For Security, Compliance, Legal and HR teams
Security teams shouldn't have to wonder if an old employee can still get in. PurpletGo makes sure they can't.
30-day free trial - no credit card required
6 Live connectors
Each one has had a real revoke run against a live vendor account before we call it Live.
You decide whenNothing is revoked until an admin or HR user starts it.
A result from each systemRevoked, failed or needs manual action, kept per system.
Evidence on every planAudit log with CSV export and a PDF case report.
Credentials locked downEncrypted at rest. Connecting anything asks for your password again.
* Slack revocation runs through Slack SCIM, so it needs a Slack Business+ or Enterprise plan.11 more stay Beta until they pass the same test. How we count
Why offboarding fails
It fails as a task marked complete on a record nobody reopens. Each case below is the kind of departure that closes clean in a tracker while something is still live.
Day 1 · 09:41
IT-482 closed by automation
Day 1 · 09:41
Jira answered 403. Nobody read it.
Day 38
Access review: Dana still active in Jira
A revoke request that returns 403 still closes the task. Nobody reads the response body of a job that reports success by default.
Each system's own result is kept. A failed revoke holds the case open.
Day 1 · 10:02
Offboarding checklist complete
Day 1 · 10:02
Linear and Figma were never on it
Day 61
License review: Dana still in Linear and Figma
Offboarding runs off a checklist written two years ago. The tools the team actually adopted since then are not on it.
A role's apps live in its role template, not a checklist someone has to remember.
Day 1 · 09:45
Access revoked in 8 systems
Day 3
Return reminder sent to Dana
Day 21
MacBook still with Dana. Case still open.
Access comes off in minutes. The case sits open for weeks because the only person who can return the hardware has stopped reading company email.
The laptop is tracked as an asset. The case stays open until its return is confirmed.
How it works
Secure offboarding is a case, not a button. PurpletGo turns every departure into one, and the case stays open until the parts only other people can finish are done too.
Step 1 of 4
One action suspends the leaver on your identity provider and removes them from the apps you select. No per-app console, no runbook.
In the sample case
A sample case. Each system reports its own outcome: Google Workspace and GitHub confirm the removal, Jira returns HTTP 403 and the error is kept, and Notion has no removal API on this tier, so it goes to a person with the reason attached.
Revoke access - Dana Reyes
SampleSelected apps
2 apps still need attention before the offboarding can move on.
dana.reyes@example.com suspended in Google Workspace; All active sessions revoked for dana.reyes@example.com; Revoked 3 third-party app token(s) for dana.reyes@example.com; removed dana.reyes@example.com from all 4 Google Group membership(s)
dreyes removed as active member from "example-co"
Jira user dana.reyes@example.com still has access: removed from 0/2 group(s), failed: jira-software-users (HTTP 403), confluence-users (HTTP 403); user deletion failed (HTTP 403). The token needs Site administration and the manage:jira-configuration scope.
I removed it by handNotion has no user-removal API on this plan tier - manually remove dana.reyes@example.com via Notion workspace settings → Members, or connect Notion as 'Notion (SCIM)' if this workspace is on the Enterprise plan with SCIM configured.
I removed it by handStep 2 of 4
Every system returns its own result: revoked, failed, or needs manual action. A failure keeps the error the vendor returned and holds the case open, and a retry re-runs only what failed. Nothing is marked done because it probably worked.
In the sample case
The same sample case, retried after the Jira token was given the missing scope. Only the systems not yet revoked are run again. Until Notion is confirmed as removed, the case cannot move past IT Revocation.
Revoke access - Dana Reyes - Try again
Sample1 app still needs attention before the offboarding can move on.
Google Workspace was already revoked - skipped
GitHub was already revoked - skipped
Jira user dana.reyes@example.com removed from 2 group(s): jira-software-users, confluence-users
Notion has no user-removal API on this plan tier - manually remove dana.reyes@example.com via Notion workspace settings → Members, or connect Notion as 'Notion (SCIM)' if this workspace is on the Enterprise plan with SCIM configured.
