# Access, onboarding and change requests with a record behind them

> Workflow software for tech and SaaS companies: access requests, onboarding and offboarding, change requests and software purchases with a tamper-evident trail.

Tech and SaaS companies automate their product and run their internal routines in chat. Someone needs admin access to production, a new engineer starts Monday, a team wants another tool on the company card, a customer asks what data you hold about them.

Each of these is quick to do and hard to prove later. When an auditor, a customer's security questionnaire or your own incident review asks who approved an access or a change, the answer is somewhere in a chat history.

## Where the work gets stuck

### Access granted in a direct message

Today: An engineer asks for access, someone with admin rights grants it, and nobody records why or until when.

With a process: An access request goes through the manager and security, records the access level and a review date, and asks the requester to confirm it works.

### Offboarding with loose ends

Today: A person leaves and some of their accounts stay open, because nobody owned the list.

With a process: Employee offboarding gives handover, accesses and equipment their own steps with owners, so a departure is not closed while something is still pending.

### Tools bought on a card

Today: Teams sign up for tools that store customer data before anyone checks security or the yearly cost.

With a process: A software license request calculates the cost per year, asks whether the tool will store personal or customer data and gets IT, security and budget approval.

### Production changes without a plan

Today: A risky change goes out without a rollback plan or a window, and the incident review starts from scratch.

With a process: A change request records the risk, the step by step plan, the rollback and the outcome, and serious incidents end in a post-mortem with preventive actions.

## Processes to start with

- [Access request](https://easy.wf/templates/access-request.md): Ask for access to a system with an access level and a review date, approved by the manager and security.
- [Employee onboarding](https://easy.wf/templates/employee-onboarding.md): Get a new hire their laptop, accounts and a planned first day, with a 30-day check-in at the end.
- [Employee offboarding](https://easy.wf/templates/employee-offboarding.md): Close a departure with handover, access removal, equipment return and the termination paperwork.
- [Software license request](https://easy.wf/templates/software-license-request.md): Check a new tool for overlap, security and privacy, and approve its yearly cost before anyone pays.
- [Change request](https://easy.wf/templates/change-request.md): Plan a production change with its risk and rollback plan, approve the window and record the result.
- [Incident report](https://easy.wf/templates/incident-report.md): Report an outage, track the fix and run a post-mortem with preventive actions for the serious ones.
- [Backup restore test](https://easy.wf/templates/backup-restore-test.md): Restore a real backup every month, keep a screenshot or log as evidence and open an incident when the restore fails.
- [Privacy rights request](https://easy.wf/templates/privacy-rights-request.md): People ask about their personal data through a public link, and the privacy team answers with a signed response letter.
- [Equipment request](https://easy.wf/templates/equipment-request.md): Ask for a laptop or monitor and follow it from IT assessment to delivery.

## What matters most

- Full timeline: Each access, change and incident keeps a tamper-evident history of who approved what and when.
- Conditional fields and steps: The post-mortem step only appears when triage says it is needed, and fields show up only when they apply.
- Automatic assignment: Requests can go to an IT pool, rotate round robin or land with whoever has the least open work.
- Deadlines and escalation: Steps have deadlines with reminders and escalation, counted in business hours when you set a calendar.
- CSV, PDF and webhooks: Requests export to CSV when someone asks for the list of accesses granted in a period.
- Public request forms: Privacy requests and service desk requests come in through a public form, without an account.

## Questions

### Is Easyflow a ticketing or ITSM tool?

No. It has no ticket queues, knowledge base or asset database. It is built for internal requests that need approvals and a record, such as access, changes and software purchases.

### Does it integrate with our identity provider or HR system?

Not natively. Easyflow sends signed webhooks and exports CSV, so you can connect it to your own scripts, but it does not create or remove accounts by itself.

### Will it help with a SOC 2 audit?

It provides records, not compliance. Each access request and change keeps a dated, tamper-evident timeline that can be exported, which is the kind of evidence an auditor may ask to see. Which controls you need is up to you and your auditor.

### Can a workflow branch in parallel?

No, on purpose. A process is a linear list of steps, and conditions skip steps or hide fields that do not apply.

Page: https://easy.wf/industries/technology