Frequently Asked Questions

Answers to the questions we hear most often, grouped by topic. Can't find what you're looking for? Contact support.

Features

What is the Workflow Automation Engine and how does it work?

The Workflow Automation Engine lets you build no-code rules that trigger actions automatically as an offboarding progresses. You define a trigger - such as a status change (e.g., "entered IT Revocation"), a time condition (e.g., "7 days before exit date"), or an event (e.g., "all checklist items completed") - and pair it with an action: send an in-app notification, fire a templated email, auto-assign a checklist template, or advance the offboarding to the next stage. Rules run silently in the background, eliminating the manual follow-up that usually falls through the cracks. You can test any rule instantly from the Settings → Automations panel before activating it in production.

Does PurpletGo support e-signatures? Which providers?

Yes - PurpletGo supports three e-signature providers:

• DocuSign - connect using your DocuSign account ID and access token. PurpletGo creates a DocuSign envelope, sends the signing email, and receives webhook callbacks via DocuSign Connect when the document is signed or declined.
• Adobe Acrobat Sign - connect with your OAuth access token. PurpletGo uploads the document as a transient asset, creates an agreement, and receives status updates via Adobe Sign webhooks.
• Dropbox Sign (formerly HelloSign, in beta) - connect with your Dropbox Sign API key.

E-signature is available on every plan.

Connect your preferred provider in Settings → Integrations → E-Signature Providers. Once connected, a 'Send for Signature' button appears on every uploaded compliance document (NDAs, severance agreements, exit letters, IP assignments, etc.). Signing status is tracked in real time - pending, signed, declined, or cancelled - and every signed event is written to the tamper-evident audit log.

How does the employee self-service portal work?

HR sends a departing employee a private link to their personal email - no account creation required. Before anything loads, they enter a one-time code, sent by text when SMS is set up and a personal mobile is on file, otherwise by email. The portal gives the employee a complete offboarding experience: My Tasks, Equipment Return, Benefits & COBRA, Reference Letters, and Alumni Network. Every interaction is timestamped in the audit log so HR has a complete record without any back-and-forth.

What is knowledge transfer tracking?

Knowledge transfer items are structured tasks attached to an offboarding that track which documentation, credentials, and responsibilities have been handed off before the exit date. Each item has a title, description, assignee, and completion status - separate from the main checklist so they can be reviewed independently.

How does exit interview scheduling work?

Exit interview scheduling (Team and Enterprise plans) lets HR book interview slots directly from the offboarding record - no spreadsheet juggling or email back-and-forth.

Calendly: Connect a Calendly personal access token in Settings → Integrations → Exit Interview Scheduling. On any offboarding, pick an event type (e.g. your '30-minute exit interview' meeting type) and PurpletGo generates a one-off Calendly booking link. The employee visits the link and self-selects a slot. When they book, Calendly fires a webhook to PurpletGo which automatically records the date, time, and video meeting link on the offboarding record. Cancellations are also synced in real time.

Google Calendar: Connect Google Calendar via OAuth (Settings → Integrations → Exit Interview Scheduling). On any offboarding, pick a date/time and duration. PurpletGo creates a Google Calendar event with a Google Meet conference link and sends calendar invites to both the HR interviewer and the departing employee - all in one click. The Meet link is stored on the offboarding record.

Manual: If no provider is connected, HR can still record a scheduled date, time, duration, meeting link, and interviewer name manually.

All three flows write the schedule to the audit log. The status tracks the full lifecycle: Pending → Scheduled → Completed → Cancelled.

What is the Offboarding → Onboarding Bridge?

The Onboarding Bridge (Team and Enterprise plans) lets HR kick off a replacement hire's onboarding checklist directly from a completed offboarding record - closing the loop between someone leaving and their replacement arriving.

How it works:

1. Open any offboarding that has reached the Completed stage.
2. The "Replacement Onboarding" card appears at the bottom of the record. Click "Start Onboarding".
3. PurpletGo pre-fills the new hire's role and department from the departing employee. Enter the new hire's name, email, start date, and hiring manager email.
4. PurpletGo creates an onboarding record and seeds a default checklist of 15+ tasks automatically - categorised by Admin, IT, HR, Culture, and Role. Engineering, Sales, and HR roles get additional role-specific tasks.
5. All org admins and HR members receive an email notification with the hire details and task count.

Managing onboardings: The "Onboarding" page (sidebar → People & Workflow) shows all active replacement onboardings across the org, with progress bars, status filters (Pending / In Progress / Completed / Cancelled), and links back to the originating offboarding record.

Task management: Each task can be checked off directly from the employee detail page or the dashboard. The progress bar updates in real time.

