Security · IT · 2FA
● IT

IT overview

Answers stakeholders need before rollout.

Tenant isolation, roles, authentication policy, audit trails and export behaviour — written for security reviewers, not marketing.

Tenant Roles 2FA Evidence

Send this page plus workspace setup to IT before procurement asks for a security questionnaire.

Access model

Tenant · roles
OwnerPolicy · billing · integrations
ManagerOperations · QA · outputs
InspectorCapture · assigned sites
Portal userClient org · scoped properties
APIIntegration keys · workspace bound

Least privilege reduces blast radius if a device or account is lost.

Separate portal identities from workspace accounts — different reset and lockout policies apply.

Authentication

Security policy
✓2FA required for all workspace users
✓Two owner-capable accounts with backup codes stored safely
✓No shared logins — individual audit trail per person
✓Recovery tested before client data volumes grow
✓IdP groups mapped to workspace roles where used
✓Session timeout matches customer policy

Non-negotiable when client evidence and portal access are in scope.

Document who can reset 2FA and how — support load spikes when that path is unclear.

Evidence + exports

Audit questions
Activity trail: actor · time · object changed
Exports on demand from live register
Retention expectations owned by customer
Pair with workspace setup + integrations guides
Data processing agreements available on request
Subprocessors listed in trust documentation

Gives IT and compliance a coherent story without ad-hoc slides.

Guide below Workspace setup →

Exports and portal downloads should be part of your retention review — not a separate shadow archive.