Home › Free tools › User access review
Most teams do review who has access. What they cannot produce, nine months later, is anything showing that they did. This takes the export you already have, sorts the accounts worth arguing about to the top, and turns your decisions into a dated record. Your staff list is personal data, so it is read in this tab and goes nowhere else.
Runs in your browser. Nothing is sent anywhereA CSV of accounts from whichever system you are reviewing. Google Workspace, Microsoft 365, GitHub, Okta and the AWS IAM credential report are recognised automatically; anything else you map by hand. The file is read in this tab and is not uploaded.
A second CSV listing your current staff, one per row, with an email address or a name in it. Any account that matches nobody on that list is flagged. This is the check that finds the leaver whose account was never closed, and no export from the system under review can do it, because the system does not know who left.
Press one to show only those accounts. An account can carry more than one flag, so these do not add up to the total.
One decision per account. Keep means the access is right as it is, Reduce means they keep the account but not everything on it, Remove means it should go, and Investigate means you do not yet know. Your decisions are saved on this device as you go, so closing the tab does not lose them.
| Account | Person | Last sign-in | Flags | Decision | Note |
|---|
What an auditor asks for is not the spreadsheet. It is a dated statement of what was reviewed, by whom, and what was decided. Fill in these two fields and the export carries them.
Reviews are saved in this browser, on this device, so the next one can tell you what changed. Nothing is transmitted and nothing syncs.
No. The file is opened with the browser's own File API and parsed inside the page. There is no server to send it to, and you can confirm that by opening your network tab while it works. This matters more here than on most tools, because a user export is a list of your colleagues' names, email addresses and sign-in times, which is personal data about identifiable people. Handing that to a compliance platform is a disclosure to a third party, whether or not anyone writes it down.
There is nothing to scan, because there is no upload. Virus scanning happens on a server, to files that arrive at it, and this file never leaves your browser. It is read from your own disk as text and the review is built in the page. An infected export would have been infected on your machine before you opened it, and nothing in the file is ever executed here. The real risk for a tool of this shape is different: a display name or an email address crafted to become markup when the table is drawn. Every cell from your export is escaped before it reaches the page, and our build runs a test that puts script payloads in every column and checks that none of them fires.
Google Workspace, Microsoft 365 and Entra ID, GitHub organisation members, Okta and the AWS IAM credential report are recognised from their column headings. Anything else is treated as a general CSV, and you map the columns yourself: the mapping panel is always available, so a system nobody has heard of works just as well as a familiar one.
Accounts with administrative rights, accounts that have not signed in for as long as you choose, accounts that have never signed in at all, accounts suspended but not removed, accounts without multi-factor authentication, accounts whose address is outside your own domain, accounts that look shared rather than personal, and, if you give it a current staff list, accounts belonging to nobody who still works there. The last of those is usually the one that produces a sharp intake of breath.
The export it produces carries what an auditor looks for: the system reviewed, the date, who performed the review, how many accounts were in scope, the decision recorded against each one and the exceptions that were found. That is the substance of the control. No tool can promise a particular auditor will accept a particular document, and any that does is selling something, but a dated record with a named reviewer and a decision per account is a great deal more than most companies can produce.
Yes, and it is the most useful thing here. Reviews are saved on your own device, so the next one can tell you which accounts are new, which have gone, which are still dormant and, most pointedly, which you marked for removal last quarter and are still sitting there. That last number is the one that tells you whether your review is a control or a ritual.
Saved reviews live in this browser's local storage on this device only. They never sync and they are never transmitted. The button at the bottom of the page deletes every saved review immediately, and clearing site data for this domain does the same thing. If storage is blocked, as it is in some private windows, the tool works normally and simply cannot save.