Ploy is an identity governance platform for organisations that run on SaaS. It connects identity providers, HR systems and business applications, turns their accounts and entitlements into one system of record, and then runs the governance work on top of it: access requests, joiner, mover and leaver changes, access reviews and audit evidence.
It is aimed at growing companies that have outgrown spreadsheets for access control, and it extends the same ownership model to machine identities and AI agents.
At A Glance
| Vendor | Ploy (Join Ploy Ltd) |
|---|---|
| Category | Identity governance and administration |
| Identities covered | Employees, service accounts, API keys, service principals, OAuth apps and AI agents |
| Deployment | Cloud platform with agentless connectors |
| Agentic AI | Luna governance agent, AI agent governance |
| Customers | Luno, Avantia Law, Liberis, PayFit, ComplyAdvantage |
| Funding | Backed by Osney Capital, Superseed, Tiny.vc and Rule30 |
| Market classification | Identity Governance & Administration |
What Ploy Does
Many growing companies still track who has access to what in spreadsheets, which leaves gaps when people join, change roles or leave and makes audits slow. Ploy’s aim is to be “one place to see and govern every identity, app and grant.” It builds an inventory of every account and permission across the connected estate, assigns each one an owner, and keeps that inventory current as people and systems change.
Governance processes then run against that inventory rather than against exported lists. Access is granted, re-decided and removed as HR events happen, reviews are scoped and chased automatically, and every change leaves evidence that can go straight to an auditor.
Products
Access Requests And Lifecycle
This module handles the day-to-day flow of access. Joiners, movers and leavers have their access re-decided as changes happen, so people get what they need on day one and lose it when they move on. Just-in-time access lets staff request elevated permissions for a limited time, and workflows and policies modules set who approves what.
Access Reviews
Access reviews are built for teams preparing for SOC 2 or ISO 27001 audits, with templates such as a SOC 2 Compliance Review. Luna scopes each cycle, chases reviewers and verifies every revocation, but nothing changes until a reviewer certifies it. Closing a cycle produces a hashed certificate recording department, MFA status and last-used data for each grant.
Non-Human Identities
Service accounts, API keys, service principals, OAuth apps and API tokens tend to outlive the projects that created them. Ploy discovers them, classifies each one and pins its type against future scans. Federated identities show issuer, subject and audiences, and every identity is given an owner: the team that uses it, and the person who answers for it.
Identity Security Posture And Access Graph
These modules show how access connects across people, apps and machines, and turn findings such as agents with no owner into a risk score.
How It Works
Ploy runs as a cloud service that reaches customer systems through connectors, with “No agents, no scripts, no CSV round trips.”
| Component | What it does |
|---|---|
| SaaS connectors | Prebuilt connectors cover identity, HR, infrastructure, security and business applications, and a connector can be built for any SaaS application with an API. |
| On-premise connector | For systems that do not run in the cloud, an on-premise connector reaches the application where it already runs. |
| System of record | Data from every connector is merged into one inventory of identities, accounts and entitlements, which every module and Luna act on. |
Identities And Systems Covered
| Workforce users | Employees, sourced from HR systems and identity providers |
|---|---|
| Service accounts and keys | Service accounts, API keys and API tokens |
| Workload identities | Service principals, OAuth apps and federated identities |
| AI agents | Microsoft Copilot Studio agents, Power Virtual Agents runtime service principals and Entra agent identities |
| Systems | SaaS applications, AWS, Azure, Google Cloud Platform and on-premise applications |
Agentic AI Capabilities
Luna
Luna takes on jobs one-off or on patrol. Each action type is set to auto-approve, guarded, needs approval or blocked, and when nothing is configured she asks first. Under needs approval, Luna proposes the action, shows her reasoning and waits for a yes, while destructive actions can be hard-blocked. Trust levels include Observer, Supervised and Custom. Luna is in use at a reported 22 organisations.
Agent Governance
Agent governance finds every named agent in a tenant and gives each a record, a type and an owner slot, because every agent gets a person. It separates access an agent holds itself from access delegated to it, flags grants that let an agent act for any signed-in user, and includes agents in the same review campaigns as apps and people.
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Okta, Microsoft, Google Workspace, JumpCloud, Keycloak |
| HR and people | Workday, BambooHR, HiBob, Personio, SAP SuccessFactors, Lattice |
| Data and observability | Datadog, Snowflake, Tailscale |
| Security | CrowdStrike, Duo Security, Zscaler, Cloudflare Zero Trust, Keeper, LastPass |
| SaaS and source control | Salesforce, Slack, Atlassian, Jira, Zoom, OpenAI, Anthropic, GitHub, GitLab |
Company Background
| Headquarters | London, United Kingdom |
|---|---|
| Leadership | Jacob Prime, CEO and co-founder; Harry Lucas, co-founder |
| Funding | £2.5 million announced on 15 October 2025, led by Osney Capital, plus angel investors |
Note: This overview is compiled from Ploy’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.