42 apps we can reach without an upgrade.

Beyond the list

Anything your directory already assigns.

Most companies hand out access to far more apps than any integrations page could list — by putting people in a Microsoft Entra or Google security group and letting the app follow. Karmoto manages that group, so it reaches those apps without needing their API at all.

Group-based app assignment needs Entra ID P1, which is included with Microsoft 365 Business Premium and E3 — so most companies this size already have it and no upgrade is involved. Entra supports security groups only, and not nested ones, for app assignment.

Files and shared drives

And the files they leave behind.

Losing a departing employee's documents is the offboarding failure people notice first — usually weeks later, when someone needs the file and it's locked in a deleted account.

Ownership transfer runs on Google's own Data Transfer API and Microsoft Graph, so the move happens inside your tenant and never passes through us. Google won't transfer files to or from an account outside your domain, which is their rule rather than ours.

Healthcare

For practices, clinics and home health.

Your EHR is usually the one system where offboarding already works — HIPAA forces an audited access review on it. What actually goes unrevoked is everything around it: the shared drive, the scheduling tool, the video visits, the billing portal. Those are in the list above. These are the healthcare-specific ones we'll reach too.

Epic, Oracle Health and MEDITECH aren't here. They're hospital-scale systems that administer access inside their own tooling rather than through a public API, and they sit outside the size of company we build for. We'd rather say that than imply otherwise.

Where the API stops

Two apps we can't close for you. We still prove they got closed.

Both let us read who has an account, and neither lets us remove one on the plan most teams hold — Notion has no removal endpoint on any plan, and Slack's is SCIM, which starts at Business+. So Karmoto flags the account during offboarding, gives your admin the exact step, and records who marked it done. The next sync re-reads the member list. If they're still there, the task reopens.

That check is the difference between a record and a tick box. Your audit trail separates the two: revoked means an API call returned success, attested means a named person said they did it, and verified means we went back and confirmed it. An auditor treats those differently, so we don't merge them.

One gap we'd rather state than have you find: Notion's API doesn't return guests, so a departing contractor on a guest seat can be attested but not automatically re-checked. Those stay marked attested, never verified, and the guest list is reviewed from an export instead. Slack has no such gap — its member list includes guests and still shows the account after removal, so the confirmation is positive rather than an absence.

Only apps with a readable member list qualify, because without one there is nothing to check the attestation against. Loom, Figma, Miro, Airtable and 1Password were all considered and none of them expose one on a plan you'd already be paying for, so they aren't here.

Where your people come from

Your HR system feeds Karmoto. Karmoto never writes back to it.

These aren't apps we provision into — they're where the hire and the termination originate. Payroll and benefits stay exactly where they are.