When a file containing credentials or customer PII lands in a public Slack channel or gets shared outside our approved domains, DoControl can quarantine it or strip the share in real time instead of opening a ticket for a human to handle hours later. The classification is good. It uses our HRIS data, so it knows a contractor from an employee, and it knows which external domains are our partners versus random Gmail. That context is the difference between a DLP people work around and one they barely notice. Review collected by and hosted on G2.com.

Alert tuning took about a month of weekly adjustments. The default thresholds were too sensitive for a company our size. Also, custom keyword lists and regex management could use a friendlier interface; right now it feels built for engineers. Review collected by and hosted on G2.com.

Scale. We are a global payments company with an enormous Google Workspace and Microsoft 365 footprint, and most tools we piloted choked during ingestion. DoControl indexed everything and stayed fast. Queries over our asset inventory return quickly, and bulk remediations that touch six figures of files complete in minutes. The architecture was clearly built for Fortune-scale data. Support is strong too; our customer success engineer knows our environment better than some of our own staff. Review collected by and hosted on G2.com.

Enterprise procurement is a slog, but that is on us as much as them. The product itself: misconfiguration management lags the data side in maturity, and I want more granularity in admin roles for a global team with regional data restrictions. Review collected by and hosted on G2.com.

Schools run on temporary labor: substitutes, consultants, coaches, contractors. They all got access to shared drives with their personal Gmail accounts, and when they left, the access stayed. DoControl flags every share to a personal domain, ties it to HR data, and our workflow now revokes access automatically when someone leaves the district. We also use it to keep students out of faculty content in our shared tenant. The district's exposure dropped over 90% in the first semester, and I did not hire anyone. Review collected by and hosted on G2.com.

Honestly, the hardest part was change management with principals, not the product. On the product side, I would like simpler reporting aimed at school boards rather than security professionals. Review collected by and hosted on G2.com.

The non-human identity angle. We have internal AI agents and copilots touching Google Drive, and until DoControl we had no way to tell a human reading a file from an agent bulk-reading a folder outside its normal pattern. It inventories them alongside OAuth apps, scores them, and flags anomalous access. The identity threat detection baselines per user and per team are solid for humans too. Their newer AI assistant, Dot, is genuinely useful for investigation: I asked it which departing employees had downloaded more than 100 files in their last 30 days and got an answer in seconds. Review collected by and hosted on G2.com.

The AI agent governance module is young. Detection logic for agent behavior needs more tuning knobs, and documentation trails the feature releases. Dot occasionally needs a question rephrased before it finds the right dataset. Expect some growing pains in this part of the product. Review collected by and hosted on G2.com.

For context, 4,000 employees, a saas sector, Microsoft 365, OneDrive and Teams as the core stack. Honestly, the wow moment. You connect Microsoft 365 and an hour later you are looking at every overshared file in the company, sortable by owner, department, and sensitivity. No agents, no proxies, no network taps. API connections and done. Review collected by and hosted on G2.com.

Honestly, coverage outside the core apps is thinner. Microsoft 365 gets the deepest treatment; smaller tools get less. On our side, the first month of anomaly detection required real tuning. On our side, we got pinged on legitimate bulk projects before it learned our rhythms. Review collected by and hosted on G2.com.

Reliability of the automation. We run 30+ workflows now: expiring external shares after 60 days, revoking access for accounts disabled in Okta, quarantining files that match our secrets patterns, asking owners to re-certify vendor shares quarterly. They fire exactly as configured. That freed my team from being the cleanup crew and let them do detection engineering instead. The playbook library got us 80% of the way on day one; the custom 20% took some iteration but nothing we could not handle. Review collected by and hosted on G2.com.

Workflow versioning is thin. When you edit a live workflow, there is no clean rollback, so we clone before we change anything. I also want better simulation: show me exactly which 12,000 files this workflow would have touched last month before I turn it on. They have preview, but it could go further. Review collected by and hosted on G2.com.

PHI detection that does not cry wolf. We scan Google Drive and SharePoint for health information, and the combination of NLP classifiers plus HRIS context cut our false positive rate by more than half compared to the regex-based DLP we ran before. When a care coordinator shares a patient file with a specialist at a partner clinic, that is the job. When a billing contractor downloads 400 patient records the week their contract ends, that is not. DoControl separates those two events reliably. Review collected by and hosted on G2.com.

Deployment was not hard, but tuning was. Expect four to six weeks before the anomaly models learn your baselines and the noise settles. The compliance reporting covers HIPAA reasonably well, but some controls still need manual mapping for our auditor. Review collected by and hosted on G2.com.

We evaluated DoControl against AppOmni and a CASB renewal. DoControl won on remediation: the others found problems well enough, but DoControl fixes them, in bulk, with workflows we control. Box and Slack coverage met our needs, and the Google Workspace depth is the best I have tested. Deployment was API-based and painless, which matters when your team is five people supporting two thousand users. Review collected by and hosted on G2.com.

Salesforce coverage is thinner than Google's. If your crown jewels live in Salesforce, demo that connector hard before you sign. The misconfiguration module exists but does not yet match a dedicated SSPM's check library on every app. And pricing: not cheap, though still less than the CASB suite we dropped. Review collected by and hosted on G2.com.

The end user engagement model, every other tool I have deployed treats employees as the problem and routes everything through my team. DoControl messages the person who overshared, explains the policy, and asks them to fix it or justify it. Most people fix it. That does two things: it closes the ticket and it teaches. Our repeat-offender rate dropped noticeably after the first quarter. From a media company perspective, where journalists share documents with sources and freelancers constantly, this was the only approach that scaled without killing how our people work. Review collected by and hosted on G2.com.

The Teams bot came later than the Slack bot and it shows. We are a Slack shop so it did not hurt us, but our sister company on Teams had a rougher first month. Admin role granularity could be deeper too. Review collected by and hosted on G2.com.

We already had a CASB, and it still couldn’t tell us who inside the company had shared what with whom in Google Drive and Slack. DoControl could—within hours of connecting. Seeing your real exposure number is uncomfortable at first, but then you get to work.

What I like most is the business context. An alert about a file shared with an external domain means one thing when it’s our CFO sending financials to our auditors, and something else entirely when a departing engineer sends a design doc to a personal account. DoControl can tell those situations apart because it reads our IdP and HRIS. Our CASB couldn’t. Review collected by and hosted on G2.com.

It is expensive for what started as a single-use-case purchase for us. Reporting is the weaker part. Executives want a monthly one-pager and I still end up exporting and massaging data myself. The pre-built dashboards are fine for operators, less so for a board deck. Review collected by and hosted on G2.com.