Ploy: Identity Governance and Access Control Service
Description of Services
1. Overview and Service Model
Ploy is a software-as-a-service (SaaS) identity governance and administration platform. It gives organisations visibility of who has access to what across their connected systems, automates the joiner, mover and leaver lifecycle, runs access reviews and certifications, enforces access policies, and maintains audit-ready records of access decisions and changes.
The Service is delivered as a cloud-hosted platform, accessed through a web browser over an encrypted connection, with APIs available for supported integration scenarios. The Service is provided on a subscription basis and is updated continuously; no update will materially reduce the functionality of the Service.
This document describes the capabilities of the Ploy platform as at the effective date. The capabilities available to a particular customer depend on the services purchased in the applicable Order Form.
2. Identity and Access Data
Ploy connects to an organisation’s identity providers (such as Microsoft Entra ID, Okta and Google Workspace), HR information systems and business applications to build and maintain a catalogue of identities, accounts, groups, roles, entitlements and other resources.
The catalogue provides current and historical visibility of access: which identities hold which access, how it was granted, and when it changed. Ploy identifies accounts that are not linked to a current employee, and discovers non-human identities, including service accounts and machine identities, so that they can be governed alongside human access.
3. Access Management
Ploy manages the granting, changing and removal of access. Authorised Users can request access to catalogued resources through a self-service catalogue, with configurable approval routing. Approved access is provisioned automatically where a supported integration allows write operations, or routed as tickets and tasks to the relevant owners where it does not.
Lifecycle automation is driven from the connected HR system: joiners receive role- and attribute-based access from their start date, movers’ access is adjusted as their attributes change, and leavers’ access is revoked on departure, including revocation of OAuth tokens and, where configured, conversion of mailboxes to shared mailboxes.
Time-bound and just-in-time access is supported, with automatic expiry and removal where possible through integrations.
4. Access Reviews and Certifications
Ploy runs access review campaigns across connected systems & disconnected systems. Campaigns can be scoped by application, role, entitlement, team or risk level, scheduled or run on demand, and routed to the appropriate reviewers, such as line managers or resource owners, with reminders and escalation handled by the platform.
Reviewers are shown the context needed to make a decision: what the access is, who holds it, how it is used and how it compares with peers. Luna AI can recommend decisions and flag anomalies for attention; decisions remain with the reviewer. Approved revocations are actioned through the platform and tracked to completion, considering different provisioning strategies per resource.
Each campaign produces an exportable evidence pack recording scope, decisions, reasoning and remediation, suitable for internal and external audit.
5. Workflows and Automation
Ploy includes a no-code workflow builder for automating identity and access processes. Workflows are triggered by events such as HR start and end dates, access requests or detected violations, apply conditions based on identity attributes, and carry out actions including creating accounts, granting or revoking access, requesting approvals, sending notifications and creating tickets or tasks in connected systems. Workflow runs are logged, providing visibility of what ran, when, and with what outcome.
6. Luna AI
Luna is Ploy’s AI assistant. Within the platform, Luna provides recommendations and context in access reviews, answers questions about identities, access and activity, and can carry out platform actions at an Authorised User’s direction, subject to that user’s permissions.
7. Integrations
Ploy provides native integrations with identity providers, HR systems and business applications, via API-based connectivity for supported systems and custom integrations where agreed.
Where an integration supports write operations, Ploy can provision and deprovision access directly. Where an integration is read-only, Ploy provides visibility and routes changes through tickets and tasks.
8. Reporting, Audit and Evidence
Ploy maintains an audit log of actions taken in the platform, including access changes, review decisions and workflow runs. Reports on access, lifecycle events and review outcomes can be viewed in the platform and exported. Audit logs can be exported to a customer’s SIEM environment where a supported integration is configured.
9. Support and Availability
Support arrangements, service availability commitments, service credits and maintenance windows are set out in Ploy’s Service Level Agreement, available at ploy.io/service-level-agreement.