Why Access Reviews Matter
One of the most important parts of securing your systems — and a core requirement in frameworks like SOC 2 and ISO 27001 — is ensuring that only the right people have access to the right systems.
This means regularly checking who has access to each critical tool or software your company uses and revoking any unnecessary permissions. The principle of least privilege — giving each user only the access they need — is key to maintaining a strong security posture.
Automated Access Visibility
ComplyJet simplifies this process by automatically pulling account data from all your connected systems.
Once you've integrated a tool (like GitHub, Google Workspace, or AWS), ComplyJet will automatically fetch:
All user accounts with access to that system
Their roles and permissions
Their corresponding employee profiles (if matched)
This makes it much faster and easier to conduct regular access reviews — without manual spreadsheet tracking or guesswork.
Reviewing Systems
On the Access Reviews page, you’ll first see a list of all systems you’ve already integrated.
If you're using a system that doesn’t have a native integration with ComplyJet, you can still manage access reviews by:
Manually adding the system to your list
Creating access accounts within that system
Assigning an owner
Running reviews just like you would for an integrated platform
This way, no system is left unchecked — even internal tools or legacy software.
Conducting Access Reviews
To start a review:
Click on a system (e.g., GCP).
View all access accounts pulled from that integration.
Assign an owner to each account if it's empty ( you can only assign an account to a current employee or current contractor already added within People page ).
Start or continue an access review for that system.
During the review, you can approve, reject, or flag accounts for further action. If there are any accounts you want to remove, you need to do them at source (ComplyJet can't remove these account, as we only have read access ).
This helps ensure that only active, relevant users retain access.
Final Goal
Your objective is to:
Review all critical systems regularly
Ensure every access account is assigned and verified
Revoke or flag any unnecessary access
Keep your systems in a reviewed and compliant state
By doing this, you reduce insider risk, improve audit readiness, and maintain control over your organization’s digital environment.