Access review and cleanup
A full inventory of human and machine access across systems, then removal of what is stale and reduction of what is broader than the job needs.
SECURITY AND COMPLIANCE
Pass the audit because the controls are real
Access, secrets, logging and incident procedure built into how your systems run, then the evidence collected as a by product rather than a scramble.
Check my access and evidence
30 minutes with an engineer, no sales call
What this is
Controls that hold on a normal Tuesday
We work on your environment: who holds access and why, where secrets live, what gets logged, how an incident is handled, and which vendors touch your data. Each control is applied in the systems themselves, and each one produces a record. When an auditor or a customer asks, you export the record instead of reconstructing the story. We hold no certifications ourselves. We prepare your environment and your evidence for your auditor.
This is for you if
- A customer or investor sent a security questionnaire and answering it honestly would take weeks.
- People who left still appear in an access list, and nobody is sure which systems they can still reach.
- Secrets sit in a shared document or in environment files passed around by message.
This is not the right fit if you need a signed attestation or certificate from us rather than work on your environment. We are not an audit or certification body, and we will point you to one instead of implying otherwise.
Scope
What we build
Secret management
Secrets moved into a managed store with rotation, scoped per environment, and pulled at runtime instead of copied into files and chats.
Audit logging
Authentication, privileged actions and data exports logged with actor and timestamp, retained long enough to answer a question months later.
Written incident procedure
Who is called, how severity is decided, what gets communicated and when, and how the timeline is recorded afterwards.
Data and subprocessor map
What personal data you hold, where it sits, which vendors process it, and under which terms.
Evidence collection
Each control paired with the artefact that proves it runs, gathered on a schedule so an audit request is an export rather than a project.
How it goes
From questionnaire panic to a standing record
- 01
Access and data inventory
One to two weeks
We map every system, every account with access, and the personal data flowing through each one, including vendors.
- 02
Cleanup and controls
Two to four weeks
Stale access removed, permissions narrowed, secrets moved into a managed store, and logging turned on where it was missing.
- 03
Procedures and evidence
One to two weeks
Incident procedure, access review cadence and evidence collection written down and run once with your team present.
Artefacts
What you receive
Written record
Access inventory with owner per system
Data and subprocessor map
Incident procedure with escalation path
Access review schedule and checklist
In your systems
Managed secret store with rotation in place
Least privilege roles applied per environment
Audit logging enabled with a retention setting
Alerting on privileged and unusual actions
For your auditor
Control list paired with its evidence source
Export procedure for each evidence type
Questionnaire answer bank based on real controls
Handover session recording
We prepare your environment and evidence. Certification and attestation come from your auditor, never from us.
Related work
The rest of this line
Cloud and DevOps
Infrastructure as code, deployment pipelines and predictable release days.
Managed support
Monitoring, incident response and a named path when something breaks.
Back up one level
IT services
Cloud foundations, delivery pipelines, security and day to day support.
Access control, hardening and evidence that stands up to a review.
Questions
Questions we get about security and compliance
Next step
Send the questionnaire that is sitting unanswered
Book a technical assessment
30 minutes with an engineer, no sales call