People

​

Overview

The People module is where you manage the humans in your compliance program — employees, contractors, and team members. It is separate from user accounts: someone can be tracked as an employee in People without having a Matproof login. Key use cases:

• Access review evidence for ISO 27001 A.8.2 and SOC 2 CC6.2
• Security awareness training tracking and attestation
• Offboarding checklists to ensure access is revoked on departure
• Device inventory for ISO 27001 asset management and DORA endpoint security

​

The People dashboard

Go to People → Dashboard for a real-time compliance overview of your workforce:

• Training completion rate across the team
• Offboarding tasks past due
• Devices with unresolved compliance issues
• Access reviews due or overdue

​

Adding employees

​

Manual entry

1. Go to People → All
2. Click Add person
3. Fill in name, email, role, and department
4. Optionally set their start date and manager

​

Import from Google Workspace or Microsoft 365

If you have the Google Workspace or Microsoft 365 integration connected, you can sync your directory automatically:

1. Go to Settings → Integrations and connect Google Workspace or Azure AD
2. Go to People → All → Import
3. Select your connected directory and click Sync

Matproof maps directory users to People records and keeps them in sync. New hires and departures are reflected automatically.

​

Employee profile

Each employee record tracks:

​

Tracking security training

Assign training to employees and track completion:

1. Open an employee record → Training tab
2. Click Assign training
3. Select the training module (security awareness, GDPR, acceptable use policy, etc.)
4. Set a due date
5. The employee receives an email with a link to complete it

Matproof records completion timestamps and generates a training log you can export as evidence for auditors.

​

Running access reviews

Access reviews demonstrate that only the right people have access to the right systems — a core requirement for ISO 27001, SOC 2, and NIS 2.

1. Go to People → All → click Start access review
2. Select scope: all employees or a specific department
3. Reviewers (typically managers) confirm or revoke access for each system
4. Matproof generates a timestamped access review report when complete

​

Offboarding

When an employee leaves:

1. Open their record → click Start offboarding
2. Matproof generates a checklist: revoke system access, collect devices, archive accounts, notify HR, etc.
3. Each task is assigned to a responsible person with a due date
4. Mark tasks complete as they are done
5. Close the offboarding when all tasks are done

The completed offboarding record serves as evidence that access was revoked in a timely manner.

​

Devices

Go to People → Devices to see every device registered against an employee, what compliance signals it’s reporting, and any open vulnerabilities.

​

How devices get into Matproof

Three ways:

1. Matproof Device Agent (recommended) — install the Matproof Device Agent on each user’s machine. The agent reports endpoint compliance signals every hour (FileVault, screen lock, OS patch level, antivirus, firewall, MDM enrollment) plus a 6-hourly software inventory matched against the NVD CVE database. This is the path that produces actual evidence on endpoint controls.
2. MDM sync — if you operate an MDM (Jamf, Kandji, Microsoft Intune), connect it as an integration. Matproof imports the device list and combines it with what the device agent reports.
3. Manual entry — for devices that can’t run the agent (Linux until GA, vendor-managed machines), add them by hand for asset-inventory purposes.

The Matproof Device Agent and an external MDM are not mutually exclusive — use the agent for compliance signals and the MDM for fleet management; Matproof reconciles them.

​

What’s tracked per device

Failed checks and high-severity CVEs raise Findings automatically and surface against the relevant control.