// industry vertical
HR / workforce SaaS audit
Workday · ADP · UKG · Carta · Topia · ethics hotline exports. payroll fraud · ghost employees · equity grant tampering · relocation cost inflation · whistleblower retaliation chains — all from SaaS audit CSV/JSON you already exported.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this vertical.
- workday hcm audit log forensic analyzerdrop workday hcm export · parse worker + job + user · runs locally
- adp payroll audit log forensic analyzerdrop adp export · parse paycheck + employee + approver · runs locally
- payroll ghost employee detectordrop payroll export · detect ghost employee patterns · runs locally
- carta equity cap table export forensic analyzerdrop carta export · parse grant + vest + user · runs locally
- topia global mobility export forensic analyzerdrop topia export · parse assignment + policy + user · runs locally
- navex ethics hotline export forensic analyzerdrop navex export · parse report + category + user · runs locally
- servicenow hrsd case export forensic analyzerdrop servicenow hrsd export · parse case + task + user · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
cross-cutting tools that surface depending on the specific investigation.
- cross equity payroll exercise correlatordrop equity + payroll exports · correlate exercise to payroll · runs locally
- cross mobility payroll relocation correlatordrop mobility + payroll exports · correlate assignment to payroll · runs locally
- cross ethics hcm retaliation correlatordrop ethics + hcm exports · correlate report to employment action · runs locally
- cross er hrsd case correlatordrop er + hrsd exports · correlate investigation to service case · runs locally
- multi hcm platform timeline correlatordrop 2+ hcm exports · unified employee lifecycle timeline graph · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
- incident timeline builderdrop multiple CSVs with timestamps from any forensic tool · merge into unified chronological timeline · entity tagging · filter by source · export full timeline · runs locally
- chain of custody gap detectorpaste custody log csv · time gaps over threshold · missing signatures · export findings csv · runs locally
want deeper HR workforce coverage?
this vertical is intentionally sparse — deep-moat coverage grows over time. tracked in the forensics rollout.