SafePaaS sells one platform for identity security, compliance automation and enterprise risk management, aimed at organisations that run their finances and operations on ERP and other business applications. It governs who can do what inside those systems, checks that access against business controls, and produces the evidence auditors ask for.
Its buyers are finance, audit and identity teams who answer to regulators and auditors for what happens inside systems such as Oracle and SAP, where a single excess permission can let one person both create and pay a supplier.
At A Glance
| Vendor | SafePaaS |
|---|---|
| Category | Identity governance, segregation of duties, compliance automation and enterprise risk |
| Identities covered | Human users, privileged accounts, service accounts, API accounts and AI agents |
| Deployment | Federated governance platform alongside or instead of existing identity governance tools |
| Certifications | AICPA SOC 2 |
| Customers | Millicom Tigo, JTEKT, CABEI, Femsa, Pennsylvania Treasury |
| Market classification | Governance, Risk & Compliance; also Identity Governance & Administration |
What SafePaaS Does
In an ERP system, an access right is also a financial power: the ability to create a supplier, approve a payment or change a configuration. SafePaaS ties identity data to that business context, including ERP responsibilities, approval authority and transaction impact, so each access decision reflects the financial risk it carries. Segregation of duties checks run before access is granted, and conflicts are “stopped before access is used” rather than found in a later review. The platform can run on its own or sit on top of identity governance tools a customer already owns. Its compliance content covers SOX, PCI DSS, OMB Circular A-123 and GDPR, and the company also provides professional risk management services.
Products
AccessPaaS
AccessPaaS is the identity governance and administration module for teams responsible for who holds access in ERP and business applications.
- Access certification campaigns
- Lifecycle management for joiners, movers and leavers
- Segregation of duties and role management
- Identity visibility and intelligence
- Unified Privileged Access Management (UPAM), which extends privileged access control beyond the ERP layer to operating systems, databases, applications and cloud infrastructure
MonitorPaaS
Finance and audit teams use MonitorPaaS to see what happens after access is granted. It governs transactions and configuration inside connected applications and tracks changes over time.
ARCPaaS And ProcessPaaS
ARCPaaS supports audit, risk and compliance work, while ProcessPaaS handles process controls and workflow, giving compliance teams one place to run control testing and remediation.
DataProbeETL And DataPaaS
DataProbeETL discovers data and traces its lineage across sources. DataPaaS manages and analyses identity data, so governance decisions rest on a clean picture of users and entitlements.
SafeInsight And SafeIQ
The two analytics tools sit on top of the other modules. SafeInsight provides cost and risk analytics for managers who need to see where access risk is concentrated, while SafeIQ lets users question their identity risk data in natural language.
How It Works
| Component | What it does |
|---|---|
| Federated governance layer | The platform sits across ERP and business applications as a single federated layer, working with an existing identity governance tool or standalone. |
| Connectors | More than 25 native connectors link it to over 250 governed applications, and every connector feeds the same policy engine and evidence trail. |
| Data flow | Identity and entitlement data is pulled from connected systems, evaluated by the policy engine before access is granted, and activity is then watched inside the applications. |
| Hosting | Cloud applications run on Oracle Cloud Infrastructure, including in the European Union, which gives data residency for customers there. |
Identities And Systems Covered
| Human users | ERP and business application users through the joiner, mover and leaver lifecycle |
|---|---|
| Non-human identities | Service accounts, API accounts and AI agents, governed as resources that carry the same business risk as people |
| Privileged accounts | Operating systems, databases, applications and cloud infrastructure |
| ERP systems | Oracle E-Business Suite, Oracle ERP Cloud, PeopleSoft, NetSuite, JD Edwards, SAP ECC and S/4HANA, Microsoft Dynamics and Salesforce |
| Procurement and people systems | SAP Ariba, SAP Concur, SAP SuccessFactors, SAP Commerce Cloud, Coupa and Workday |
| Other business applications | Kyriba, IBM TRIRIGA and Planview, plus AWS |
Integrations
| Area | Integrations |
|---|---|
| Identity platforms | Okta, Microsoft Entra ID, SailPoint |
| IT service management | ServiceNow |
| Security tooling | Splunk, CrowdStrike, Palo Alto, Zscaler |
Company Background
| Headquarters | Plano, Texas, United States |
|---|---|
| Leadership | Adil Khan (Chief Executive Officer) and Hennie Vermeulen (Chief Technology Officer) |
| Platform launch | 2017 |
| Scale | More than 250 reported customers, 9.5M ERP users governed and 445M segregation of duties violations processed |
| Recognition | Included in the 2026 Gartner Market Guide for Identity Governance and Administration |
Note: This overview is compiled from SafePaaS’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.