Keep repeating that and you won't get much more userbases among regulated environments.
Reality is, those audit companies won't give you their certification if you don't use all available mechanisms provided by google. So companies use them to get certification.
So technically it is not forbidden. But unless the company can't provide a certified security audit, they won't get accreditation.