How does exit interview form builder work?

Admins create custom templates with text, rating scale, and multiple-choice fields (Settings → Exit Interviews) and assign them to offboarding cases. When an employee submits their responses, PurpletGo automatically runs AI sentiment analysis on all open-text answers. Each response receives a sentiment label, a score, a one-sentence AI summary, and up to 3 themes (compensation, management, career growth, work-life balance, culture, etc.). The Analytics page has a dedicated Exit Interviews tab showing sentiment trends, average scores by department, and a Retention Signals panel. On Team and Enterprise plans, the AI HR Copilot can also generate a full quarterly summary report across all exit interviews - see below.

What is the AI HR Copilot and what can it do?

The AI HR Copilot (Team and Enterprise plans, Analytics → AI Copilot tab and Employee Detail page) extends the base AI assistant with three advanced capabilities:

1. Document Drafting - on any offboarding record, click Generate Draft to produce a complete, personalised Exit Letter or Separation Agreement. Choose the document type, add optional context (severance amount, specific clauses), and the AI fills in the employee's name, role, tenure, last working day, and company details. The draft is displayed inline with a one-click copy to clipboard. Always review with legal counsel before sending a separation agreement.

2. Quarterly Exit Interview Summary - select any year and quarter, then click Generate Report. The AI synthesises all exit interview responses for that period into an executive report: a 2–3 sentence overview, key themes ranked by frequency and sentiment, per-department insights with trend direction (improving/stable/declining), prioritised recommendations, and action items with owner and urgency.

3. Resignation Risk Predictions - click Run Analysis to identify which departments are at elevated risk of voluntary resignations in the next 30 days. The AI analyses the last 90 days of offboarding data - resignation count per department, SLA breach rates (a disengagement proxy), and average checklist completion speed - then returns at-risk departments with risk level, supporting signals, early warning signs, and recommended retention actions. Results are cached per day to avoid repeated AI calls.

Can PurpletGo draft exit letters and separation agreements automatically?

Yes - on Team and Enterprise plans. On any employee offboarding record, scroll to the AI Document Drafter card. Select Exit Letter (warm, professional tone acknowledging contributions and final-day logistics) or Separation Agreement (formal legal structure with sections for severance, confidentiality, non-disparagement, and release of claims). Add any optional context - such as a specific severance amount, a non-compete clause reference, or notable contributions to mention. The AI fills in the employee's name, role, department, company name, last working day, separation type, and tenure automatically from the offboarding record. The draft appears inline and can be copied to clipboard in one click. For separation agreements, always have legal counsel review before sending.

How does the quarterly exit interview summary work?

In Analytics → AI Copilot tab, select a year and quarter and click Generate Report. PurpletGo pulls all exit interview responses submitted during that period, aggregates sentiment scores, groups by department, and collects the top recurring themes. The AI then produces an executive-level quarterly report covering: a concise overview paragraph, key themes with frequency (high/medium/low) and sentiment direction (positive/neutral/negative), per-department insights with a trend signal (improving/stable/declining), a prioritised list of HR recommendations, and specific action items with suggested owner (HR/Leadership/Management) and priority. Results are cached per unique data snapshot so repeated views don't incur additional AI costs.

How does PurpletGo predict which departments are at resignation risk?

The Resignation Risk Predictions panel (Analytics → AI Copilot tab, visible to HR, admin, and superadmin roles) analyses the last 90 days of offboarding data to surface departments at elevated risk of voluntary resignations in the next 30 days. Signals used: voluntary resignation count per department, SLA breach rate per department (high breach rates indicate disengagement - tasks being ignored), and average checklist completion speed (slower completion = lower engagement). The AI cross-references these signals to rank departments by risk level (high/medium/low), identify specific warning signs, and recommend concrete retention actions with urgency (immediate/short-term/ongoing). Predictions are cached for 24 hours so the report refreshes once per day with the latest data.

How do reference letters and background check verification work?

The Reference & Background Check Portal (Team plan and above) covers two workflows. Reference letters: managers or HR admins write structured references for departing employees, choosing the type (general, technical, character, or performance). Background check requests: when a new employer requests verification, HR logs the request in PurpletGo, records contact details, and fills out a structured verification response covering employment dates, job title, department, rehire eligibility, salary disclosure decision, and reason for leaving. Every action is captured in the audit log.

How does equipment return tracking work for remote employees?

Send the employee a return label from your own carrier account, then record the carrier and tracking number on the offboarding (every plan). PurpletGo links to the carrier's tracking page, and when the package arrives, marking it received marks the assets inside it returned. Photos of the returned equipment can be attached to document its condition. PurpletGo does not create or pay for shipping labels.

