Access offboarding, past the SSO wall

Your IdP disables what it covers. We close everything it doesn't.

Every offboarding checklist ends at SSO. The GitHub seat, the HubSpot login, the AWS IAM user — the apps nobody remembers to check — stay open for weeks. Deprovly finds them and shuts the gap, with a verified revocation where we can get one, and a tracked, SLA'd ticket where we can't.

Become a design partner See how it works

First design partners get a 3-month pilot at the monthly rate.

Employee offboarded 14 days ago — still has access to

AWS IAMRevoked

HubSpotRevoked

Internal wiki (no SSO)Access flagged, removal not yet confirmed

Design tool (no SSO)Access flagged, removal not yet confirmed

Two tiers, matched to what's actually possible.

Not every app has an API that confirms removal. We don't pretend otherwise — we tell you which ones do, and chase the rest down with a human-closed, audited ticket.

Verified tier

Confirmed revocation, same day

Connects directly to the vendor API. Access is pulled and confirmed — not assumed — within 24 hours.

GitHub · HubSpot · AWS IAM

Best-effort tier

Detected, ticketed, SLA-tracked

Daily check for lingering access on everything else. Opens a ticket, tracks it against a 1-business-day SLA, never auto-removes.

Every other app in your stack

1 daybest-effort remediation SLA, tracked and alerted on breach

24 hrsverified-tier revocation, confirmed via vendor API

100%of actions written to an append-only audit log

Built for the moment "prove you deprovision" stops being theoretical.

If you're mid-SOC2 Type II and someone just asked how fast you actually remove access, we'd like to talk.

hello@deprovly.com