Access Control Policy

Effective: 20 October 2026 · Reviewed at least once a year

This policy defines who may access Reachlee's systems and the data they hold, and how that access is granted, protected, reviewed and removed. It supports our Information Security Policy.

1. Principles

• Least privilege: every person, service and integration gets only the access its job requires.
• Need to know: customer data is accessed only to operate the service or to resolve a customer's support request.
• Individual accountability: access is personal, and credentials are never shared.

2. Access to production systems

• Access to production systems and customer data is limited to authorized personnel.
• Administrative access is protected by multi-factor authentication wherever supported, and server access uses key-based authentication.
• Databases are reachable only from within our infrastructure, never directly from the internet.
• Secrets are kept in encrypted storage and are never placed in code, logs or messages.
• Internal administrative tools are available only to approved administrators.

3. Customer access

• Customers sign in with Google; Reachlee never sees or stores their password.
• Sessions use secure, HTTP-only cookies that are protected against cross-site use and expire automatically.
• Every request is checked against the customer's workspace, and data from one workspace is never visible to another.
• Within a workspace, sensitive actions such as billing, team invitations, integrations and workspace settings are restricted to the workspace owner. Team invitations are single-use and expire.
• Customers connect social accounts through each platform's official authorization screen and can disconnect at any time.
• AI connectors receive access only after the customer approves them, with scoped, revocable permissions, and their actions are logged.

4. Granting, changing and removing access

• Access is granted only for a specific purpose and removed when that purpose ends.
• When someone with access leaves or changes role, their access is removed or reduced promptly, and relevant credentials are rotated.
• If a credential may have been exposed, it is revoked and replaced immediately, and the event is handled under our Incident Response Policy.

5. Logging and review

• Access to production systems and administrative actions are logged.
• Access rights are reviewed at least once a year and after any security incident, and access that is no longer needed is removed.

6. Review

This policy is reviewed at least once a year and whenever our team or systems change. Questions go to tusharkapil@reachlee.co.