How do multi-step approval workflows work?

On Team and Enterprise plans, HR admins can create named approval chains from Initiations → Settings → Multi-Step Approval Chains. Each chain is a sequence of steps - for example: Manager (24h SLA) → HR (48h SLA) → Legal (72h SLA). When a new offboarding initiation is submitted, the configured chain attaches automatically and the first-step approver is notified by email and in-app. Each step can target a role (any user holding that role can approve) or a specific person. If an approver is out of office they can delegate their step to a colleague - the delegation is recorded in the audit trail. SLA timers run per step. If the deadline passes without action, the approvers (and anyone they have delegated to for that day) are reminded by email and in-app, and HR and the person who asked are told the request is waiting. A day later the admins are told, and once more the day after; the request is then flagged Approval stalled on the Initiations page until a step is decided. Each escalation is in the step's history and the audit log. Once every step is approved, the offboarding record is created automatically. Every action - approve, reject, delegate, or escalate - is stored in an immutable per-step audit trail visible in the initiation detail view.

Does PurpletGo have a shared calendar for offboarding milestones?

Yes - the Org-Wide Offboarding Calendar (Team plan and above) shows all upcoming offboarding events in a month-view grid: Last Working Day, IT Revocation Deadline, and Asset Return Deadline. Filter by department. Export the entire visible month as a standards-compliant .ics file to import into Google Calendar, Outlook, or Apple Calendar.

Can I bulk-advance or delete offboarding records?

Yes. On the Kanban board you can select multiple cards using checkboxes, then advance them to the next stage, revert them, or delete them in one action. This is especially useful during large-scale restructuring or layoffs where dozens of cases need to move simultaneously.

How does bulk offboarding initiation work for layoffs and RIFs?

PurpletGo supports two bulk offboarding workflows:

CSV Import (recommended for RIFs): Upload a spreadsheet with one employee per row. Required columns are email, full name, and exit date (YYYY-MM-DD). Optional columns: resignation date, separation type, role, department, and notes. The four-step wizard auto-detects column headers, lets you remap them, and shows a per-row validation preview before anything is created. Each row can have its own exit date and separation type - ideal when a reduction-in-force affects different teams on different dates. Invalid rows are skipped with an inline error message; valid rows are submitted as a single named batch.

Directory selection: Select up to 200 employees from the Employee Directory, set a shared exit date and separation type, and click Bulk Offboard.

In both cases, PurpletGo creates each offboarding in its own database transaction - a failure on one row never blocks the others - and groups all created records under a shared batch ID visible on the Bulk Batches dashboard. Employees who already have an active offboarding are automatically skipped.

Can I import my employee directory from a CSV file?

Yes - on all plans. The CSV Import wizard walks you through four steps: Upload, Map columns, Preview (with per-cell validation errors), and Done. The server enforces a hard cap of 500 employees per import batch and full field-level validation on every row.

What separation types does PurpletGo handle?

Every offboarding case is classified by separation type: resignation, termination, layoff, retirement, or contract end. This classification flows through to analytics, audit exports, and checklist template selection - so you can have different workflows for a voluntary resignation vs. a layoff.

What analytics and reports does PurpletGo provide?

The Analytics page shows offboarding velocity (started vs completed each month), average completion time (creation to completion) by department and separation type, and bottleneck detection - the checklist tasks most often still open. Pick any date range; figures follow each user's department limits, and downloads need the export permission. Team and Enterprise plans include the SLA Compliance Dashboard with historical compliance rates, breach trend charts, and worst-performing task rankings, plus Scheduled Reports v2 - a custom report builder that delivers tailored offboarding data directly to your stakeholders' inboxes with an optional board-ready PDF attachment.

How does Scheduled Reports v2 work?

Available on Team and Enterprise plans, Scheduled Reports v2 (Settings → Reports) gives Super Admins and Admins a full custom report builder:

• Report types: Weekly Summary, Monthly Summary, Offboarding Stats, Overdue Tasks, or fully Custom.
• Column selector: choose from 14 data columns - employee name, email, role, department, separation type, exit date, status, resignation date, completion days, pending/completed/overdue task counts, legal hold flag, and created date.
• Filters: narrow data by status, department, or separation type; the summary and the rows both follow them.
• Group by: optionally group report rows by department, separation type or status (and assignee for the Overdue Tasks report) - both in the email and PDF.
• Date range presets: Last 7 days, 30 days, 90 days, last month or last quarter (the previous calendar month or quarter), last year, or all time.
• Schedule: daily (every day), weekly (every Monday), or monthly (1st of month), in UTC.

