Access governance a spreadsheet can’t fake
Every capability below ships today. Where it runs on a schedule, we name the actual cadence — “automatic” should be verifiable, not vibes.
Offboarding checklist & completion guarantee
When an employee exits, Grantledger generates one revocation task per active grant automatically. The offboarding case is a hard invariant — it cannot be marked complete while any task is outstanding.
The auditor sees a closed case with every access accounted for, each revocation timestamped and attributed.
Access requests & four-eyes approval
Requests are routed for separate approval. Separation of duties is absolute: the requester is stripped from their own approver list, and privileged requesters route by authority (Admin→Owner, Owner→a different Owner).
No access was ever self-approved — provable from the routing record.
Recurring access certifications
Scheduled certification campaigns re-attest who should still have access, on a per-tenant cadence. Reviewers certify (keep) or request revoke on each item.
Periodic proof that access was reviewed and re-attested — not granted once and forgotten.
Audit log & change history with revert
Every workflow, role, permission, consent, and grievance action is recorded on a hash-chained log. Every domain record also carries change history you can revert. Encrypted fields are logged as ciphertext, never plaintext.
Tampering is detectable: edits, mid-chain deletes, and even truncating the most recent rows all break verification against a vendor-side anchor.
Role-based access control — with manager scoping
Admin, IT, Manager, and Employee roles, plus per-system authorized granters, approvers, and revokers. Managers are scoped to their direct reports only — a real access boundary, not a display filter.
Least privilege is enforced structurally; a manager cannot see or act on anyone outside their reporting line.
Auto-expiring access
Time-boxed grants really end. Grant an access “for 30 days” and it expires on its own — no cleanup ticket, no lingering permissions.
Temporary access provably did not outlive its window.
Grievance redressal (DPDP s13/s14)
A built-in grievance mechanism for your own employees: a data principal raises a grievance, it opens with a response deadline, your admins are notified, and you record the resolution. Details are encrypted at rest.
Demonstrates the “readily available” grievance channel a Data Fiduciary must provide — every step timestamped and audited.
Connectors
Connect an app and Grantledger provisions access on approval and revokes it on offboarding or expiry — through the connector, with the audit trail. Cloud providers use secure federation (no long-lived secret stored); everything else uses a scoped token encrypted with your workspace’s own key. Not connected? That app stays a manual system of record — still tracked, still on the offboarding checklist.
Apps
Cloud
Custom
Dev tools
HR
Identity
// Inbound HRIS is the trigger — a leaver detected in your HR system auto-starts the offboarding guarantee.
Building your own integration? There’s a public REST API and signed webhooks too.
See it against your own access inventory.
Start free and import via CSV, or book a walkthrough.