Access reviews

An access review is a check, once a quarter, that everyone and everything that can reach your workspace still should. Auditors (SOC 2, ISO 27001) ask for evidence that it happens; this is that evidence.

When it happens

At the start of each quarter a review is made and the owner is told by notification and email. If it is still open after two weeks, a reminder follows. An admin can also start one any time from Settings ▸ Access reviews.

What's in it

The workspace as it stood when the review was made: each member and their role, each team, each API key, each AI connection, and whether Solstral support or your agency may come in.

Deciding

Press Confirm for each one that should stay, or Revoke for one that shouldn't. Revoking happens at once: a member is deactivated (and the API keys they made stop working), a key or connection stops working, support access is switched off. The owner and teams can only be confirmed here; change them in Members.

The sealed record

When the last row is decided, the review is completed and sealed. Its checkpoint, a fingerprint of every decision, is saved in the audit log as "Access review completed". Printable record opens a page to print or save as a PDF for your auditor.