A supply chain visibility SaaS company has run its SOC 2 user access reviews on BalkanID since 2022, and now reviews tens of thousands of accounts on a monthly cadence.
Systems
Okta, Microsoft 365 and Azure, AWS (6 accounts), Google Workspace, GitHub, Salesforce, Jira and Confluence, Slack, Zoom, Jamf, HR system, plus monitoring and delivery tools via file upload
Drivers
SOC 2 audit evidence for access reviews across a large, growing app estate
Challenges before BalkanID
- Access reviews for SOC 2 were assembled by hand, app by app, from exports and screenshots.
- Large identity populations in collaboration and CRM systems made complete reviews impractical in spreadsheets.
- Leavers were not reliably reconciled against every system.
What they implemented
- Automated review campaigns per application, with 20+ integrations and file upload for tools without APIs.
- Campaigns at scale: 22,000+ identities in a single collaboration suite review and 41,000+ in the CRM review.
- A move from annual to monthly reviews.
Outcomes
- Continuous customer since 2022, renewed every year, including under new security leadership.
- Reviews that were impractical by hand now run monthly across the full estate.
- Early campaigns flagged terminated users in the email and collaboration suite, including accounts still active after departure.
- Audit-ready SOC 2 evidence produced from the platform each cycle.
.svg)
