SOC 2 · Rippling
Turn Rippling terminations into closed access
Deixic reads who has left, who joined, and which devices they hold in Rippling, and fixes the access in the systems that own it.
Tests Deixic works on in Rippling
Criteria touched: CC6.2 Provisioning and deprovisioning, CC6.3 Access modification and least privilege.
Failing testWhat Deixic doesCriterion
Offboarding revokes accessReads the termination record in Rippling and suspends, removes, or deactivates the person in Google Workspace, GitHub, and AWS.CC6.2
Access matches current roleReads role and employment changes and lists access that no longer matches.CC6.3
Devices returned at offboardingReads the devices assigned to a terminated person.CC6.2
What runs, what waits, what is yours
Deixic classifies every Rippling action before it runs.
Runs within policy
- Read employee status, role, and devices
- Start a deprovisioning work item for each termination
Waits for a named approver
- Removing production access from a terminated person in AWS or GCP
Sent to you as a decision
- Any edit to an employee record. Deixic reads Rippling and never writes to it.
- Which date counts as the termination date when records disagree.
Read back and evidence
Each change is read back from Rippling, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The employee status the fix was based on
- The resulting state in each downstream system
Your auditor gets
- The termination record with its date
- One receipt per system changed, linked to that record