Day one, they’re ready. Last day, they’re out.
Everything in between runs here too.
Every account, app, device and access grant: set up when someone joins and removed when they leave, automated across the tools we connect to and flagged for the rest. Hiring, people records, spend, compliance and security checks sit in the same system.
What you get depends on the plan. Every item below shows the plan it starts on.
From $299 a month, flat — not per person. See pricingRuns on a server that is only yours. See exactly what we can and cannot reach
Ava Chen
Platform Engineer · starts today
Onboarding run
Onboarding run: 8 accounts created, 1 laptop, 1 IT task
- Identity providerAccount created
- Email and calendarAccount created
- ChatAccount created
- Code hostingAccount created
- Cloud accountsAccount created
- TicketingAccount created
- Video meetingsAccount created
- Password managerAccount created
- LaptopAssigned to Ava
- Building badgeIT task, due today
Product demo with sample data. Accounts change on the tools you connect; anything else is raised as a task.
It starts with a join and a leave. It does not stop there.
Six parts of the company in one system, at one flat monthly price. Each item shows the plan it starts on.
Joining and leaving
All on every plan
You keep your identity provider, your payroll and benefits system, your device-management tool and your accounting system. Zonitix works alongside them.
Built for companies that get audited — with or without an IT team. Have one? It takes work off their plate. Don’t? The system runs the lifecycle for you. No per-seat fees: every plan is one flat price for your instance, whatever your headcount.
Joiner. Mover. Leaver.
Automated.
When someone joins, changes role or leaves, their access moves with them. No tickets, no spreadsheets.
- A role change shows the access to grant, revoke or keep before anyone approves it, then grants the new role’s access and removes the old.
- A leaver has access revoked automatically on the tools we connect to. Anything a connector can’t do itself is raised as a task, not forgotten.
- Every workflow change has to pass validation before it can go live, is kept as a version you can roll back to, and is approved by someone other than its author, or by an administrator.
- Whoever starts a hire can’t also approve it. A different approver signs off, or an administrator steps in.
- To start a run
- One action
- Access changes
- All logged
- Where it runs
- Your dedicated instance
The right access,
by role, not by ticket.
Define a persona once — Sales Rep, Finance Analyst, Platform Engineer — and Zonitix builds the provisioning plan for it: accounts created automatically in the providers it supports, the rest raised as dated tasks.
- Roles, groups and personas. A matrix resolves each person’s effective access and shows whether a grant comes from a role, a group or a one-off override. A group can require MFA of everyone in it.
- Self-service access requests. Each request clears two gates — a business approver (never the requester) and then IT’s provisioning approval — before any account is touched. If the person has since left, the grant is refused at approval time.
- Access-certification campaigns. Each person’s access goes to the right reviewer to keep or revoke; no one certifies their own. A revoke pulls a Zonitix role or group immediately and raises an IT-approved deprovision run for an external app.
- Drift between campaigns. A live ‘current access & drift’ view surfaces off-book access, so you always have the review an auditor asks for.
- Model
- RBAC + personas
- Templates
- Personas
- Evidence
- Access Reviews
Access reviews
Each person’s access, certified or revoked by a reviewer
Product demo · sample dataSee a join and a leave, live, on a real instance.
A 30-minute walkthrough of onboarding one person and offboarding another, on a live instance — not slides.
What happens after you book
- 1Together
A demo with the founder
Thirty minutes on a live instance: onboarding one person and offboarding another. Bring your questions.
- 2Us
We provision your private server
In the hosting region you choose. Your administrator gets a one-time setup key to create the first account.
- 3You
You connect your tools and set the rules
Link your identity provider and directory, then decide what each role gets on day one and what is removed on the last.
Get audit-ready
without the fire drill.
Audits stop being a scramble: the trail, the controls and the proof are already in one place.
- A tamper-evident audit trail logs every access grant and removal, hash-chained, with a one-click integrity check your auditor can export.
- Framework readiness scores 146 mapped controls across SOC 2, ISO 27001, HIPAA and five more frameworks, with an evidence vault for the proof.
- The records auditors ask for — policy, risk and vendor registers and a Statement of Applicability — sit beside the controls they support.
- Signatures and training count by themselves: policy signing and training start on Team, and on Advanced the hub reads who has signed and who has finished as evidence for the controls that ask for it. Nobody enters it twice.
- Reports on demand or on a schedule export to PDF, CSV or Excel and can be emailed to your auditors or board.
The audit trail is on every plan. The full Compliance Hub comes with Advanced.
- Audit Trail
- Complete
- Readiness
- Scored
- Export
- PDF / CSV / Excel
Works with the tools you already run.
Zonitix grants and removes access itself on sixteen tools, and on any app that speaks SCIM 2.0. If a call fails, the step becomes a written task instead of a silent gap.
Grants and removes access automatically
- Okta
- Microsoft Entra ID
- Google Workspace
- AWS IAM
- Active Directory / LDAP
- OpenLDAP
- Slack
- GitHub
- Jira
- Zoom
- Salesforce
- BambooHR
- 1Password
- Zendesk
- ServiceNow
- Dropbox
- Any app that speaks SCIM 2.0
Reads and maps, doesn’t remove access
These are read for visibility and audit evidence. Removing access there stays a manual step, and Zonitix does not manage devices through them. Azure and Google Cloud are read by Cloud Mapping, and Jamf Pro and Intune feed the Compliance Hub, both included from Advanced.
- Azure
- Google Cloud
- Notion
- Jamf Pro
- Microsoft Intune
Offer letters are signed on your instance with Zonitix Sign, our built-in e-signature (Team and up). The Identity Hooks documentation says exactly what every connector reads. We add connectors as we build them, and we’ll tell you plainly if the one you need isn’t there yet.
Answers before you ask.
Still have a question we didn’t cover?
The founder replies personally, usually within one business day.
There’s nothing for you to install and no security team required. We provision a dedicated, single-tenant instance for you and host it, and we walk you through connecting your tools every step of the way — guided setup, not a project you have to staff. Your instance is ready within one business day (Sunday to Thursday) of you sending us your setup details (the short form after payment). If we miss that, tell us and we refund your first payment in full. Day to day it’s built to be run by a normal IT or ops person: every plan includes the System Health console — a read-only view of your server’s CPU, memory, disk and service status — and from the Advanced plan up the built-in Security Lab self-audit checks your setup for gaps and tells you exactly what to fix.
Still have a question we didn’t cover?
The founder replies personally, usually within one business day.
Flat monthly prices. No per-person fees.
Core $299 · Team $649 · Advanced $1,799 a month, flat, whatever your headcount. Every plan is a private instance on a server that runs only your company.