Controls
Evidence is only credible if you can say who could touch it.
Every person has a role at a place in your organisation, and what it allows is shown in the product. A manager sees their sites, not the company.
Access follows your structure.
Organisation and sites
People are given a role at the organisation or at a single site. A role at a site reaches that site and what sits beneath it.
Roles you can read
Owner, Administrator, Manager, Compliance officer and staff roles. What each can do is listed in the product, so what you see is what is allowed.
Granted, not assumed
Someone cannot grant a role above their own, cancel an invitation for one, or disable an administrator. The limits are built into the system, not left to good behaviour.
Removed cleanly
A role can be taken away or a person disabled without deleting the history of what they did.
The people who change access are verified twice.
- Owners and Administrators are asked to set up two-step verification and have 14 days to do it. After that, writing, downloading and exporting are restricted until it is done.
- Approving the disposal of records needs a session that has proved a second factor.
- Someone who has lost their authenticator and their recovery codes asks for recovery from the sign-in screen. Everyone who could object is emailed at once, with a link that cancels the request, and a colleague with the authority to grant the same roles must approve it. Nothing completes for 24 hours after the request.
Who did what stays on the record.
Material actions are recorded with who took them and when, in a log that cannot be quietly changed and holds IDs, not personal details. Removing someone’s access does not remove the record that they acted. The database itself keeps customers apart, so a mistake in the software cannot show one organisation another’s records.
See the controls on a real record.
Bring one worker file and we will show who could see it, how long it is kept and what leaves the system when it is asked for.