Access Control
oklido implements comprehensive access controls to protect your data.
Principles
Our access control follows these principles:
- Least Privilege - Users get minimum access needed
- Need to Know - Access only to required data
- Separation of Duties - Critical functions require multiple people
- Defence in Depth - Multiple layers of controls
User Access Levels
Internal Users (Your Team)
| Role | Documents | Users | Settings | Billing |
|---|
| Owner | Full | Full | Full | Full |
| Admin | Full | Full | Full | View |
| Editor | Full | View | Limited | - |
| Viewer | View/Download | - | - | - |
| Auditor | View | View | View | - |
External Users
| Type | Access |
|---|
| Beneficiary | Shared documents only |
| Guest | Shared documents only, time-limited |
Authentication Controls
Password Requirements
- Minimum 8 characters
- Mix of upper/lower/numbers
- Checked against breach databases
- No password reuse (last 5)
Multi-Factor Authentication
- Optional but recommended
- Authenticator app (TOTP)
- Required for admin functions (configurable)
Session Management
| Control | Setting |
|---|
| Session timeout | 24 hours |
| Idle timeout | 1 hour |
| Concurrent sessions | Allowed |
| Secure cookies | Required |
System Access Controls
Infrastructure Access
| System | Access Method | Who |
|---|
| Production servers | None | No direct access |
| Database | IAM + VPN | Engineering only |
| AWS Console | IAM + MFA | Authorised staff only |
| Logs | AWS Console | Operations + Security |
Code Access
| Repository | Access |
|---|
| Application code | Engineering team |
| Infrastructure code | Infrastructure team |
| Security tools | Security team |
Audit Logging
All access is logged:
What We Log
| Event | Logged Data |
|---|
| Login | User, time, IP, device |
| Failed login | User, time, IP, reason |
| Document access | User, document, action, time |
| Settings changes | User, what changed, time |
| Admin actions | User, action, target, time |
Log Retention
| Log Type | Retention |
|---|
| Security events | 7 years |
| Access logs | 90 days |
| Error logs | 30 days |
Log Protection
- Immutable (append-only)
- Encrypted at rest
- Separate access controls
- Regular integrity checks
Access Reviews
Regular Reviews
| Review Type | Frequency |
|---|
| User access rights | Quarterly |
| External user access | Monthly |
| Admin access | Monthly |
| Service accounts | Quarterly |
Triggered Reviews
Access is reviewed when:
- Employee leaves/changes role
- Security incident occurs
- Compliance audit requested
- Customer request
Privileged Access
Admin Access Controls
Administrators have additional controls:
- MFA required
- Session recording for critical actions
- Approval required for sensitive operations
- Regular certification
Break-Glass Procedures
Emergency access:
- Documented procedures
- Multiple approvals required
- Full audit trail
- Time-limited
- Post-incident review
Third-Party Access
Subprocessor Access
| Provider | Access | Purpose |
|---|
| AWS | Infrastructure | Hosting |
| Auth0 | Auth data | Authentication |
| Stripe | Billing data | Payments |
Vendor Management
- Security assessment before onboarding
- Data Processing Agreements
- Regular security reviews
- Minimal access principle
Your Access Controls
Managing Team Access
- Go to Settings → Team
- Add/remove users
- Assign appropriate roles
- Review access regularly
Managing External Access
- Go to Settings → External Access
- Review beneficiaries and guests
- Revoke access when no longer needed
- Set appropriate expiration dates
Access Logs
View access to your documents:
- Open any document
- Click "Audit Log"
- See who accessed and when
Questions
For access control questions:
