SOC 2 · Gusto
Turn Gusto terminations into closed access
Deixic reads hires and terminations in Gusto and fixes the access of each person who left in the systems that hold it.
Tests Deixic works on in Gusto
Criteria touched: CC6.2 Provisioning and deprovisioning, CC6.3 Access modification and least privilege.
Failing testWhat Deixic doesCriterion
Offboarding revokes accessReads the termination record in Gusto and closes the person's access in Google Workspace, GitHub, and AWS.CC6.2
New hires provisioned by roleReads hire records and lists accounts that exist without a matching record.CC6.2
Access matches current roleReads status changes and lists access that no longer matches.CC6.3
What runs, what waits, what is yours
Deixic classifies every Gusto action before it runs.
Runs within policy
- Read employee records and audit events
- Start a deprovisioning work item for each termination
Waits for a named approver
- Removing production access from a terminated person in AWS or GCP
Sent to you as a decision
- Any change to payroll or compensation records. Deixic reads Gusto and never writes to it.
- Which date counts as the termination date when records disagree.
Read back and evidence
Each change is read back from Gusto, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The employment status the fix was based on
- The resulting state in each downstream system
Your auditor gets
- The termination record with its date
- One receipt per system changed, linked to that record