Access control

Required on every account, with no exception process

• Every administrative account requires MFA — Cloudflare, Supabase, GitHub, the domain registrar and the mail provider. No account with production reach can be entered with a password alone.
• Hardware-backed factors are used — WebAuthn or a platform authenticator. SMS is not used as a factor anywhere.
• Recovery codes are held offline in an encrypted store, separate from the password manager.
• There is no MFA exception process.

Four principals, and what each can do

The database enforces its own half rather than relying on the application: row-level security denies by default on all 50 tables, and the public role has execute permission on none of the 77 functions. Both measured 7 September 2026.

One holder, with grant dates available on request

• Production access is held by the engineering owner and by nobody else. The list is supplied under NDA with grant dates.
• Administrative endpoints are gated twice — an identity-aware proxy at the edge, then a bearer token inside the application. Compromising one does not grant access.
• There is no standing shell access. No SSH, no bastion, no jump host, because there is no server. Administrative action is an authenticated HTTP call or a platform console operation, both logged by the platform.
• No shared accounts. Every human principal is individually identified; automation uses service credentials not attached to a person.
• Production credentials are not present on a development machine by default. Local development runs against a local store with synthetic data.

Quarterly, and on any event that changes who should have what

• Quarterly, every account on every platform is reviewed against the question of whether that principal still needs that level of access.
• Immediately after a departure, a role change, or an incident.
• API keys are reviewed alongside the account they belong to. Keys with no request in 90 days are flagged to their owner and revoked if unclaimed.
• Each review is recorded with the date, the reviewer and what changed. These records form part of the evidence pack.

Both directions, with stated deadlines

Onboarding

1. Confidentiality undertaking signed before any access is granted.
2. Background check where the role carries production access, to the extent applicable employment law permits.
3. Individual accounts created with MFA enforced from first login.
4. Access granted at the minimum level for the role. Production access is not granted by default and is not granted during onboarding.
5. Security responsibilities set out in the engagement terms.

Offboarding

1. Within one business day of a planned departure, and immediately on an involuntary one, every account is disabled.
2. Any shared credential the person could have seen is rotated, not merely revoked from them.
3. Device access is removed and company data removed from personal devices.
4. A written record is kept of what was revoked and when.

Where each kind of secret is held

• No secret is present in the repository, in a configuration file, or in build output. Commits are scanned for credential patterns before they land.
• Rotation is annual as a minimum, and immediate on any suspicion of exposure, on a departure, or on a provider's advice.
• Customer key revocation clears the edge cache immediately, so a revoked key stops working on the next request.

Three, each scoped to a single function

None is attached to a person, so none breaks when a person leaves. All three are in the rotation schedule and each is separately revocable.