Access Control Policy
linkhaus, LLC · Effective November 4, 2026 · Owner: Company owner · Review: At least annually
This policy establishes operating requirements. Implementation evidence, configuration records, and completed reviews are maintained separately; publication alone is not proof that every control has been implemented or audited.
Least privilege and roles
Access to Linkhaus systems and personal data must be limited to a documented business need. Creators may access their own private account data. Support personnel may access only the information needed for an authorized support task. Administrative access is reserved for the owner or explicitly authorized administrators. Service accounts must have permissions limited to their specific workload.
Granting and removing access
The owner must approve access before it is granted and record the person or service, purpose, role, approval date, and systems covered. Shared administrative accounts must be avoided where individual identities are supported. Access must be reviewed when responsibilities change and revoked promptly when employment, a contract, or the business need ends. Emergency access must be time-limited and reviewed afterward.
Authentication and personal data
Administrative accounts must use MFA where supported. Platform integrations must use authorized tokens with permissions limited to required features. Secrets must be stored in restricted configuration or secret-management services. Account-scoped application authorization must be preserved in queries and background jobs. Access restrictions must apply to exports and support tooling as well as the normal interface.
Logs and reviews
Relevant administrative and access logs must be retained under a documented retention schedule, protected from unauthorized changes, and made available for investigations. Passwords and tokens must not be logged. The owner must review all privileged access at least annually and after significant changes, retaining the review date, findings, approvals, and removals. This policy does not claim that a historical review has already taken place.
Exceptions require owner approval, documented safeguards, and a review date. Contact: shie@linkhaus.ai.