AccessCertIQ
Our own on-premises platform for privileged-access recertification: who holds elevated access, is it still justified, and was it actually removed? Signed evidence at the end, every time.
Illustration — a campaign review in progress.
The review it replaces
Most mid-size organizations still run privileged-access reviews by hand: exporting users from each system, merging them into an Excel master list, emailing managers, then routing everything for sign-off.
It works — until an auditor asks you to prove it. Reviews drag on for weeks, spreadsheet versions multiply, and nobody can show that flagged access was ever removed.
| Today, manually | With AccessCertIQ |
|---|---|
| Per-system exports and scripts | Read-only connectors on a schedule |
| Hand-merged Excel lists and email chains | Structured decisions in a reviewer inbox |
| "Revoked" — taken on trust | Removal verified on the next sync |
| Evidence scattered across emails | One signed evidence package per campaign |
How it works
Every action is written to a tamper-evident, append-only audit trail.
Connect
Read-only connectors collect privileged access; accounts are correlated to identities.Review
Reviewers work a risk-first inbox of plain-language items with structured decisions.Remediate
Rejected items become tickets. Your team makes the change — the next sync verifies it.Close & prove
The final approver signs off, and the campaign produces signed evidence.
What it does
- Campaigns that run once — or recur on a schedule from saved templates
- Plain-language entitlements: "Domain Admins" reads as "can administer the entire Windows domain"
- Five structured decisions, with justification enforced where it matters
- Orphan (ownerless) account detection that blocks closure until resolved
- Time-bound exceptions — never indefinite, always carried into the next campaign
- Eight standard reports, exportable as PDF, CSV, Excel or JSON
Connects read-only to 11 systems
Every connector runs under a documented, minimum-privilege service account. If a sync fails, the last good snapshot is retained.
- Active Directory
- Azure / Entra ID
- AWS IAM
- SQL Server
- Oracle
- PostgreSQL
- MySQL
- MariaDB
- MongoDB
- Linux
- Windows Server
Also built in: single sign-on (SAML 2.0 / OIDC), email over your own SMTP, SIEM/syslog export, and SCIM 2.0 / AD sync for platform users. On the roadmap: Exchange, GCP IAM, Jira, ServiceNow.
Security, audit & evidence
- AES-256-GCM encryption at rest; TLS 1.2+ everywhere, with mutual TLS between internal components
- Append-only, hash-chained audit trail — no role, not even Auditor, can edit or delete it
- Fail-closed: approval, closure and evidence export are blocked if the audit trail cannot be written
- Each closed campaign produces a SHA-256 signed evidence package, verifiable offline, indefinitely
What AccessCertIQ is not
We state the boundaries plainly, because our buyers stake audits on them.
- Not a full identity-governance suite — no joiner/mover/leaver automation, and not a PAM vault
- It never changes access itself: your team makes the change, it verifies the removal
- Campaign-based reviews, not continuous monitoring
- It produces strong evidence for ISO 27001, SOC 2, PCI DSS and SBP ITGC reviews — it does not itself certify compliance
Prove it on your own systems.
A pilot runs a full campaign on one or two applications within a few weeks — evidence package included.