I removed it by handIT Revocation → Asset Recovery
Access must be revoked for every selected app before moving past IT Revocation. Not yet revoked: Notion
Step 3 of 4
Each action lands in the audit log with a timestamp and an actor, and every plan includes a PDF case report for the departure.
In the sample case
The same sample case in the audit log and its PDF case report. Every entry is hash-chained to the one before it, so an edited or deleted row breaks the chain (checking the chain from the page is on the Team plan and above). The PDF's SHA-256 is taken after it is finished, so it lives in the audit entry and the download headers, not in the file itself.
Audit Log
SampleDownloaded the offboarding PDF for Dana Reyes - document d73d0297-c819-4559-bc63-b4680a4e4ff2, sha256 0f577037d9dfad289141003125548d2ffed82b04160f200cadfa71f1ee1ec6ec, signed with key 6fcd0d86bd979d16
Notion: Removed manually - confirmed by Sam Patel
Revoked access to Google Workspace, GitHub, Jira Cloud, Notion
Verify Chain Integrity: Chain Intact. All 1,284 signed entries passed hash verification. No tampering detected.
Access Revocation
Generated by PurpletGo on 9/24/2026, 2:31:07 PMPage 2 of 2
Document ID d73d0297-c819-4559-bc63-b4680a4e4ff2 (recorded in the audit log)
SHA-256 0f577037d9dfad289141003125548d2ffed82b04160f200cadfa71f1ee1ec6ec
Step 4 of 4
A private link lets the leaver finish their own tasks, and the replacement's onboarding checklist starts from the apps the leaver actually had.
In the sample case
The same sample case from the leaver's side. The link goes to their personal email, opens only after a one-time code, stops working after 7 days or when HR revokes it, and shows only what is still waiting on them. The portal and codes by text are on the Team plan and above.
Self-service portal
SampleHi Dana, here's your offboarding
3 days until your last working day · 3 things still need you
1 document needs your signature
My Tasks0 / 1
Return company laptop and chargerDue Sep 29, 2026
Waiting for your signature
Equipment Return AgreementEquipment ReturnAwaiting signature
Team Checklist
Tasks being completed by your HR and IT teams on your behalf.
A real case
About five months later, on 24 September 2018, the former engineer used it to delete 456 virtual machines behind Webex Teams. Over 16,000 accounts were down for up to two weeks.
April 2018An engineer resigns from Cisco.
With PurpletGo, the AWS revoke:
It runs in the same revoke as every other system you connect, when an admin or HR user starts it, and the case stays open until each one reports back.
Source: U.S. Department of Justice, Northern District of California, the guilty plea of 26 August 2020 and the sentencing of 9 December 2020.
See what PurpletGo does for your toolsFAQ
An identity provider deactivates the accounts it federates. It does not tell you what happened in the apps outside that federation, it does not track the laptop, and it does not hold the case open until those are resolved. PurpletGo records a per-system outcome for every app you connect and keeps the departure open while anything in it is unresolved.
It is recorded as failed, with the error the vendor returned, and the case stays open. A retry re-runs only the systems that failed. If a system has no deprovisioning API at all, it is marked as needing manual action rather than being silently skipped, and someone has to confirm it by hand before the case can close.
No, and no offboarding tool honestly can. PurpletGo revokes on your identity provider and the apps you connect to it. Shadow IT that was never connected to anything is outside what any deprovisioning product can see. What it does guarantee is that nothing you did connect gets marked done without a result.
Through a private link sent to a personal address, because corporate email usually stops working on the last day. They open it with a one-time code, sent by text when SMS is set up and otherwise by email. The link opens exactly one offboarding, lasts seven days, and can be revoked instantly from the employee record. It only ever exposes that person’s own outstanding items.
An audit log where every action carries a timestamp and a named actor, plus a PDF case report for each departure, included on every plan. Team and Enterprise make the log tamper-evident, with each entry chained to the one before it. The per-system outcomes are part of that record, so the evidence shows what failed as well as what succeeded.
Connect your identity provider, run one departure, and read the per-system results.
30-day free trial - no credit card required