Resources • security • IT • 2FA
Security & IT overview (answers your IT team will ask)
A practical overview for IT and security reviewers: tenant isolation, access controls, 2FA policy, audit trails, and recommended customer policies for handling evidence packs.
- Security
- IT
- 2FA
- Audit trails
- Tenant isolation
Clear answers for IT teams
so rollouts don't stall on uncertainty
A practical overview for IT and security reviewers — tenant isolation, access controls, 2FA policy, audit trails, and recommended customer policies for handling evidence packs and exports.
Goal 01
Separation
Separate customer workspaces prevent data mixing between organisations. Each workspace is scoped to one organisation — users only see workspaces they belong to, and no data crosses between customers.
Goal 02
Controls
Roles and 2FA policy keep access appropriate to the job. Align roles to tasks — capture, review, billing, admin — and apply 2FA consistently for internal users and client portal accounts where enabled.
Goal 03
Auditability
Door-level evidence trails and exports generated from the same record. Stable door IDs, photos attached to the door history, and PDF/CSV outputs traceable back to the source — so audits don't require evidence reconstruction.
IT & security teams
Access control, tenant separation, auditability — this page answers the standard questions in security reviews and procurement questionnaires so rollouts don't stall on "we need more information".
Ops leaders
Define customer policies for exports and evidence packs — what gets exported, where it is stored, and who can access it — so the tool's capabilities are matched by the right organisational policy.
Admins
Configure roles and 2FA and document the decisions — so when staff change or IT asks for evidence that policies were applied, the answer is already in writing rather than reconstructed from memory.
Data scoped to your workspace
access controlled by roles and 2FA policy
Three isolation properties that answer the "how is customer data separated?" question, then the four access control decisions that define who can do what inside your workspace.
Three isolation properties · workspace scope
Isolation 01
Workspace separation
Data is scoped to your organisation's workspace. Each customer organisation has its own isolated workspace — door records, inspections, remedials, users, and exports are contained within the workspace and not accessible to other organisations.
Isolation 02
Access by membership
Users only see workspaces they belong to. Account membership controls visibility — an account that has not been invited to a workspace has no access to it, regardless of any other account activity.
Isolation 03
Least-privilege mindset
Roles control who can configure, export, or manage billing. Inspectors capture; managers review; admins configure. No role has blanket access to everything — permissions are aligned to the task, not given by default.
Access control decisions · roles + 2FA + ownership
Four things to configure before rollout
01
Roles
Align roles to tasks
Capture, review, billing, admin — assign the role that matches the person's job, not the most permissive role available. Roles are easier to audit when they reflect actual responsibility.
02
Workspace 2FA
Define and apply consistently
Decide whether 2FA is required or encouraged for all internal workspace users — and apply the policy before rollout, not as a follow-up action after accounts are already active.
03
Portal 2FA
Client accounts — same logic
Encourage or require 2FA for client portal users when the portal is enabled. Portal users access inspection evidence and remedial status — treat them with the same care as internal accounts.
04
Account ownership
At least two owner accounts
Ensure at least two owner or admin accounts exist so access is never dependent on one person. If the sole admin leaves, account recovery becomes a support issue rather than a routine handover.
Field devices are part of the security boundary
and evidence is most defensible when the record shows identity, history, and outputs from the same dataset
Recommended device policies for offline-capable workflows, then the three audit trail properties that make evidence packs reliable in reviews and disputes.
Offline & device policy
Three recommended controls for field devices
Device 01
Device security
Use disk encryption, lock screens, and MDM where appropriate. A field device with inspection photos and client door records is inside the security boundary — treat it accordingly.
Device 02
Shared tablets — named logins only
Avoid shared logins on shared tablets. If a device is shared between inspectors, each person should sign in with their own account and sign out — including clearing any offline cache — before handing the device on.
Device 03
Evidence handling
Store exported evidence packs centrally with controlled access — not on personal devices or in personal cloud storage. Decide where exports live and who has access before the first export is generated.
Audit trails · activity visibility
Three properties that make evidence defensible
Audit 01
Door identity
Stable door IDs prevent "which door was this?" disputes. When the same stable identifier appears across inspections, remedials, and close-out evidence, the trail is unambiguous — even months or years later.
Audit 02
Evidence continuity
Photos and notes attached to the door record — not stored separately and linked by filename or email. Evidence attached to the record can be produced on demand; evidence stored elsewhere risks becoming detached or unavailable.
Audit 03
Outputs from the record
PDFs and CSVs generated from the underlying door record — not manually assembled from screenshots or rebuilt in a separate document. The output and the record are the same thing; one can't get ahead of the other.
Your retention and sharing policies
matter as much as the tool
The export handling checklist, three recommended customer policies that reduce risk, and a four-question IT sign-off grid so security reviews can reach a decision quickly.
Export handling checklist · decide before first export
Four decisions that define how evidence packs are stored and shared
01
Storage location
Where PDFs/CSVs are archived
Decide where exported evidence packs are stored — and who owns and maintains that folder or share. "Whoever saved it last" is not a storage policy.
SharePoint/Jobs/2026/Site-A/02
Access control
Least-privilege access to exports
Avoid "anyone with the link" for evidence pack storage. Named access, or at minimum a folder structure only accessible to the relevant team — not a public share.
Named folder access only03
Naming
Define a naming convention
A naming rule makes exports findable without searching across dates and project names. Site, building, date, and visit reference are the four most useful components.
RiversideA-Jan22-v1.pdf04
Retention
How long after job completion
Agree how long exported packs are retained after job completion. This is often driven by contract terms or your own compliance obligations — document the decision and who is responsible for reviewing it.
Min. 6 years (check contract)Recommended customer policies
Three policies that reduce risk and prevent avoidable access problems
Device hygiene
Keep devices updated and locked. Use MDM where appropriate for field tablets so device policies apply consistently without depending on each individual following the right steps. Review periodically — not just on initial setup.
Leavers process
Remove access when staff leave. Avoid shared logins that make individual account removal irrelevant. Define who is responsible for access removal, and how quickly it should happen — before someone actually leaves, not after.
Output storage
Store exported packs centrally with controlled access. A shared team folder with named access beats a collection of personal downloads scattered across devices and email threads. Apply the export checklist above before the first export.
IT sign-off Q&A · four questions to answer
The questions IT teams most commonly need answers to before approving rollout
Identity: who owns admin accounts, and what is the 2FA requirement?
Admin accounts should be held by at least two named individuals — not a shared account or a single person. 2FA requirement is a policy decision your organisation makes. Define it, apply it consistently for internal users, and document which accounts have it active.
Exports: who can export, and where are exports stored?
Exports are controlled by role — admin-level access is required to export from the workspace. Storage location is your responsibility: decide before the first export where PDFs and CSVs are archived, who has access, and what the naming convention is. See the export checklist above.
Client access: portal access vs PDFs, and who approves access changes?
Decide whether clients access evidence via the portal (named accounts, live record) or via emailed PDFs — or both, with a clear definition of which is "official". Approve portal access changes through a named process so additions and removals don't happen ad hoc.
Offboarding: how quickly do you remove access for leavers?
Same-day removal is the target for staff who leave. Define who is responsible for removing access (HR notification to admin, or a named admin on the team), and include client portal accounts in the same process — not just internal workspace accounts.
Share this page with your IT team.
Or send your security questionnaire — confirm requirements early.
Use the overview to unblock internal review, then put access and export policies into practice with workspace setup.