Every offboarding, fully closed. Every time.
The record of who has access to what — where an offboarding case can’t close until every access is revoked, on a log that can’t be quietly edited.
no card to start · your employee data stays in your own database
Offboarding lives in a spreadsheet. Auditors keep flagging it.
At most small and mid-sized companies, “who has access to what” is a spreadsheet, a Slack thread, or someone’s memory. When people leave, revocations get done mostly — and nobody can prove it later. That gap is the first thing a SOC 2, ISO 27001, or HIPAA auditor pulls on.
What auditors ask — and what you answer
- “Who left last quarter?”→ complete list
- “Prove access was revoked.”→ closed case
- “Who approved this?”→ four-eyes record
- “Has the log been edited?”→ hash chain: no
From “someone left” to a closed, provable case
Mark the leaver — or auto-detected straight from your connected HRIS.
One revocation task per active grant, generated automatically.
Each access revoked in its real system and marked done — audited.
The hard rule: the case stays open until every task is done.
Governance, not just a list
Four-eyes approval
Every request routed for separate approval. The requester is stripped from their own approver list — no self-approval, ever.
Guaranteed offboarding
A case can’t be marked complete while any revocation task is outstanding. A hard invariant, not a reminder.
Tamper-evident audit
Hash-chained log. Edits, mid-chain deletes, and even tail-truncation are all detectable.
Manager-scoped RBAC
Managers see their direct reports only — a real access boundary, plus per-system granter/approver/revoker authority.
Auto-expiring access
Time-boxed grants really expire. An hourly job flips past-due access to expired and audits it.
Recurring reviews
Scheduled certification campaigns re-attest access on a per-tenant cadence — unattended.
Priced for SMBs, not enterprise IGA
Starter
Never fail an access audit again.
- Access record-keeping
- Auto offboarding checklist
- Auto-expiring access
- Tamper-proof audit log
Growth
Access management runs itself.
- Everything in Starter
- Recurring access reviews
- Retention enforcement
- SLA-breach email reminders
Business
Automatic provision & deprovision.
- Everything in Growth
- Real connectors (AWS, Okta/SCIM, GitHub, HRIS…)
- Public API & webhooks
- Priority support
Customer proof
We don’t publish fabricated logos or quotes. Real customer proof appears here as early customers agree to be named.
Close the offboarding gap before your next audit.
Start free, import your access inventory, and turn “we think we revoked it” into proof.