See every non-human identity with access to your systems
A guided, read-only session across Google Workspace, Microsoft 365, GitHub and Slack. We produce the full accountability record, walk the findings with you, and you keep the report either way.
What you get
A complete inventory
Every third-party application, service account, token and bot with access to the connected sources, with the scopes each holds and, where the source exposes it, when it was last used.
An ownership column
For each identity: the human accountable, whether they are still with the organisation, and an explicit No owner where no answer exists. This column is usually the finding.
A control mapping
Findings mapped to PCI DSS 8.6, CIS Controls 5.5, ISO/IEC 27001 A.5.16 and SOC 2 CC6 — including, honestly, which of those actually apply to you and which do not.
Exactly what access it requires
Published here before you connect anything, so your security team can review it without asking. Read-only throughout. No write scopes are requested for any source, and no agent or network access is involved.
| Source | Read-only scopes requested | What we read |
|---|---|---|
| Google Workspace | admin.directory.user.readonly, admin.directory.domain.readonly | Third-party app grants, service accounts, admin-role holders, and the user records needed to resolve an owner. |
| Microsoft 365 / Entra ID | Application.Read.All, Directory.Read.All, AuditLog.Read.All | Enterprise applications and their consent grants, service principals, app registrations, and sign-in activity to establish last use. |
| GitHub | read:org, read:user, repo (metadata) | Installed GitHub Apps, OAuth apps, organisation personal access tokens and Actions secret names. Secret values are never read. |
| Slack | team:read, users:read, apps.connections (read) | Installed applications, bot users, and the workspace member records needed to resolve ownership. |
What we deliberately cannot do
HumanAudit holds no write permission on any connected source. We cannot revoke a grant, rotate a credential, change a permission or modify a record in your environment. That is a design commitment rather than a current limitation — you should not grant write access to an early-stage vendor, and we do not want it.
How the session runs
You request a scan
The form below. Work email, company, and which sources you can connect. We reply within two business days with a time.
A 20-minute connection call
You authorise the read-only connections on the call, so you can see exactly what is being requested. Nothing is stored before you consent.
We produce the record
Usually within two business days. Inventory, ownership column, scope analysis, control mapping.
A findings session
We walk the report with you. If your existing tooling already covers what we found, we will say so plainly.
You keep everything
The report is yours regardless of what happens next. You can request deletion of the underlying scan data at any time.
Request an exposure scan
Six fields, three of them required. We reply within two business days, from a person, with a time rather than a sequence of marketing emails.
Who this is currently a good fit for
Cloud-native organisations of roughly 200–3,000 people using Google Workspace or Microsoft 365, with a meaningful number of SaaS integrations. If you are much smaller, the finding is usually that you do not have this problem yet — and we will tell you that rather than sell to you.
Request received.
We reply within two business days, from a person, with a proposed time. If you do not hear from us in that window, email hello@humanaudit.ai — that is a failure on our side, not a filter.
Nothing has been connected and no data has been read. The read-only authorisation happens on the call, with you watching.
Questions about the scan
Is the scan really free?
Yes, and you keep the report whether or not anything else follows. We are running these sessions to learn what the report is missing, which is worth more to us right now than a fee would be.
How long does it take, end to end?
Two business days for us to reply with a time. Then one 20-minute call in which you authorise the read-only connections and we take the first pass. Two more business days to produce the record, then a second session to walk it. So roughly a working week of elapsed time and about an hour of yours. It is a guided session, not an automated self-serve scan — we say so here rather than let you discover it on the call.
What does it cost afterwards? Are we being qualified for a $50,000 contract?
No. There is no paid product to sell you yet — see the capability table on the home page for exactly what exists. When there is one it will be priced for organisations of 200–3,000 people, which is the specific gap left by the platforms that acquired every independent product in this space. If your budget process needs a number before you will take the call, say so in the form and we will tell you what we currently expect to charge and how firm that is.
What if you find nothing interesting?
Then we will say so, and you will have spent twenty minutes establishing that your existing controls cover this. That is a legitimate outcome and we would rather tell you than manufacture urgency.
Who needs to be on the call?
Someone with administrative read access to at least one of the four sources, and ideally whoever would be accountable for acting on the findings. Two people is usually the right number.
Can we run it without connecting anything?
Not usefully — the value is in your actual data. If a read-only connection is not something you can approve, a reasonable alternative is to export your third-party application list from your Google Workspace or Microsoft 365 admin console and send it to us. We can produce a partial report from that.
What happens to our data afterwards?
Scan data is retained for 90 days by default so we can produce a comparison on a second run, then deleted. You can request immediate deletion at any point and we will confirm in writing. Details are on the security page.