Access control policy
Effective 18 October 2026 · Version 1.0
1. Principles
People get the least access they need to do their job, through their own account, and nothing more. Access is approved by the practice owner (or, for the service itself, the Security Officer), is checked by the software on every request, and is removed the day it is no longer needed.
2. Roles
| Owner | Everything, including staff accounts, connections to other services, settings, the activity record, and exporting or erasing a person's data. Only an owner can change another owner. |
| Admin | The whole inbox, contacts, calendar, clinical notes (read and write), automatic-message rules and the activity record. Cannot manage staff accounts or connections. |
| Clinician | Messages, contacts, calendar and clinical notes (read and write). No rules, settings or staff management. |
| Front desk | Messages, contacts and calendar. No access to clinical notes. |
The permissions behind each role are fixed in the software; adding a feature means assigning it to a permission, not inventing a special case. A person's role is looked up from the database on every request, so changing a role or switching an account off takes effect at once, not when a session expires. People cannot change their own role.
3. Accounts and sign-in
- Every person has their own account. Shared accounts are not permitted, because they make the activity record meaningless.
- New accounts are created from a one-time invitation link that the owner sends personally. It works once and expires after 7 days. The person chooses their own password.
- Passwords must be at least 12 characters and are stored only as bcrypt hashes. Password reset links work for one hour, and only the newest works.
- An owner can set a temporary password for someone when email is not available; the person then chooses their own.
4. Two-step sign-in
Two-step sign-in with an authenticator app (time-based one-time passwords, RFC 6238) is available to every account. It is required for owners and administrators: new and existing owner and administrator accounts have 14 days to set it up, after which they cannot use the application until it is on. Each code works once. Eight recovery codes are issued at setup, stored only as hashes, and each works once. Turning two-step off or issuing new recovery codes needs the password and a current code. If someone loses both their phone and their recovery codes, the owner resets their two-step sign-in after confirming who they are, and the reset is recorded.
5. Sessions and lockout
- A session lasts at most 14 days. The session cookie cannot be read by scripts on the page, is sent only over HTTPS, and is marked so that other websites cannot use it to submit requests on the person's behalf.
- Changing or resetting a password ends every other session for that account.
- Five wrong passwords or codes in a row lock the account for 15 minutes. An owner can unlock it sooner. Sign-in attempts from one address are also rate-limited.
- Switching an account off ends access immediately.
6. Reviewing access
At least every quarter, and whenever staff change, an owner reviews the Team page: who has an account, what role, whether two-step sign-in is on, and when they last signed in. Accounts no longer needed are switched off. Switched-off accounts are kept (not deleted) so past messages and notes keep their author.
7. When someone leaves
The owner switches their account off the same day. If they had access to any connection or key, those are replaced. If they had access to the server, their key is removed.
8. Administrator and server access
Access to the server is by SSH key only (password login is switched off), limited to the Security Officer, using keys held only on the Security Officer's own devices and never shared. Multi-factor authentication is on for the hosting (DigitalOcean) and domain and DNS (Cloudflare) accounts used to manage the service, and is being switched on for the source code, Meta developer and TikTok developer accounts; none of these accounts is shared. Secrets are never sent by email or chat.
9. Records
Sign-ins and failed sign-ins (including attempts on a locked account), role and account changes, two-step changes and resets, reads of clinical notes, and exports and erasures are written to the activity record. Owners and administrators can read it in the app (Team, then Access log). Each person can also see their own recent sign-ins, including failed attempts on their email, under Your account.