Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (8)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Google Drive ↗ | 7.8* | 6.4* |
| Google Sheets ↗ | 7.4* | 3.5* |
| Microsoft SharePoint ↗ | 7.6* | 5.7* |
| Confluence ↗ | 7.6* | 5.4* |
| Dropbox ↗ | 7.7* | 4.9* |
| Box ↗ | 8.4* | 5.1* |
| Figma ↗ | 7.5* | 4.3* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Original files, cloud-native documents and spreadsheet ranges differ in fidelity. File change notifications do not establish complete cell, document or permission history.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Google Drive
Files and knowledge · Checked 2026-10-22
Google Drive / customer-authorized Drive API file reads, downloads and exports. Broad third-party OAuth scopes and internal apps have different review requirements.
Read findings and sources ↗Google Sheets
Files and knowledge · Checked 2026-10-16
Google Sheets / user-authorized Sheets v4 ranges and spreadsheet writes, with Drive file-change hints and spreadsheet downloads; no row-level immutable identity or native cell change log is assumed.
Read findings and sources ↗| Customer control | Google Drive ↗ | Google Sheets ↗ | Microsoft SharePoint ↗ | Confluence ↗ | Dropbox ↗ | Box ↗ | Figma ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|
| Category | Files and knowledge | Files and knowledge | Files and knowledge | Files and knowledge | Files and knowledge | Files and knowledge | Files and knowledge | Databases and data platforms |
| Overall control | ||||||||
| Data access | ||||||||
| Third-party accessibility | ||||||||
| External action | ||||||||
| Continuity | ||||||||
| Data exit | ||||||||
| Business logic and customization | ||||||||
| Assessment scope | Google Drive / customer-authorized Drive API file reads, downloads and exports. Broad third-party OAuth scopes and internal apps have different review requirements. | Google Sheets / user-authorized Sheets v4 ranges and spreadsheet writes, with Drive file-change hints and spreadsheet downloads; no row-level immutable identity or native cell change log is assumed. | SharePoint Online / Microsoft Graph list-item reads and document-library driveItems, original file download/upload and drive delta; site configuration and complete version-history migration are excluded. | Confluence Cloud / distributable OAuth 2.0 app, permission-scoped page REST v2 operations, CQL search and customer content exports; legacy Connect webhooks and Data Center are separate. | Dropbox / OAuth user file access, downloadable original file payloads and folder cursors; cloud-native documents requiring conversion, full team administration and historic versions beyond retention are excluded. | Box / customer-authorized OAuth, original downloadable files, folder listings, uploads and user Events feed; enterprise-wide audit, Box Notes conversion and full permissions/version migration are separate. | Figma / REST API reads for explicitly selected file keys and comments, comment posting/deletion and file webhooks through a public OAuth app. Design mutations, MCP, plugins and complete workspace migration are excluded. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-22 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-22 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Google Drive ↗
Drive supports direct file integrations, but download restrictions, export size limits and OAuth reviews qualify that access.
Google Drive / customer-authorized Drive API file reads, downloads and exports. Broad third-party OAuth scopes and internal apps have different review requirements.
Google Sheets ↗
Sheets provides range APIs without a separate standard-use API charge. Changes to a spreadsheet require rereading selected ranges; Drive file notifications do not identify every edited or deleted cell.
Google Sheets / user-authorized Sheets v4 ranges and spreadsheet writes, with Drive file-change hints and spreadsheet downloads; no row-level immutable identity or native cell change log is assumed.
Microsoft SharePoint ↗
SharePoint offers structured list access and document-library delta queries. Current file payloads are downloadable, while list data, permissions and site behavior need distinct migration inventories.
SharePoint Online / Microsoft Graph list-item reads and document-library driveItems, original file download/upload and drive delta; site configuration and complete version-history migration are excluded.
Confluence ↗
Confluence exposes page bodies and structured search through customer-authorized apps. Content exports help planned migration, while macros, attachments and page permissions need separate inventories.
Confluence Cloud / distributable OAuth 2.0 app, permission-scoped page REST v2 operations, CQL search and customer content exports; legacy Connect webhooks and Data Center are separate.
Dropbox ↗
Dropbox provides original file download and a cursor-based file-tree change route. Production app review and namespace permissions are separate from a customer granting OAuth access.
Dropbox / OAuth user file access, downloadable original file payloads and folder cursors; cloud-native documents requiring conversion, full team administration and historic versions beyond retention are excluded.
Box ↗
Box provides original file APIs and a retained user-event stream. Monthly licensed API allowances and user/endpoint throttles both affect extraction, and event ordering is not guaranteed.
Box / customer-authorized OAuth, original downloadable files, folder listings, uploads and user Events feed; enterprise-wide audit, Box Notes conversion and full permissions/version migration are separate.
Figma ↗
Figma returns file trees and comments through scoped REST calls. Seat type and the requested resource’s plan determine the available request budget.
Figma / REST API reads for explicitly selected file keys and comments, comment posting/deletion and file webhooks through a public OAuth app. Design mutations, MCP, plugins and complete workspace migration are excluded.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.