are minor gripes considering what we get overall. Review collected by and hosted on G2.com.