Delivery options: • Distribution lists: create named groups of email addresses (e.g. 'Board', 'HR Leadership') and select one per report - recipients are merged with any direct addresses. • Direct recipients: add individual emails alongside or instead of a list. People who aren't users in your organisation get the report without names and email addresses. • Board-ready PDF attachment: when enabled, each delivery includes a branded PDF - org logo in the header, an executive summary KPI panel (total, completed, active, overdue, avg days, legal hold), data tables with optional grouping, page numbers, and a PurpletGo-branded footer. • Webhook delivery: optionally POST a JSON summary payload (report ID, org name, date range, KPI totals, row count) to a public HTTPS endpoint on each delivery - for dashboards, Slack bots, or data pipelines. Redirects aren't followed.

If a delivery fails, the report shows the error in Settings → Reports, and a report where no email went out is retried the next hour.

What are distribution lists in PurpletGo?

Distribution lists (Settings → Reports → Distribution Lists) are reusable named groups of email addresses - for example 'Board of Directors', 'HR Leadership', or 'Compliance Team'. You create a list once and select it when configuring any scheduled report. When a report fires, PurpletGo merges the list's addresses with any direct recipients and deduplicates before sending. You can create as many lists as needed, each with up to 100 email addresses.

What is the SLA Compliance Dashboard?

Available on Team and Enterprise plans, the SLA Compliance Dashboard lives under Analytics → SLA and gives HR and operations managers a historical view of how well the team is meeting checklist task deadlines.

Key metrics:

• Overall compliance rate - % of SLA-tracked tasks completed on time across the org
• Compliance by department - colour-coded rate bars (green ≥80%, amber ≥50%, red under 50%) so you can spot problem areas at a glance
• Trend - weekly or monthly charts of breaches and compliance rate for the date range you pick (up to 2 years), tasks grouped by their SLA deadline
• Worst-performing tasks - a ranked table of checklist task names by breach rate, filtered to tasks with at least 2 SLA instances

The Export CSV button (with the Export analytics permission) downloads a row-level report for the same range - task name, employee, department, assignee, SLA hours, SLA deadline, completed status, breached flag, completed timestamp, and overdue-by hours - ready to share in manager performance reviews.

Can offboarding emails be sent from our own email domain?

Yes - on Enterprise plans. Set a custom sender name and address (e.g. no-reply@acme.com) in Settings → Branding. Add the verification TXT record shown on that page (purpletgo-verification=...) to your sender domain's DNS, then hit Verify - PurpletGo confirms you own the domain before activating the custom sender. An SPF record alone isn't enough; the page also reports whether your SPF record includes PurpletGo, for deliverability. All portal invitation and checklist emails are then delivered from your domain rather than noreply@purpletgo.com.

Does PurpletGo have an AI assistant for offboarding?

Yes - on Team and Enterprise plans. The AI Offboarding Assistant adds intelligence to three areas: checklist suggestions (role-based, up to 10 missing tasks with priority ratings), risk scoring (0–100 risk score with specific remediation recommendations), and knowledge transfer summarization (AI-drafted structured handoff document from KT notes and exit interview responses).

What are Predictive Offboarding Alerts?

Predictive Offboarding Alerts (Team and Enterprise plans) give HR teams a proactive heads-up before an employee decides to leave. A nightly scoring engine assigns every active employee a 0–100 flight risk score based on tenure, department attrition rate, peer departures, and exit interview sentiment. Employees are banded as Low, Medium, High, or Critical. HR can filter by risk band and drill into per-employee risk factors.

Does PurpletGo handle contractor and vendor offboarding differently from full-time employees?

Yes. PurpletGo has a dedicated Contractor / Vendor Offboarding workflow designed for contingent workers. When you add someone to the employee directory you can tag them as Contractor or Vendor, optionally recording their contract end date and the agency or company they work through. When that contract end date arrives, PurpletGo automatically creates the offboarding record and applies a shorter checklist - focused entirely on access revocation, asset return, contract closure, and NDA acknowledgement - with no payroll, COBRA, or benefits steps. For contractors with access to external third-party systems, the Vendor Access panel lets IT and HR track every system the contractor had access to (Salesforce portals, vendor APIs, VPNs, databases), record the contact email for each vendor, and log a per-system revocation note and timestamp when access is confirmed removed. Every revocation event is written to the audit log.

How does the contract expiry auto-offboarding work?

Once a contractor's contract end date is set in PurpletGo, a nightly job checks for contractors and vendors whose contract ends that day. If no active offboarding already exists for that person, PurpletGo automatically creates an offboarding record with separation_type = contract_end, applies the contractor checklist (no payroll or benefits steps), and emails all org admins and HR members to let them know the workflow has started. This means you never need to manually remember to kick off a contractor offboarding - the system handles it the moment the contract expires.

