Early access · Entra ID · Okta · Google Workspace
Upload your identity provider export. We explain every cryptic entitlement in plain English, flag the risky ones first, and send each manager a short list they can finish in minutes. You get an auditor-ready evidence PDF, with no connection to your IdP.
CSV upload only · No admin credentials · Demo uses synthetic data · Book a 15-min call
Q4 access review: your team (12 people)
Sorted by risk · 41 items · 7 flagged
SG-FIN-PAYMENTS-RELEASECan release payment batches at the bank. Holder left the company Aug 29 but signed in 6 days ago.
SG-FIN-AP-RW + SG-FIN-AP-APPROVECan create and approve the same vendor bill (separation-of-duties conflict).
Contributor on rg-prod-sqlCan change production databases. Held by a contractor.
Illustration with synthetic data
A sysadmin recently described their quarterly access review: one Excel file, about 9,800 rows, sent to 140 managers, with an enterprise IGA tool far out of budget. Managers saw names like SG-FIN-AP-RW and GRP_LEGACY_SAP_FI_ALL, had no idea what they meant, and either rubber-stamped everything or ignored the email.
That's the normal state of access reviews at growing companies: too many rows, no context, and an auditor waiting for evidence.
“SG-FIN-AP-RW” becomes “Can create and edit accounts-payable invoices”, with a risk tier (Critical / High / Medium / Low) and the reason. Override any call, and your overrides stick.
Admin, production, finance and customer-data access go to the top, along with terminated-but-active users, dormant accounts, contractors with admin, and toxic combos like “edit vendor bank details + release payment”. Low-risk birthright access takes one click.
Timestamped decisions, scope, reviewers, completion and findings in one PDF with a sha256 fingerprint of the decision log, plus a revocation to-do CSV for whoever runs your IdP.
Download users and group/role/app assignments from Entra ID, Okta or Google Workspace (plus your HR roster if you have one) and upload the CSVs.
Each manager gets a magic link to a short, risk-sorted list. No accounts, no training. Automatic reminders chase the stragglers.
Download the evidence PDF and the revocations CSV. Remove access in your IdP as you normally would.
We never ask for admin credentials or API tokens, and we have no write access to your identity provider.
Only entitlement names and descriptions are sent for explanation, never employee names or emails.
Early-access reviews: we delete your exports within 7 days of delivering results, and confirm it in writing. The hosted demo uses synthetic data only and deletes every demo workspace after 24 hours.
This is an early-stage product, and we don't hold a SOC 2 report yet. During early access, parts of the review are prepared with you by hand while the product catches up. Ask us anything on a call.
Review due now?
$299 one-time · money-back guarantee
First 5 founding customers
$149 /month
MSP or vCISO running reviews for several clients? $299 for the first client review, then $199 for each additional client review in 2026. Talk to us.
At launch, CSV exports from Microsoft Entra ID, Okta and Google Workspace, plus an HR roster CSV. Anything you can export to CSV with users and entitlements can work, and we'll help map the columns.
No. You upload exports, and we never get credentials or write access. Revocation stays in your hands via the to-do CSV.
The evidence PDF documents who reviewed what, when, the decision and any comments, with a tamper-evident hash. Whether it satisfies a specific control is your auditor's call. It's a more complete record of the same process many teams evidence with spreadsheets and email today.
They're a starting point, not a verdict. Each one shows its reason and confidence, low-confidence items are flagged for you first, and you can override any tier.
During early access, you send exports for one review. We use them only for that review and delete them within 7 days of delivering results, confirmed in writing. Ask for earlier deletion at any time.
An email address. They click a link, choose Keep / Revoke / Not sure, and they're done.
Best fit: 50–500 people, a SOC 2 / ISO 27001 / HIPAA / SOX-style access-review requirement, and no budget or appetite for an enterprise IGA rollout.
Join the waitlist for early access, or book a 15-minute call and we'll look at your export format together.
Work email only. We'll reply within 1 business day and only email you about early access. Reply “unsubscribe” anytime. Form by Tally.