Quarterly access reviews

Check who can open your organisation's documents, deactivate leavers, and record that you reviewed it, with a CSV for your auditors.

An access review is a regular check that everyone who can open your documents should still be able to. Admins do it at Admin → Access review and record it in one click.

What the page shows

One row per person in your organisation:

Column	Meaning
Person	Name and email. A SCIM tag means your identity provider manages them. A Break-glass tag marks a person who can still sign in with a password when single sign-on is required.
Role	Viewer, Member, Manager or Admin
Status	Active or Deactivated
Two-factor	On or Off
Last sign-in	The latest sign-in in the security log, or Never. A 90+ days tag marks active people who have not signed in for three months.
API keys	How many of their API keys are still active

The security log is kept for a year, so "Never" can also mean "not in the last year".

Doing a review

Open Admin → Access review. If there is no review in the last 90 days, a banner says "No review in the last 90 days."
Go down the list. Look for leavers, people with a role bigger than they need, admins you do not recognise, accounts without two-factor, and API keys that nobody uses.
Fix what you find under Admin → Users. You can change roles and deactivate people there. See Roles and permissions.
Back on Access review, add an optional note, for example "Removed two leavers; confirmed admins with the CEO".
Press I have reviewed everyone's access.

SignSpry saves who reviewed, when, how many people were on the list and your note. The last 20 appear under Past reviews.

For auditors

Download CSV exports the current list: name, email, role, active, two-factor, whether the person may use a password when SSO is required, SCIM-managed, last sign-in (UTC), active API keys and the date added. Keep one with each recorded review. Auditors for SOC 2 and ISO 27001 ask for this kind of evidence.

SignSpry itself has no SOC 2 report and no certification against ISO 27001. The access review is a tool for your own audits and controls.

Keeping it manageable

If you use single sign-on and SCIM, your identity provider deactivates leavers for you, and the review becomes a confirmation.
Turn on Require two-factor authentication for everyone under Admin → Signing defaults if the Two-factor column shows gaps. See Passwords, two-factor and account security.

Was this useful?

More in Security, trust & legal

How sealing works, and what it provesWhat happens to a document at the moment the last person signs, and what the seal does and does not prove. The hash-chained audit trailEvery event linked to the one before it, so the sequence cannot be quietly rewritten. What is recorded and how to check it. Trusted timestamps: proving when, not just whatAn independent authority attests the time a document was sealed, so you do not have to take SignSpry's word for it. Checking a signed PDF without an accountUpload a PDF to the Verify page to see who sealed it, what the seal covers, and whether this exact file is in SignSpry's records.