Product

You set the objective. Prufy runs the tests.

Every audit starts from your methodology, with its missions and checks. Prufy stops where your judgement is needed.

Cobalto BancaFictional data

Access audit

Cobalto Banca, S.A. · IT internal audit

Q2 2026 1 Apr to 30 Jun 2026In progress

Summary

Missions

Decision needed 1
In progress 1
Not started 2

Checks

3 / 18 accepted

Accepted 3
Decision needed 3
Under analysis 2

Conclusions

Findings 2
Exceptions 2

Decision needed

CheckType

Authorised reviewersNot satisfactoryProposed assessment

Review within the periodNot satisfactoryProposed assessment

Revocations carried outCannot confirm whether the mlopez leaver was processedDecision needed

Exceptions and limitations

RecordReference

Active access outside the campaignE-01

Access without a valid decisionE-02E-03

An illustrative case

From discrepancy to conclusion.

Follow the case to the auditor’s conclusion.

Access auditFictional data

Two sources. One discrepancy.

The request is closed. The directory still shows active access.

Request management

Access removal request completed

REQ-4581 · 26 Jun 2026

Corporate directory

Access remains active

Period-end population · 30 Jun 2026

Prufy flagsAccess removal needs verification.

Closing the request does not establish that access was removed.

Digital specialists

Auditor, Research and Assistant, under your direction.

Each one with its own job. You review what they deliver.

Access auditChecksFictional data

Ref.CheckStatus

C-001Joiners with an approved request412 accountsAccepted

C-002Leavers removed on time38 leavers1 exception

C-003Privileged access reviewed27 accountsIn progress

C-004Quarterly recertification412 accountsNot started

Runs the tests in the plan, documents every step with its evidence and escalates whatever needs a decision.
Access auditChecksFictional data
Ref.CheckStatus
C-001Joiners with an approved request412 accountsAccepted
C-002Leavers removed on time38 leavers1 exception
C-003Privileged access reviewed27 accountsIn progress
C-004Quarterly recertification412 accountsNot started
Keeps the frameworks, methodologies and authorised sources the specialists work with up to date.
Access auditSourcesFictional data
Used inSourceWhere
C-001ISO/IEC 27001Annex A · 5.18
C-002Internal audit methodologyTest 3.2 · own
C-003NIST CSF 2.0PR.AA-05
C-004Access control policyv3.2 · section 4.1
Handles requests, email, calendar, meetings and transcripts so the file does not depend on an inbox.
InboxFictional data
Assistant2 Jul · 12:10
Request sent · Directory audit log
Assistant has asked the identity owner for the directory audit log for check C-002. It follows it up until it arrives.
Sent with your team's request template.
View the request

API, SDK and MCP

Prufy, where you already work.

Direct the specialists from your own systems and agents, with the same permissions as inside Prufy.

01
Your context, with you
The project, its evidence and its decisions travel to wherever you ask, without switching tabs.
02
Built for agents
Your organisation's agents can request work from Auditor, Research and Assistant and collect the result with its evidence.
03
Access you can revoke
Every connection uses a key you control and can withdraw at any time.

Available on the Pro and Enterprise plans.

Integrations

Your systems keep the records. Prufy does the work around them.

Communication

Email
Meetings

Documentation

Documents
ERP and accounting

Control and security

Identity
GRC
SIEM
Ticketing

Custom

Each organisation's own systems are connected during the pilot.

Cobalto Banca · Project sourcesFictional data

SourceTypeAccess

Corporate directoryIdentityAuthorised

Ticketing systemTicketingAuthorised

Recertification campaignGRCAuthorised

Spreadsheet sent by emailEmailProvided by the team

Illustrative categories. The connections for each case are agreed with you.

Your audit intelligence belongs to you.

Request a demo

Designed around ISO/IEC 27001, ISO/IEC 42001 and SOC 2 and ready for certification.