SOC 2 and ISO user access recertification — $499
4 systems / 75 users / 7 days from the day we have your files.
One campaign from your roster and system CSVs. Not software. Not Vanta. Not a template.
We match identities, flag leftovers and privileged accounts, and split keep/revoke sheets by manager. Day 2 you get a working packet. You run the reviews. Day 7: an evidence ZIP after you sign.
You sign. We don’t revoke access. You revoke in your own consoles.
Stripe · then email CSVs · no login. The 7-day clock starts when the files arrive, not when you pay.
If we cannot ship the evidence ZIP within 7 days of usable files, we refund $499.
What you send
- Roster (HR / Google / M365): name, work email, manager, start/term date, department
- Up to 4 system CSVs (Workspace/M365, GitHub, AWS IAM, 1Password/Okta): identity, role/privilege, last activity if you have it
- User/role exports only. No API keys, passwords, or production secrets.
- Zip the files. At 4 systems / 75 users they fit in email. If an attachment bounces, we will take a Drive link — no upload portal.
What you get
Day 2 — working packet: inventory · flags (leftovers, privileged, orphans, dormant, shared) · one keep/revoke sheet per manager.
Day 7 — evidence ZIP (after managers mark and you sign): those sheets · exception register · your signed attestation PDF · INDEX.md. That is the pack you keep. Not an audit opinion.
Sample pack
Download a synthetic 40-user campaign — same file set as a real job. Fake people. No signup.
7 days from your files
The clock starts when CSVs arrive, not when you pay. You get two packages — a working packet so managers can review, then one evidence ZIP for the auditor. Max 2 jobs at once.
- Day 0Pay $499. Email CSVs to recertify@kernelcraft.com.
- Days 0–1We match identities and flag leftovers, privileged, orphans, dormant, and shared accounts.
- Day 2Working packet (email/Drive): inventory, flags, and one keep/revoke sheet per manager. Not the auditor ZIP yet. You send those sheets to your managers and collect keep / revoke / unsure.
- Days 2–5Your managers mark keep / revoke / unsure. We do not chase them. We stay on recertify@kernelcraft.com if a sheet is unclear. We do not send another pack in this window.
- Days 5–6You return the marked sheets. We log exceptions (keep-with-reason) and send a DocuSign attestation for you to sign.
- Day 7Evidence ZIP: the reviewed sheets, exception register, signed attestation PDF, and an INDEX.md an auditor can follow. That is the pack you keep.
This is for you if
- 15–80 person SaaS doing or renewing SOC 2 / ISO
- Access review still lives in Sheets
- You can export roster + up to 4 system CSVs
- Your managers will mark keep/revoke
This is not
- SailPoint, Okta OAuth, or a connector farm
- Auto-revoke in your consoles
- A Vanta / Drata replacement
- A formal audit opinion. You are reviewer of record.
CSVs and data
Exports only. Stored in a job folder. Working copies deleted within 30 days of ZIP delivery. Encrypted archive kept 90 days, then deleted, unless you ask sooner or later.
Do not send API keys, passwords, private keys, or production secrets. See privacy.
Who
Recertify is sold and fulfilled by Kernelcraft LLC in Dallas. After you pay, email your CSVs to recertify@kernelcraft.com — that inbox is how the job runs.
Over 4 systems or 75 users? Email first. Don’t pay $499 until we quote. We run at most two jobs at once; if we cannot start yours, we say so before you pay or we refund.
Pay $499
Stripe checkout. Then email your CSVs to recertify@kernelcraft.com. The 7-day clock starts when the files arrive.
If we cannot ship the evidence ZIP within 7 days of usable CSVs, we refund $499. If the files are unusable, we say so and refund. If you never send files, ask within 14 days for a refund. If we already sent the working packet and managers don’t finish, that is not a refund — you keep the packet.
Later recerts (not billed now): $999/quarter, offered with the evidence ZIP — new exports, diff vs this campaign, next packet + ZIP.