JaraLock
Automate · Secure · Control
JaraLock creates and revokes a person's accounts across seven identity and SaaS providers in one run — and shows you exactly what it would do before it does any of it.
Your access. Your rules.
| Provider | Action | Status | What happened |
|---|---|---|---|
| GGoogle Workspace | disable_user | Success | Suspended jordan@acme.com. |
| GGoogle Workspace | revoke_sessions | Success | Signed jordan@acme.com out of all sessions. |
| EMicrosoft Entra ID | disable_user | Success | Disabled account jordan@acme.onmicrosoft.com. |
| AAtlassian | disable_user | Success | Disabled Atlassian account for jordan@acme.com (account_id 359e1f61-7f7e-473a…). |
| GhGitHub | disable_user | Success | jordan@acme.com was not a member of org 'acme' (already removed or never added) — no action needed. |
| AAtlassian | revoke_sessions | Skipped | No separate session-revocation step for this provider. |
The part that matters
The worst thing software like this can do is offboard your whole company at 2am because someone pasted the wrong spreadsheet. So it stops on its own, before touching a single account, and waits for a second human.
This batch of 214 rows exceeds this organization's fraction_of_directory threshold (25%) and was paused before making any changes. A different administrator than the one who submitted it must approve resuming it.
Zero provider calls made. Nothing to undo.
Break-glass admins and service accounts are checked before any provider is even loaded — not by an API flag, not by a CLI switch, not at runtime.
Every run shows the exact plan without contacting anyone. Going live is a deliberate act, not the default.
If disabling someone in Google or Entra fails, the run halts there instead of cheerfully closing their Slack while their email still works.
Type an address and the person appears — name, photo, role. An address matching nobody in your directory is called out in warning colours while a typo is still free to fix.
Ask first
Type the question the way you'd say it. You get a report built from your real safelist, your real connections and your real employee records — including the thing you actually needed to know: Jordan is the only owner of the AWS account and the payroll login. Somebody has to take those over first.
No AI, no external service, nothing sent anywhere. A deterministic parser reads the question, restates what it understood, and says so plainly when it doesn't recognise one — rather than confidently analysing the wrong thing. Asking never changes an account.
Seven providers
Three are verified end to end against live tenants — created, disabled, sessions revoked, confirmed by the provider's own notification emails. The rest are built and documented. The difference is published rather than blurred.
Where it runs
JaraLock is self-hosted. Your employee data and your provider tokens stay on infrastructure you control and never reach a server of ours — because there isn't one. Nothing calls home. The only outbound traffic is to the seven providers' own APIs, plus a SIEM webhook if you configure one.
Which also means it can't be discontinued out from under you. Once licensed there's no expiry and no check-in of any kind. If this company vanished tomorrow, your install would keep working.
Price
Single company
Managed service provider
For comparison: per-seat lifecycle tooling is billed monthly per user. A hundred-person company tends to spend more than the single-company licence costs in its first year alone — and again every year after.
Before you trust it
This software disables accounts and revokes access at your company. You shouldn't have to take a vendor's word for how it behaves — so the trial ships the full source, not a binary. Your own engineers can read every line before it goes anywhere near your directory. It is source-available: read it, modify it, run it on hardware you own; a licence is required to administer a real organization past the trial.
You don't have to ask first to start checking. The security document is published in full here — three reviews, including what was found, what was fixed, what is knowingly accepted and why, and the two findings an earlier review got wrong.
It runs for 30 days from install with no licence key and no card. Email for access and you get the repository. Then it is two commands and a Docker daemon — it bundles its own database and generates its own secrets, so there is nothing to fill in.
$ cp .env.example .env $ docker compose up -d
That's the whole install. It comes up at https://localhost
behind its own TLS. Nothing calls home, then or ever — the only
outbound traffic is to your own providers' APIs.