Zoho People

Access

HR System

Mycroft syncs the Zoho People roster and uses joining and exit dates to evidence provisioning and access removal.

The employment record holds the dates personnel controls are tested against. Mycroft reconciles the roster against every connected system and measures the interval from each exit to account removal.

Find out more

How Mycroft connects to Zoho People

How it connects: An administrator authorizes Mycroft against your Zoho People account.
What Mycroft can access: Read-only employee directory data.

Which controls Zoho People evidence maps to

Each row is a control an auditor tests and the specific artifact Mycroft collects from Zoho People to satisfy it. Collection runs on a schedule and every result is timestamped.

Zoho People compliance control mappings and the evidence Mycroft collects for each
Framework	Control	What it requires	Evidence collected from Zoho People
SOC 2	CC1.4	The entity retains competent personnel with defined responsibilities.	Employee roster with designation, department and reporting manager, used as the population for personnel controls.
SOC 2	CC6.2	Access is registered and authorized before credentials are issued.	Date of joining per employee compared with the creation date of each account they hold in connected systems.
SOC 2	CC6.3	Access is removed when no longer required.	Date of exit per departure with the measured interval to removal of each downstream account.
ISO 27001	A.6.1	Background verification checks are completed prior to employment.	Screening status relative to joining date, with exceptions surfaced for documented handling.
ISO 27001	A.6.3	Personnel receive appropriate security awareness training.	Training assignment and completion tracked against the live employee roster rather than a static export.
ISO 27001	A.6.5	Post-employment responsibilities are defined and enforced.	Exit and role-change events linked to the corresponding access removal or modification records.
HIPAA	§164.308(a)(5)	Security awareness and training is provided to the workforce.	Completion status for every current workforce member, with the population sourced from the HRIS.

What Mycroft collects automatically

Gathered from Zoho People on a schedule, dated and stored against the controls above.

Employee roster with status, designation, department and reporting manager
Date of joining for provisioning evidence
Date of exit for offboarding interval measurement
Employment type, distinguishing permanent staff from contract engagements
Role and department change history for access recertification
Policy acknowledgement and training completion against the live roster

Manual work this removes

The tasks that disappear from someone's quarter once Zoho People is connected.

Exporting and reformatting employee lists each quarter for the access review
Reconciling exits against system accounts by hand
Keeping a separate training tracker aligned with the roster
Identifying accounts belonging to former employees

Often connected alongside:

All integrations →

Zoho People and Mycroft: frequently asked questions

The read-only employee directory used for the personnel controls.

The date of exit becomes a measurable clock. Mycroft compares it against the removal time of every account the person held across connected systems and reports the interval, which is the figure an auditor computes when testing whether access is removed within your stated window.

Yes, if it is where every hire and departure is recorded. If some staff are engaged through another system (an EOR, or a regional HRIS) connect that too, so the merged roster covers the full workforce population that personnel controls are tested against.

We turn the compliance nightmare into a dream

Talk to us