Standing service it-leavers-with-live-access-checked-every-month · revised 12 October 2026
Standing service
Check every month for leavers who still have access to your named apps
Each month we compare your staff list with your directory and up to five apps and send a list of leavers who still have an active account, seat or token, with the evidence row for each.
This starts a conversation by email. Nothing is charged, and nothing is run, until we have agreed scope, access and terms with you in writing.
The responsibility you hand over
A one-off leavers check is out of date within weeks. New people leave every month, and an app added after the check is never compared with the staff list.
Who it’s for: Managing director or IT lead who has had one leaver found with access and wants it checked every month, not once.
Usually starts when: A one-off check found leavers with access, and new leavers have arrived since.
The result: Every month you receive a list of people who have left and still have an active account in your directory or a named app, one row per person and system with the export row it came from. New rows since last month are marked, and accounts not on the staff list are shown apart. Nothing is changed by us.
What stays true, and what we do about it
No response-time guarantee is published for this new service. A target for delivering each report is agreed in writing before it starts, set to what a service at this stage can keep.
Hours are agreed in writing before the service starts. At launch the service is not staffed round the clock and runs once each month.
What must remain true
- For each covered app, nobody whose leave date is past the agreed grace days has an active account, seat or token, unless a named exception exists
- Every app and the directory is either covered each month or listed as not covered
What we watch
- The staff list with five fields, supplied each month
- User exports from the directory and each app, or a read-only role you create
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A month closes and the staff list and exports are available. | We produce the list and summary and send them to the person you named. |
| A leaver still has access beyond the grace days. | We put them first in the summary with the evidence row and offer the change-list job for your admin to run. Linked job: Leaver removal change list |
| An app's export changes shape or stops arriving. | We say so and list the app as not covered until a working export is back. |
We do on our own
- Read the exports and compare them
- Prepare the list and the summary
- Offer a fixed job as a next step
We ask you first
- Any change to the grace days or the exceptions list
- Any request for wider access or more staff-list fields
- Adding an app to the check
We escalate to you when
- The same leaver appears two months running
- A leaver holds an admin role
- An export stops being available
How you know it held. Each month you can recompute the list from the same exports. The summary says how many rows were checked, how many apps were covered and how many were not.
How we keep it true
This service is never finished. Each month's report shows whether the thing it watches stayed true, and it continues until you end it.
Find people who have left but still have an account or seat in your apps Job Optional
A list of people who have left but still have an active account, seat or token in each app you name, with the export row behind every entry, and unlisted accounts shown apart.
Bought separately; not part of the monthly fee
The one-off version, useful as the baseline.
Get a leaver access-removal change list and dry-run script that your admin runs Job Optional
For leavers you name, a line-by-line change list and a script that prints what it would do and changes nothing until your admin runs it live on each account.
Bought separately; not part of the monthly fee
The change list and dry-run script your admin runs.
What is included, and what is not
- The monthly leavers-with-access list
- The evidence row for each entry
- A not-covered list for apps without an export
- A one-page summary
Included
- A staff list limited to five fields: name, work email, start date, leave date and manager
- Your directory and up to 5 apps, each as a user export or a read-only role you create
- Up to 250 people
- A monthly list with new and closed rows marked
- A short summary and a question list for the owner
Not included
- Disabling or deleting any account
- Reading mailbox or file contents
- HR data beyond the five staff-list fields
- Out-of-hours cover or a response time
- A decision on who should have access
What you get to see
The customer deliverable is the running result and its evidence, not a pull request. The pull request stays an internal record.
- Request. Your request, as we understood it
- Agreed checks. The agreed checks that define done
- Test results. Test results against each check
- Independent review. An independent review and what it found
- Known limits. What it does not cover
- Acceptance. Your accept or change request
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
Each month's list covers every person on the staff list whose leave date is past the grace days and every named app, and its row counts can be recomputed from the exports.
Evidence: The list, the export row counts and your own recomputation.
Every row points to an export row your admin can open, and a 20% sample of at least 10 rows matches the live console.
Evidence: Your marked sample.
Rows new or closed since last month are marked correctly against last month's list.
Evidence: This month's list beside last month's list.
No account, role or seat has been changed by us.
Evidence: Your own audit logs for the month.
Sign-off. Your named IT admin reads each report and says whether the rules still suit you. A month counts as delivered when you have received the report and the summary.
If it fails. If we cannot run a month because an export is missing or has changed, we say so, explain what we need and do not guess. If the service is not working for you, you can end it at the end of any month.
When it fits, and when we stop
It fits when
- A first check has been done, by us or by you, so there is a baseline
- HR will share the five staff-list fields each month and no more
- Each app can give a user export, or you create a read-only role
- A named admin receives the list and acts on it
We stop and tell you if
- HR will only share more than the five fields
- Fewer than half of your apps can give a user export
- You suspect an active break-in, which needs incident response first
What could go wrong
The service only reads and reports, so there is nothing to undo. Ending it leaves your systems exactly as they are; you keep every report we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A current employee is listed as a leaver. | Rows are questions with evidence, and your admin confirms before any change. |
| An app silently drops out of the check. | Every named app is covered or listed as not covered each month. |
| Export text contains instructions meant for a language model. | Exports are treated as data only, the run has no send or change tools, and inputs and outputs are logged. |
A separate automated reviewer checks every report against the agreed test before it is sent. No person on our side reviews unless your agreement names one. Your named IT admin decides what to do with each finding.
Stays with a person
- Your named IT admin decides what to do with every finding
- You make every change in your own systems
Access we would need
- A read-only role that you create and can remove, or exports that you run
- Never a role that can change anything, and no admin credentials held by us between runs
Questions
Do you disable the accounts you find?
No. We list them with evidence. Your admin decides and acts.
How soon after a leaver is listed?
We publish no response time. Each month's list is delivered on a day agreed in writing.
Do we need the one-off check first?
A baseline helps. You can buy the one-off check, or give us a month of exports to start from.
Also part of
Send an enquiry
Send us
- The apps to cover, up to 5, and your directory type
- How many leavers you expect each month
- The number of grace days you allow after a leave date
Later, once you agree
- Each month: the staff list with five fields, a user export from the directory and each app, and last month's list, through an agreed secure route
- The list of approved exceptions
- The name of the person who receives the list
You keep your systems and your files. We work on redacted or synthetic copies, or on exports you run yourself, and we hold no admin access between runs. Before any real personal data is shared, the written agreement names the model provider, its country and how long it keeps data, or the work runs on your own provider account.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “it-leavers-with-live-access-checked-every-month” as the subject.