1. Find the accounts nobody knows about
Get one list across Google Workspace or Microsoft 365 and your main SaaS tools, instead of clicking through admin consoles the week before an audit.
In validation · For companies of 50 to 1,000 people
Every AI agent, API key, and service account in your company, with a name next to it.
If a tool can access your data, someone on your team should own it, know what it can do, and review it before an auditor asks. WhoRunsThis is a lightweight way to find those accounts, assign owners, and run access reviews that actually inform the reviewer.
- Read-only connections
- Metadata only — never stores secrets
- Built for SOC 2 & ISO 27001 evidence
- No card, no commitment for the pilot
The accounts nobody knows about are the ones auditors ask about
Departments adopt AI tools and automations one at a time. Each one creates keys, bots, and connections, often under one person's account. Then that person leaves, or an audit lands, and nobody can answer a simple question: who runs this?
2. Put an owner and an expiry on every non-human identity
An account with no owner does not get reviewed, it gets ignored. Assign a person, set a review date, and let expiry do the chasing. When the owner leaves, the account gets flagged instead of forgotten.
3. Run access reviews a reviewer can actually stand behind
Approving a list of names is not a review. Reviewers see what each account can access, when it was last used, and what it is for, so they can make a real decision. The result is an audit trail your SOC 2 or ISO 27001 auditor can follow without a screenshot scramble.
How it works, in 3 steps
-
Step 1. Connect, read-only.
Connect Google Workspace or Microsoft 365 and your key SaaS tools with read-only access. No agents to install, no changes made to your systems. You approve the exact scopes first, and you can revoke the connection at any time from your own admin console.
-
Step 2. Review what was found.
See every AI agent, API key, service account, and integration in one place, with risk explained in plain English. Assign an owner and an expiry to each one. Anything unknown gets flagged for a decision. Prefer not to connect anything yet? Start from a CSV export instead — CSV import is a first-class way in, not a fallback.
-
Step 3. Run informed reviews, export the evidence.
Reviewers confirm, question, or flag access with the context in front of them. Every decision is logged in an audit trail, and the evidence pack exports mapped to SOC 2 CC6/CC7 and ISO 27001 Annex A controls, in a form an auditor can use.
Stated principles, not fine print
- Read-only, always in v1. We recommend; you act in your own console; the next scan verifies it happened. The tool never revokes, disables, or rotates anything.
- Metadata only. Secret values are never read or stored. There is no secret-value column in the database by design.
- No AI makes attestation decisions. Risk is scored by fixed, explainable rules, stated in one sentence per identity. No AI auto-approves anything.
- Honest coverage. Some sources are limited by the platforms themselves. Coverage is stated per connector, and manual add plus CSV cover the gaps — including vendor-embedded agents no API can enumerate.
The differentiator
Informed Attestation: a review where the reviewer actually understands what they approved
For each agent, the reviewer sees what it is, who owns it, what it can reach, when it was last actually used, and a plain-English risk explanation. For example, in plain words: a bot that can read customer support mail, has not been used in months, and whose owner has left the company reads very differently from its name alone.
Segregation-of-duties warnings appear inline. Every attestation carries an expiry, by risk level. High-risk keeps require a written rationale, and “risk accepted” is a distinct, auditable decision — not a default approve. The design deliberately resists rubber-stamping.
Simple flat pricing, by company size
Not per user, and not per agent. Per-user pricing punishes a company for a problem that is about identities, not seats. Per-agent pricing punishes discovery — the bill rising because the product worked. Flat pricing is predictable enough to say yes to without a procurement process.