How does third-party vendor access revocation tracking work?

The Vendor Access panel (visible on the offboarding detail page for contractors and vendors) lets IT admins and managers log every external system a contractor had access to - for example, a Salesforce org, an AWS contractor account, a client VPN, or a vendor billing portal. For each entry you record the vendor name, system name, access type (Account, API Key, VPN, Portal, Database, Other), and optionally a contact email at the vendor. When access is confirmed removed, you click Revoke, add an optional revocation note (e.g. 'Account deactivated via Salesforce Admin on 2026-05-01'), and the entry is timestamped with who revoked it. All create, revoke, and delete actions are written to the tamper-evident audit log, giving you a permanent record for security reviews and contract completion audits.

Does PurpletGo have a public REST API?

Yes - on Team and Enterprise plans. The PurpletGo public REST API (/api/v1) lets you automate offboardings, read employee data, and receive real-time events via webhooks from your own HRIS, scripts, or internal tooling.

Authentication: API keys use the format pgo_live_<32hex> and are passed as a Bearer token. Each key is scoped to one or more permissions: offboardings:read, offboardings:write, employees:read, webhooks:read, webhooks:write.

Endpoints available:

• GET /api/v1/offboardings - List offboardings (filter by status, department, pagination)
• GET /api/v1/offboardings/:id - Get a single offboarding record
• POST /api/v1/offboardings - Create a new offboarding programmatically
• PATCH /api/v1/offboardings/:id - Update offboarding status
• GET /api/v1/employees - List employee profiles
• GET/POST/DELETE /api/v1/webhooks - Manage outbound webhook endpoints
• GET /api/v1/webhooks/:id/deliveries, POST /api/v1/webhooks/:id/deliveries/:deliveryId/redeliver - A webhook's delivery log, and sending a failed delivery again

Webhooks: Register an HTTPS endpoint to receive real-time events (offboarding.created, offboarding.stage_changed, offboarding.completed, offboarding.deleted, revocation.completed, revocation.failed, asset.returned, asset.overdue, checklist.completed, document.signed). Events are delivered with an HMAC-SHA256 signature in the X-PurpletGo-Signature header so you can verify they came from PurpletGo.

Rate limit: 120 requests / 60 seconds per API key.

OpenAPI spec: A machine-readable OpenAPI 3.0.3 specification is available at /api/v1/openapi.json for import into Postman, Insomnia, or any code generator.

Full endpoint-by-endpoint reference: API Reference

Integrations

What is SCIM provisioning and how does it work in PurpletGo?

SCIM (System for Cross-domain Identity Management) is an open standard that lets identity providers push user lifecycle events - provisioning, updates, and deprovisioning - directly to connected apps. In PurpletGo, Team and Enterprise plans can generate a per-org SCIM 2.0 Bearer token in Settings → Integrations. You paste the PurpletGo SCIM endpoint URL and token into your IdP (Okta, Azure AD, JumpCloud, OneLogin, or any SCIM-compatible provider), and from that point on, whenever your IdP deprovisions a user, PurpletGo automatically creates a termination offboarding record for that employee. No polling, no manual triggers - the entire offboarding process is initiated the instant the IdP signals a user removal.

Which identity providers does PurpletGo support for direct access revocation?

On every plan, PurpletGo revokes access in Google Workspace (account suspend, session sign-out, token revoke, group removal), Okta (user deactivation + session clear), and Microsoft 365 / Azure AD (account disable, sign-in session revoke, license removal, mailbox OOO), alongside apps such as GitHub (org member removal). JumpCloud (account suspend), OneLogin (account suspend), and Ping Identity (account disable) are in beta and part of the Enterprise plan. When an employee is offboarded you simply tick the providers to revoke, and PurpletGo works through them one at a time, giving each vendor 30 seconds to answer. Every action is timestamped in the audit log.

How does PurpletGo deprovision Microsoft 365 and Azure AD accounts?

When 'Azure AD' is added to the access revocation list on an offboarding, PurpletGo runs five deprovisioning steps in parallel using the Microsoft Graph API: (1) Disable the Azure AD account - this immediately blocks access to every connected Microsoft app, including Teams, SharePoint, and OneDrive. (2) Revoke all active sign-in sessions - any existing browser or mobile session is invalidated within minutes. (3) Remove the user's group memberships. (4) Remove all assigned Microsoft 365 licenses - recovering the seat for reallocation the same day. (5) Set an out-of-office auto-reply on the departing employee's mailbox: colleagues are told to contact the manager's email on the offboarding (or "your manager" when there is none), and outside senders to use your main support channel. The auto-reply is on by default and can be turned off in the Microsoft 365 integration's settings. Each step is attempted independently so a partial failure doesn't block the others. Under legal hold, group memberships and licenses are kept so the mailbox and OneDrive are not scheduled for deletion. Every action is logged in the audit trail.

