Document owner: Servstead, LLC. Version 1.0. Effective date: July 3, 2026.
Related: https://servstead.com/policies/security
1. Purpose
This Access Control Policy establishes requirements for granting, reviewing, and revoking access to Servstead production systems and customer data.
2. Unique identities
Every employee, contractor, and administrator must use an individual account. Shared credentials for production systems are prohibited.
End users authenticate with individual Servstead accounts tied to a single business tenant.
3. Least privilege
Production access is granted only when required for job duties and approved by the Information Security Lead.
Access is revoked within twenty-four (24) hours of role change or offboarding.
In-product permissions follow least privilege: owners have full business access; managers have operational access; field crew access is limited to assigned jobs.
4. Tenant isolation
Customer data is isolated at the database layer using PostgreSQL row-level security. Application code cannot query another tenant's records without service-role automation running server-side jobs.
Object storage paths are scoped by business identifier.
5. Administrative and production access
Access to hosting (Vercel), database (Supabase), payments (Stripe), email, and Plaid dashboards requires multi-factor authentication.
Production database credentials are not stored on employee devices. Secrets are managed through hosting environment variables.
Integration tokens (including Plaid access tokens) are stored server-side only and are never exposed to browsers.
6. Access reviews
Administrative access is reviewed at least quarterly. Unused accounts are disabled.
7. Contact
Access control questions: servstead@gmail.com