Prune
Prune for SaaS teams

Add access lineage without replacing your auth stack.

Your application keeps issuing and revoking credentials. Prune receives signed lifecycle events, checks what your instrumentation can prove, and gives customers a precise recovery workflow when access becomes untrusted.

Create integration workspace →Inspect the working reference app
The contract

Your servers report facts. Prune builds provenance.

Northstar uses these same application services in-process. External SaaS products use the signed event API and receive narrowly scoped revocation requests.

  1. 01
    Observe first

    Create a test environment and link an internal account reference. Enforcement remains off.

  2. 02
    Send signed lifecycle events

    Record login, credential creation, usage, and revocation without sending raw secrets.

  3. 03
    Close coverage gaps

    Consistency checks expose credential types or active access paths your integration cannot yet explain.

  4. 04
    Enable controlled revocation

    Approved plans produce signed, idempotent webhook deliveries with independent confirmation.

Trust boundary

Prune does not need your database or customer secrets.

Your application retainsPasswords, raw API keys, access tokens, provider credentials, and the final authorization decision.
Prune receivesStable credential references, parent-child relationships, status, timestamps, and allow-listed security metadata.
Prune returnsCoverage gaps, containment plans, signed revocation instructions, verification results, and an audit receipt.
Start safely

Connect one credential type. See what is still missing.

The gradual path is the product: test mode, visible coverage, then enforcement only when the integration is trustworthy.

Open the integration console →