What integrations does PurpletGo support for access revocation?

Google Workspace, Microsoft 365 / Azure AD, Okta, Slack, GitHub, and AWS are generally available and included on every plan. Other access revocation integrations are labelled Beta and are also included on every plan, except JumpCloud, OneLogin, and Ping Identity (beta), which are part of Enterprise. HRIS sync (beta, Team and Enterprise) is supported for BambooHR, Workday, Rippling, Gusto, and ADP Workforce Now - with automatic termination detection that creates offboarding records without any manual step. IT ticket auto-creation with two-way sync (beta, Team and Enterprise) is supported for Jira, Freshdesk, ServiceNow, and Zendesk. Team and Enterprise plans also include a SCIM 2.0 endpoint so any IdP can push deprovisioning events directly to PurpletGo.

Does PurpletGo offer a public API for custom integrations?

Yes - on Team and Enterprise plans. The Developer Portal lets admins generate API keys with fine-grained scopes. The REST API follows standard conventions - JSON responses, page-based pagination, consistent error shapes. Rate limiting is enforced at 120 requests per 60 seconds per key. An OpenAPI 3.0 specification is served at /api/v1/openapi.json.

Does PurpletGo automatically create IT tickets?

Yes - on Team and Enterprise plans. PurpletGo auto-creates tickets in Jira, Freshdesk, ServiceNow, or Zendesk across three ticket types: access revocation, equipment return, and account deprovisioning. Two-way sync is built in - configure the generated webhook URL in your ticketing system and PurpletGo records the ticket as resolved the moment it is closed there. When every ticket for the offboarding is resolved, matching equipment tasks that are not tied to an asset record are closed. Tasks about removing access or accounts are never closed by a ticket, because a resolved ticket does not prove the access is gone: an app's "Revoke" task follows the recorded revocation result, and any other access task is left for a person to tick.

What are outbound webhooks used for?

You can register signed webhook endpoints to receive real-time event payloads when an offboarding is created, changes stage, is completed or deleted, when access revocation finishes or fails (with each app's result), when an asset is returned or overdue, when the checklist is completed, and when a document is signed. Webhooks are HMAC-SHA256 signed so your system can verify authenticity, retried for about a day and a half when your endpoint is down, and listed per endpoint in a delivery log where a failed delivery can be sent again. They are available on Team and Enterprise plans. Enterprise plans also include the full SIEM Export feature - stream security events to Splunk, Datadog, or any generic webhook target.

Which SIEM platforms does PurpletGo support?

PurpletGo supports six target types: Splunk (HTTP Event Collector), Datadog (Log Intake API), Elasticsearch, Sumo Logic (HTTP Source), New Relic (Log API), and a generic HMAC-signed JSON endpoint for anything else. You can configure multiple targets, filter which event types each one receives, and test delivery with a single click.

Does PurpletGo support Microsoft Teams notifications?

Yes - on every plan. Connect a Microsoft Teams incoming webhook from Settings → Integrations → Microsoft Teams to receive rich Adaptive Card notifications for every offboarding lifecycle event: stage transitions, new initiation requests, overdue tasks, SLA breaches, and document signatures.

On Team and Enterprise plans you can also register a Teams Outgoing Webhook to unlock interactive bot commands directly in any channel:

• @PurpletGo status <email> - look up the latest offboarding status for any employee
• @PurpletGo approve <uuid> - approve a pending initiation request and create the offboarding record
• @PurpletGo reject <uuid> - reject a pending initiation request
• @PurpletGo help - list all available commands

Both the incoming webhook notifications and the outgoing webhook commands are verified with HMAC-SHA256 so requests cannot be spoofed. All approve/reject actions performed via Teams are recorded in the tamper-evident audit log.

How does HRIS sync work?

Connect BambooHR, Workday, Rippling, Gusto, or ADP Workforce Now from Settings → Integrations. PurpletGo syncs your full employee directory and detects terminations automatically - when an employee's status changes to terminated or inactive in your HRIS, PurpletGo automatically creates a new offboarding record and notifies all org admins. Syncs run on a nightly schedule and can also be triggered on demand. A sync history log is available directly on the integrations card so you can see past sync results, employee counts, and any auto-created offboardings.

Security & Compliance

How does the Compliance Policy Engine work?

