Access reviews that survive the audit.
UARG runs your periodic user access reviews end to end. It pulls the population, puts the dangerous access in front of reviewers first, chases them from your own mailbox, and hands your auditor a pack that reconciles — every quarter, every system.
No card. Bring one real export and we'll run a review against it on the call.
NetSuite — Q3 2026 user access review
Population 1,284 accounts · 9 reviewers · deadline 14 OctThe quarterly problem
The spreadsheet was never the control. It was the evidence that a control might have happened.
A user access review lives or dies on three questions an auditor will ask, and a mailbox full of spreadsheets answers none of them well.
“Is this every account?”
Someone exported a report weeks ago and typed a row count under a screenshot. Nobody can prove the file was not edited on the way, or that the merge of one-row-per-role did not quietly drop a third of the grants.
“Did anyone actually look?”
Four hundred rows arrive in a manager's inbox on a Friday. The rational response is to select-all, approve, reply. Nothing in a spreadsheet distinguishes that from a considered review.
“What happened to the exceptions?”
Three accounts were flagged for removal in Q1. The chaser is in someone's sent items, the ticket is closed, and the same three accounts turn up flagged again in Q2 because nothing carried forward.
How it works
Eight phases. Three of them cannot be talked past.
Every review moves through the same lifecycle, and a timeline at the top of the screen says where it is and whose desk it is on. Three gates are enforced by the software rather than by a policy document — the review simply will not advance.
Scheduled
Each system's cadence sets its own next date. Reviews open on it automatically — never auto-approved, always in the hands of a person.
Kickoff approval
A named human attests that the review may begin, and the period under review is fixed.
Report validation
The listing is reconciled against the source system before anybody reviews it. Row counts, evidence, hash.
Reviewer outreach
Each reviewer gets only their own population, from your mailbox, with the full chaser schedule queued up front.
In review
Risk screens first, remainder second — and the review cannot leave this phase while a single account is undecided.
Gate — 100% decidedRemediation
Every removal and change tracked through to done, each with a documented cause.
Gate — root cause on filePost-review confirmation
The system owner confirms the changes actually landed in the source system.
Gate — confirmation requiredSigned off
The review locks. Still exportable, no longer editable, and the pack is one click away for the rest of time.
Product
Built for the two hard parts: getting the data in, and getting reviewers to think.
Reviewers see the dangerous access first
Rather than a flat list of hundreds of rows, reviewers work five filtered risk screens before confirming the remainder — so the twenty decisions that matter get the attention, instead of being diluted across four hundred that don't.
- Terminated but still active — leavers matched against your HR feed
- Not in the HR system — contractors, service accounts, ghosts
- Privileged access — admin and finance-critical entitlements
- Unusual for the job title — an entitlement compared against everyone sharing that title, flagged when exactly one person holds it
- No recent login — dormant, which is a question rather than an accusation
An audit pack, not a folder of attachments
Any review exports to two formats that reconcile with each other, and both report the position honestly — including the gaps. The export is deliberately never blocked, because a control that hides an incomplete quarter is worse than one that shows it.
- PDF — cover position with a complete/incomplete banner, reports relied upon, full population and decisions, changes with root causes, control steps, audit trail
- Excel — seven tabs, with anything unreviewed highlighted in red rather than omitted
- Every action recorded — who decided what, when, and on whose behalf
- Evidence retained — source files hashed with SHA-256, so it can be proved the artefact was never swapped
Get the data in, two ways
A NetSuite connector pulls the listing on demand over SuiteQL and records the query it ran and the row count NetSuite itself reported. For everything else, upload CSV or Excel — and confirm what was found in the file before anything is stored.
No more guessing which report to pull
The hardest part of a real review isn't the workflow — it's knowing what to ask the system owner for. 113 systems ship with their own guidance: which reports the review needs, what the screenshot must show, and the columns the export has to contain.
Chasers from your own address
Mail goes out from the customer's mailbox — Microsoft 365 via Graph, or SMTP — not a shared vendor domain. A chaser from your own compliance address is one a manager acts on; the same chaser from a stranger's domain is one they report as phishing.
Corrections stick across quarters
“Service account, cannot be logged into, credentials in the vault” is written once and shown every period thereafter — kept separate from the approve/deny decision, so the account is still genuinely reviewed. Reassigning a reviewer sticks too.
Nobody chases the chasers
The full follow-up schedule is queued the moment outreach goes out — reminder at day 7, again at day 10, escalation the day after the deadline — and a reviewer's pending chasers are cancelled the second they finish.
Five roles, scoped on the server
Administrator, compliance manager, system manager, manager reviewer, auditor. A people manager sees only their own reports — on screen and in the export, because scoping the screen alone would be cosmetic when the pack is one download away.
Security
You are handing us a map of who can do what in your finance system.
That deserves specifics rather than a badge wall. Here is what is actually enforced, so the person who has to sign off on the vendor review knows where to look.
