Offboarding in
fifteen seconds,
not five days.
An AI-native orchestrator for the whole identity lifecycle — joiner, mover, leaver. One Slack message revokes access across Okta, Microsoft 365, Slack, GitHub, Zoom and Salesforce — cryptographically signed, policy-gated, and logged to a tamper-evident audit chain. The same pipeline provisions new hires, applies role changes, and runs access reviews.
Five stages, one signed decision.
Parse → verify → score → policy gate → execute. Every action is OPA-allowed and signed before any portal sees it.
See the pipeline →Autonomy, but not a black box.
OPA-gated. WORM-audited. HITL on the risky 5%. Every defense is code you can read.
Security model →EUR 2,130 per leaver, per year.
Editable planning assumption: reclaimed licences plus six operator hours. Incident avoidance, audit time, and breach risk are excluded.
Run the numbers →Joiner, mover, leaver — plus the governance around them.
Offboarding is the flagship, but joiner and mover are now validated live against real tenants too — the same parse → verify → score → policy → execute pipeline drives all three. The governance layer around them is code-complete and in active validation.
Offboarding
Soft-deactivate every account, reclaim licenses, defer the hard delete 5 minutes so a mistake is reversible. The proven path.
Provisioning
Birthright access templates expand by role and department; no matching template routes to a human instead of guessing. Privileged grants force HITL.
Role change
Live-read the user's access, grant the new role before revoking the old, never strip company-wide base access, flag ad-hoc access instead of silently removing it.
Access reviews · scheduling · transfer · SIEM
Periodic access-review campaigns with surgical revoke, future-dated offboarding, data handoff before delete, and a durable SIEM export of the audit chain.
A 45-day proof of value. Free, in your cloud.
We onboard one design partner at a time, with our engineers on the deployment end-to-end. You connect your HRIS and top three portals; we run offboardings with your security team approving the risky ones. After 45 days, continue on contract or walk away. Nothing owed, nothing retained.