Available on Team and Enterprise plans. Enable any combination of SOC 2 Type II, HIPAA Security Rule, GDPR, ISO 27001:2022, and PCI DSS v4.0 frameworks from the Compliance → Policy Engine tab. PurpletGo seeds each framework with a pre-built checklist of offboarding-relevant controls. For each control you set a status, add internal notes, and attach evidence items manually. The Auto-Collect button scans your existing audit log for matching access revocation and deprovisioning events and attaches them to the relevant controls automatically. Export Report generates a structured JSON file formatted for hand-off to external auditors.

How does GDPR / CCPA data retention and erasure work?

PurpletGo's Data Retention & Privacy module (Team plan and above) covers three workflows. Retention policy: set a period and choose whether completed offboarding records should be anonymized or hard-deleted. Right-to-erasure requests: when a former employee exercises their GDPR Art. 17 or CCPA right to erasure, HR logs the request, an admin approves, then executes the anonymization in a single database transaction. Audit log entries are kept and the hash chain still verifies, but the person's names, contact details, IP addresses and notes in them are encrypted with a key for that person, which the erasure destroys in the same transaction: they then read [erased] in the audit log, in exports made afterwards and in the archived copies. Copies already sent elsewhere (SIEM, webhooks, emails, exports downloaded earlier) are not reached. Data export: any individual's complete data package can be exported as a structured JSON file on demand, fulfilling GDPR Article 20 right-to-portability requests.

Does PurpletGo support SAML SSO?

Yes - on Team and Enterprise plans. SAML 2.0 Single Sign-On lets your team log in via Okta, Azure AD, or Google Workspace without a separate password. Setup takes under five minutes. You can optionally enforce SSO org-wide to block all password-based logins entirely. Group-to-role mapping automatically assigns PurpletGo roles based on your IdP group attributes, keeping roles in sync on every login. Just-in-Time provisioning creates accounts on first SSO login, and an emergency bypass code gives superadmins a way back in if the IdP is ever unreachable.

What compliance standards does the audit log support?

The PurpletGo audit log is designed to support SOC 2 Type II, ISO 27001, and GDPR employee data lifecycle requirements. On Team and Enterprise plans, every entry is HMAC-SHA256 signed and cryptographically chained, and verifying the chain detects entries that were modified, deleted, or reordered. An admin can start that check from the audit log page; PurpletGo's servers carry it out, because the chain is keyed with a PurpletGo secret. The log records changes, sign-ins, exports and report downloads, and access revocations; it does not record every time data is viewed. Exports include each entry's hash, and every export (CSV, JSON, PDF) is hashed with SHA-256, the hash is recorded in the hash-chained audit log, and the file is signed with an Ed25519 key whose public key is available in the app, so an auditor can check that a file has not changed since it was downloaded. On Team and Enterprise plans, a signed copy of the whole log is also archived nightly to Google Cloud Storage, and archived copies are kept as part of the audit trail. Entries stay in PurpletGo for the audit log retention period you set (24 months by default, 3 to 120 months). SIEM streaming to Splunk, Datadog, or a generic webhook target is also available on Enterprise.

Is my data isolated from other organisations?

Yes. Customer data is separated by PostgreSQL Row-Level Security in the database, in addition to checks in the application. Scheduled jobs that work across organizations, such as retention and reminder runs, run under a separate database role reserved for them.

Does PurpletGo support IP allowlisting and network-level security controls?

Yes - on Enterprise plans. The Access Controls panel (Settings → Security → Access Controls) gives admins four layers of network and session security. IP allowlisting: restrict logins to one or more approved IPv4/IPv6 addresses or CIDR ranges - for example, your corporate VPN subnet (10.0.0.0/8). Any request from an IP outside the list is rejected before it reaches the application. Geo-blocking: deny logins originating from specific countries using IP geolocation (Cloudflare header when behind Cloudflare, offline MaxMind GeoLite2 database as fallback). Session timeout: force all members to re-authenticate after their token exceeds a configured age (1 hour up to 7 days). Terminate all sessions: a panic button that instantly invalidates every active session across the entire organisation - useful if credentials are suspected to be compromised. All changes are recorded in the audit log with actor and timestamp.

Roles & Access

Can managers initiate offboardings?

Yes. Users with the Manager role can submit a structured offboarding request directly from the Initiations page. The request enters an approval queue where HR or any configured approver can review, approve, or reject it - keeping managers in the loop without giving them full admin access. On Team and Enterprise plans you can attach a multi-step approval chain so the request passes through Manager → HR → Legal (or any sequence you define) before the offboarding record is created.

Can managers initiate offboardings without HR access?