Tenant isolation in the database, not just the code
Every query is scoped by organisation, and PostgreSQL row-level security enforces the same thing underneath — so a query that one day forgets its filter returns nothing rather than another customer's access review. The application's database role cannot bypass RLS, and sees nothing at all without a tenant context.
Source-system credentials encrypted at rest
A NetSuite token is, in effect, a key to your financial system. Credentials are encrypted with AES-256-GCM under a key held outside the database, are never returned to the browser after saving, and disconnecting deletes them rather than disabling them. Integrations refuse to operate at all if that key is unset.
Sessions you can actually revoke
A password reset moves a per-user cutoff that evicts every outstanding token — not just the browser that asked. Invitation and reset links are stored only as hashes, expire, work once, and are redacted from the outbox so compliance staff reading it cannot take over an account.
Authorisation on the server, in one place
Access is capability-based rather than role checks scattered through the codebase, and item-level rules live in a single function so no action can quietly omit them. The interface only hides what the server would refuse anyway.
Attacks reproduced before the fix was believed
Brute-force throttling that is not an enumeration oracle, a strict Content-Security-Policy with a per-request nonce and no inline scripts, SSRF protection on the connector's hostname, and evidence downloads served so an uploaded HTML file cannot execute on our origin. Each was confirmed by driving the running application, not by reading the code.
Your data leaves as easily as it arrived
A full tenant export is built in, and backups are verified by restoring them rather than by observing that a file exists. UARG runs on standard PostgreSQL with no proprietary lock-in, so a self-hosted or private-cloud deployment is a supported option rather than a special case.
Pricing
Priced per system in scope, not per employee.
Reviewers are unlimited on every plan. Charging per head would tax you for inviting the managers who ought to be doing the reviewing.
Team
One or two critical systems, run by a small finance or compliance function.
Billed annually · up to 3 systems in scope
- Unlimited reviewers and reviews
- CSV and Excel ingestion with guided column mapping
- All five risk screens, including outlier detection
- Full PDF and Excel audit pack
- Report-pulling guidance for all 113 systems
Business
A full SOX or ISO scope across the finance and IT estate.
Billed annually · up to 15 systems in scope
- Everything in Team
- NetSuite connector — pull the listing on demand
- Send from your own mailbox — Microsoft 365 or SMTP
- Single sign-on
- Automatic scheduling, reminders and escalation
- Read-only auditor seats, with export
Enterprise
Unlimited scope, or a deployment that has to live inside your own boundary.
Annual contract · unlimited systems
- Everything in Business
- Self-hosted or private-cloud deployment
- Custom source-system connectors
- Security review, DPA and named contact
- Onboarding of your first review cycle with you
A “system in scope” is one application reviewed on its own cadence — NetSuite, Active Directory, Salesforce. Review it four times a year or twelve; it counts once.
Questions
The ones that come up on every call.
Our systems have no connector. Is UARG still worth it?
Yes — and that is the normal case. Upload is a first-class route in, not a fallback: everything downstream (HR matching, risk flagging, reviewer assignment, the audit pack) is identical whether the data arrived by connector or by file. The upload step shows you what was found in the file — which column identifies the account, which way round the dates are, how many rows describe the same account — and asks you to confirm it before anything is stored, rather than guessing and being quietly wrong.
How long does it take to run the first review?
Getting the export out of the source system is usually the long pole, and it is the part UARG can help with before you have even loaded a file: take a system into scope and it tells you which reports to ask for and what they have to contain. Once the listing is in, outreach is a single action and the software does the chasing from there.
What stops a manager approving four hundred rows without reading them?
Nothing can make someone think. What the software can do is change what they are looking at: the risky access is separated out and put first, so a reviewer who skims still skims the twenty rows that matter rather than burying them in four hundred. Everything is attributed and timestamped, and a review cannot close while a single account is undecided — so a rushed review is at least a visible, attributable one.
Can our auditor get in directly?
Yes. The auditor role is genuinely read-only — it holds no capability that writes — and it can pull the same PDF and Excel pack you can, for any review including closed ones. That is usually cheaper than fielding evidence requests by email for six weeks.
Where does our data live, and can we host it ourselves?
UARG runs on standard PostgreSQL with no host-specific services, so it deploys to a managed cloud or inside your own boundary from the same codebase. Self-hosting is an Enterprise option rather than a fork. A full tenant export is built in either way — the exit is part of the product.
What is deliberately not in the product yet?
We would rather tell you now than at the security review. NetSuite is the connector that exists today; other systems come in by file, and adding a provider is a small piece of work rather than a rewrite. The guidance for the 113 catalogued systems is labelled with how far it has been verified, and those labels are meant literally — treat an unverified click path as a checklist of what the report must contain, not as directions.
See it against your own data.
Twenty minutes. Bring one real export from a system you actually review, and we will run a review against it on the call — risk screens, chasers, audit pack, the lot.
No card, no procurement conversation, no sales sequence afterwards.