# Access Control Policy — Reachlee

> How Reachlee controls access to its systems and customer data: least privilege, multi-factor authentication, secure customer sessions, workspace isolation.

# Access Control Policy

Effective: 20 October 2026 · Reviewed at least once a year

This policy defines who may access Reachlee's systems and the data they hold, and how that access is granted, protected, reviewed and removed. It supports our [Information Security Policy](/security/information-security-policy/).

## 1\. Principles

* **Least privilege:** every person, service and integration gets only the access its job requires.
* **Need to know:** customer data is accessed only to operate the service or to resolve a customer's support request.
* **Individual accountability:** access is personal, and credentials are never shared.

## 2\. Access to production systems

* Access to production systems and customer data is limited to authorized personnel.
* Administrative access is protected by multi-factor authentication wherever supported, and server access uses key-based authentication.
* Databases are reachable only from within our infrastructure, never directly from the internet.
* Secrets are kept in encrypted storage and are never placed in code, logs or messages.
* Internal administrative tools are available only to approved administrators.

## 3\. Customer access

* Customers sign in with Google; Reachlee never sees or stores their password.
* Sessions use secure, HTTP-only cookies that are protected against cross-site use and expire automatically.
* Every request is checked against the customer's workspace, and data from one workspace is never visible to another.
* Within a workspace, sensitive actions such as billing, team invitations, integrations and workspace settings are restricted to the workspace owner. Team invitations are single-use and expire.
* Customers connect social accounts through each platform's official authorization screen and can disconnect at any time.
* AI connectors receive access only after the customer approves them, with scoped, revocable permissions, and their actions are logged.

## 4\. Granting, changing and removing access

* Access is granted only for a specific purpose and removed when that purpose ends.
* When someone with access leaves or changes role, their access is removed or reduced promptly, and relevant credentials are rotated.
* If a credential may have been exposed, it is revoked and replaced immediately, and the event is handled under our [Incident Response Policy](/security/incident-response-policy/).

## 5\. Logging and review

* Access to production systems and administrative actions are logged.
* Access rights are reviewed at least once a year and after any security incident, and access that is no longer needed is removed.

## 6\. Review

This policy is reviewed at least once a year and whenever our team or systems change. Questions go to [tusharkapil@reachlee.co](mailto:tusharkapil@reachlee.co).

---
Source: https://www.reachlee.co/security/access-control-policy