Yes - on Team and Enterprise plans. The Manager Self-Service Offboarding Initiation feature lets any manager submit a structured offboarding request. By default the request enters a configurable multi-step approval chain before an offboarding record is created. HR and admin users can also disable the approval requirement org-wide from the Settings tab on the Initiations page. Every approval, rejection, and delegation is recorded in the audit log.

Can one account manage multiple organisations?

Yes. A single PurpletGo account can be a member of multiple organisations. An organisation switcher in the top navigation lets you move between workspaces instantly. Each organization's data is separated by row-level security in the database.

What roles are available and what can each role do?

PurpletGo has five built-in roles: Super Admin (full control, including billing and org settings), Admin (manage employees, offboardings, team members, and integrations), Manager (initiate offboardings and advance stages for their direct reports), HR (upload compliance documents and view exit interviews), and Developer (read-only access to offboarding records). Enterprise plans unlock Custom Roles with hand-picked permissions across every module and optional department scoping.

How do custom roles work on the Enterprise plan?

Enterprise organisations can create unlimited custom roles from Settings → Roles & Permissions. Each role gets a name, a description, and a fine-grained permission set covering every module: offboardings, employees, assets, compliance documents, exit interviews, analytics, billing, team members, integrations, API keys, automations, and audit log. Roles can also be restricted to specific departments.

Does PurpletGo support multi-org hierarchies for group companies and subsidiaries?

Yes - on Enterprise plans. The Org Hierarchy feature lets a parent organisation create and manage sub-organisations (divisions, subsidiaries, regional entities) under a single account. Sub-orgs automatically inherit the parent's Enterprise plan, so you don't need to purchase separate plans for each entity. From the hierarchy dashboard a superadmin can view consolidated offboarding stats and a unified audit log across the entire group, making it easy to get a real-time picture of active offboardings, SLA breaches, and completed offboardings across all entities. You can also push checklist templates from the parent down to all sub-orgs in one click, ensuring every subsidiary follows the same offboarding standards. Sub-orgs can be detached at any time to operate as independent organisations, with all their data preserved; a detached org starts its own 14-day Team trial and then needs its own plan.

Can different divisions of my company manage their own offboarding independently?

Yes. Each sub-org in PurpletGo's hierarchy has its own isolated employee directory, offboarding requests, checklists, and settings. Users in one sub-org cannot see data from another unless they have been explicitly added as a member. A parent-org superadmin can switch into any sub-org they are a member of (creating a sub-org makes you a member) to assist or review, but day-to-day HR staff in each division only ever see their own data. The parent superadmin can share approved checklist templates across all divisions but cannot otherwise interfere with a sub-org's workflow unless they switch into it.

Plans & Setup

What are the offboarding limits on each plan?

No plan limits the number of offboardings or assets. Plans differ by employees and seats: Starter ($119/mo billed monthly, or $99/mo billed annually) covers up to 50 employees (+$2 per employee per month up to 100) and 3 seats (members of any role). Team ($499/mo billed monthly, or $399/mo billed annually) covers up to 250 employees (+$1.50 per employee per month up to 500) and 15 seats, and adds compliance controls, HR system sync, SAML SSO and SCIM. Enterprise (custom pricing, contact sales) is unlimited. Active employees count, contractors and vendors included; leavers whose offboarding is complete and erased people do not, and sub-organizations are never billed for extra employees. On a monthly plan, extra employees are on your monthly invoice, prorated; on an annual plan an extra employee costs 12 times the monthly rate a year, and each change is charged within a month. Nothing is billed during the trial. Plans can be upgraded or downgraded at any time from Settings → Billing.

Is there a free trial?

Yes. Every new organisation starts with a 30-day free trial of Team features - no credit card required. Enterprise trials are arranged through sales. If you subscribe during the trial, billing starts when the trial ends. If the trial ends without a plan, the organisation becomes read-only: you can sign in, view, and export your data. Data in a read-only organisation is deleted after 12 months, with warning emails before deletion.

How long does it take to set up PurpletGo?

Most teams start their first offboarding within minutes of signing up. Connect your integrations, build a checklist template, invite your team, and you're live. No complex configuration or IT project required - the setup wizard walks you through every step.

Can PurpletGo be white-labeled with our own branding?

Yes - on Enterprise plans. Upload your company logo, choose brand colors, and configure a custom portal domain (offboarding.acme.com via CNAME). Portal links sent to departing employees will use your domain, and the self-service portal displays your full branding instead of PurpletGo's.

Can we add a legal footer and privacy policy link to outbound emails?

Yes. Enterprise plan admins can set a custom legal disclaimer (up to 500 characters) and a link to their own Privacy Policy URL in Settings → Branding → Email Footer. These are automatically appended to every offboarding email sent to departing employees, keeping your communications compliant with internal legal and GDPR requirements.