Your biggest attack surface has a payroll.
Most breaches start with a person, and most audits end with one: who read the policy, who did the training, who still has access they shouldn't. Assura syncs your roster from HR, chases the confirmations for you, and keeps the evidence live - so the human layer of your programme is provable, not assumed.
A short call about your organisation, then a full demo if it fits - no obligation.
From payroll to proof.
Sync the roster
Connect your HR system - BambooHR today, or import a spreadsheet - and every joiner, mover and leaver lands on the roster automatically.
Send one link
Each person gets a personal link to read the policies and confirm their training. No account, no password, two minutes on a phone.
Review access
Run periodic access reviews against what your connectors actually see - who has admin, who has dormant accounts, who left but lingers.
Evidence, banked
Every confirmation and review lands in the evidence pool with a timestamp - feeding assessments, the trust page and the auditor workspace.
The whole human layer, one tab.
One live list of everyone in scope - synced from HR or imported - with security status at a glance instead of a quarterly spreadsheet hunt.
Tokenised personal links collect "I've read the policies" confirmations with timestamps. Auditors ask for exactly this; most firms reconstruct it from email.
Security-awareness training recorded per person, with gaps visible before the auditor or the insurer finds them.
Structured, recurring reviews of who can touch what - informed by live connector data, signed off on the record.
When HR marks a leaver, Assura flags their accounts and access for removal the same day - the gap that fails more audits than any firewall.
Give your auditor a read-only view of the people-evidence - attestations, reviews, timestamps - instead of a folder of screenshots.
How assessments use itStop chasing signatures.
The annual "please confirm you've read the security policy" email thread is where good intentions go to die. Assura sends each person a personal link, tracks who's confirmed, nudges who hasn't, and stamps every confirmation with a time and a version - so when a customer or auditor asks, the answer is a page, not an archaeology dig.
- No accounts or passwords for staff - one link, two minutes
- Policy versions tracked: re-attestation triggers when documents change
- Confirmations feed framework controls automatically via mapping
Leavers leave. Their access lingers.
Every organisation has a James: left in June, still in the CRM in September. Because Assura sees both your HR roster and your actual systems, it catches the difference - and turns the quarterly access review from a spreadsheet ritual into a short list of real questions with sign-off on the record.
- HR sync flags leavers the day HR knows
- Connector data shows admin rights and dormant accounts as they are
- Reviews are recorded decisions, not ticked boxes - who approved, when, why
People-evidence that works everywhere.
Nothing here is an island. Attestations and access reviews score the people-controls in every framework you assess, show up on your trust page as live proof, pre-fill the personnel sections of security questionnaires, and give the auditor workspace its human chapter. Collect once, use everywhere.
- ISO 27001, SOC 2 and Cyber Essentials people-controls scored from real confirmations
- Trust page shows attestation coverage without exposing names
- Questionnaire answers about training and offboarding draft themselves
Asked and answered.
Do my staff need Assura accounts?
No. Attestation links are personal, tokenised and work on any device - staff read, confirm, done. Only the people running the programme need accounts.
We don't use an HR system. Can we still use this?
Yes - import your staff list from a spreadsheet and maintain it in Assura. If you adopt an HRIS later, connect it and the sync takes over from there.
Which HR systems do you sync with?
BambooHR today, with the roster model built to add more - and device trust via Jamf, Kandji and Intune covers the hardware side of onboarding. Tell us what you run and we'll be straight about timelines.
Is this a training platform?
No - it records and evidences training rather than delivering courses. Run whatever awareness training suits your team; Assura keeps the proof that it happened, per person, where your frameworks and auditors need it.