Starter
$49 / month
Up to 100 employees
- 1 workspace (Google Workspace or Microsoft 365)
- Core inventory of AI agents, API keys & service accounts
- Owner assignment & leaver guard
- Plain-English risk explanations
- Expiry on every identity
- CSV import
Expected main tier
Growth
$99 / month
Up to 300 employees
- Everything in Starter
- Both workspaces, if needed
- More connectors (GitHub, Slack-limited, AWS metadata)
- Informed Attestation access reviews
- Segregation-of-duties warnings
- Auditor evidence export (SOC 2 CC6/CC7, ISO 27001 Annex A)
Scale
$199 / month
Up to 1,000 employees
- Everything in Growth
- All connectors
- Multiple review cycles
- Multi-entity / consultant view
- Priority support
Annual billing at 10 months for 12 once paid plans launch. Pilot pricing is grandfathered for 12 months. Free pilot: 30 days, read-only, 1 workspace plus up to 5 tools — inventory, owner assignment, 1 full Informed Attestation review, and 1 evidence export. You keep the inventory export even if you decline. Maximum 3 concurrent pilots.
Built by a practitioner, not a marketing team
PraBin Shrestha works in identity and access management and has hands-on experience administering SailPoint Identity Security Cloud (ISC). He is the author of a research series on IAM and AI, covering informed attestation for access reviews, separation of duties for AI agents, and the identity problem created by vendor-embedded AI agents.
This product is that research turned toward a practical problem: smaller companies face the same non-human identity sprawl as large ones, without the team or the budget for an enterprise governance platform.
No customer logos are shown here because the product is in validation and has no customers to show yet. No testimonials, customer counts, or statistics are shown for the same reason. That will change only when it is true.
Join the waitlist for a free pilot
We are taking a small number of companies for a free, read-only pilot. You get a full inventory of your AI agents, API keys, and service accounts, with owners and risk notes, plus one guided access review. In return, we ask for one feedback call. No card, no commitment, and nothing is connected until you approve a one-page pilot outline.
Disclaimer: This product is in validation. It is not generally available yet. Joining the waitlist or taking part in a pilot does not create a contract, and pilot features and planned pricing may change based on what we learn. Nothing on this page is a guarantee of compliance or audit results.
Frequently asked questions
We already have Okta. Is this not the same thing?
Okta and similar tools handle sign-in, single sign-on, and lifecycle for people well. The gap this addresses is different: non-human identities created inside SaaS tools and AI platforms, API keys and service accounts that may never touch your identity provider, and the review evidence an auditor wants for them. If your current stack already inventories and reviews those accounts with owners and expiry, you may not need this. The pilot inventory will show you either way, and that answer costs nothing.
Is read-only access actually safe to grant?
Read-only means the connection can list accounts, keys, integrations, and usage metadata, and cannot change, delete, or create anything. Secret values are never read or stored. You approve the exact scopes before connecting, you can revoke the connection at any time from your own admin console, and the pilot outline states what is read and why before anything is connected. If your policy requires it, start with a CSV export instead of a live connection and judge the value first.
Will this actually help with SOC 2?
Access reviews, account ownership, and evidence of periodic review are part of what SOC 2 auditors test under the logical access criteria (CC6/CC7), and ISO 27001 Annex A has equivalent expectations. This helps with that specific slice: a current inventory including non-human accounts, named owners, documented reviews where the reviewer saw real context, and a dated, hash-chained audit trail to hand over. It does not replace a compliance platform, an auditor, or your other controls, and it does not guarantee any audit outcome. No tool can honestly promise that.
Which tools and stacks does it cover?
The pilot is designed around Google Workspace or Microsoft 365 as the core, plus GitHub, Slack (limited — its audit data is restricted by Slack's own plan rules, and we say so up front), and AWS metadata, along with CSV import and manual add for vendor-embedded agents. The exact connector list for the pilot will be confirmed in the pilot outline for your stack. If a key tool of yours is not covered, we will tell you before the pilot starts, not after.
What does the free pilot include, and what happens after?
The pilot runs for 30 days, read-only, for one company: inventory, owner assignment support, and one guided Informed Attestation review with an exported evidence pack. At the end, you can keep the inventory export whatever you decide. Paid plans are offered only after the pilot review meeting, and saying no ends it there. No auto-conversion, no card on file.