Run the access review. Keep the proof.

How it works

1. 1. Import

   Paste or upload a CSV of users and entitlements from any system, map the columns, and rows without a reviewer default to you.

2. 2. Review

   Each reviewer gets a single-purpose link, no account, and marks every row Keep, Revoke or Don't know from a phone.

3. 3. Close

   Mark revocations as actioned, close the review, and download the evidence pack PDF with its sha256, chain head and verify URL.

The problem, in your words

"No one stored anything we don't have any screenshots or logs. The guy who owned security left six months ago… Now leadership is asking me to 'recreate' what happened last year."

"9,800 rows. 140 managers. Due in 10 days. Completion rate last quarter was 34%… The managers who do complete it approve everything. Every single row."

"A list of users isn't enough. A quarterly access review with sign-off is… If you can't show it happened, for an auditor it didn't happen."

Features

• One CSV splits into per-reviewer campaigns; reviewers get magic links, never accounts.
• Keep, Revoke or Don't know per row; "Keep all remaining" requires a typed justification.
• Reminders at T-7, T-2, the due day, then every three days overdue.
• A revocations-to-action list; mark each one done with a date and note.
• Evidence pack: roster, timestamps, IP, every decision, exceptions, sha256, chain head, verify URL.
• Compare with the previous review of the same system: new, removed, changed entitlements.

What it is not

• It does not connect to your identity provider or revoke anything. You import a CSV and make the changes; it records that you did.
• It is not a GRC platform and it does not make you SOC 2 compliant. It is the control and the proof for one control.
• It is not legal, audit or security advice. Your auditor decides what is sufficient; we produce the record they ask for.

Pricing

Flat monthly fee. Limits are enforced with upgrade prompts, never by losing data.

Full plan limits

Questions

What data do you hold, and where does it go?

The rows you import (identifiers, entitlements, optional descriptions and notes), each reviewer's decisions and comments, and the timestamp, IP and browser of every reviewer action. It stays in your account's database; you set retention to 12, 24 or 36 months, and "Delete review data" hard-deletes rows and uploads. Detail on /security.

What happens when I cancel?

Your account drops to Free limits. Nothing is deleted and existing reviews stay readable. If you delete the account, rows and uploads are removed immediately and generated packs are purged after 30 days unless you downloaded them.

Does it replace Vanta, Drata, Entra P2 or SailPoint?

No. Those connect to your identity systems and cover many controls. AttestProof runs one control from a CSV and replaces the spreadsheet-and-email version of a review. If you already own a platform with working access reviews, use it.

Do reviewers or auditors need an account?

No. Each reviewer gets a single-purpose link that works on a phone and shows who is asking, why, and what will be recorded. Reviewer links expire 30 days after the review closes. Auditor share links (Pro) are read-only, expire after 14 days by default, and can be revoked any time.

Is this legal or audit advice?

No. AttestProof records what your reviewers decided and when. Whether that satisfies a framework or a specific auditor is a judgment for you and them. We never state that your organization is compliant.

How do I get my data out?

Every plan generates the evidence pack PDF. Starter adds a CSV export of every row and decision; Pro adds JSON of the full pack. Each PDF prints its own sha256 and a public verify URL, so it stands on its own after you leave.