Purpose

Limit access to Eduspera systems and customer data to the people and services that need it, for as long as they need it.

Scope

Production application (Coolify-hosted Next.js), Supabase project (Postgres, Auth, Storage), Bunny Stream, Cloudflare, Emailit, Stripe, GitHub organisation and the secrets vault.

Principles

Least privilege. Every account has the minimum role needed. Row Level Security and server authorization protect customer data. School pages and APIs retain the active academy context even when a person belongs to more than one school. Platform-wide administration is a separate privileged function.
Unique identities. No shared accounts. Service credentials are issued per integration and stored in the platform secrets vault (AES-256-GCM, single master key held in the hosting environment), never in the repository.
Multi-factor authentication. Infrastructure administrator accounts must use provider MFA. Panel roles require email 2FA with a 30-day device trust. Privileged API, REST and RPC access require assurance bound to the verified authentication session; a different session does not inherit that proof. Personal data export, deletion requests and display/consent preferences remain self-authorized.
Validated mutations. The browser uses a public API key, not a service credential. RLS constrains permitted personal operations; managed profile fields, entitlements, assessments and sensitive content have additional database restrictions. Server route handlers validate privileged mutations, including the active school and same-origin browser submissions. Service-role credentials remain server-only.

Access lifecycle

Grant — access is requested in writing, approved by the founder, and granted with the narrowest role available (e.g. school_admin scoped to one academy).
Review — platform-admin and infrastructure access is reviewed quarterly; the list of accounts with production access is kept with this policy.
Revoke — access is removed on the day a person leaves or a contract ends: SSO/identity disabled, personal tokens rotated, shared secrets rotated in the vault.

Monitoring

Sensitive actions (sign-in, role changes, enrollments, grading, payments, exports, erasure, SSO changes) are written to an immutable audit log that tenant admins can read and export. Failed sign-ins are rate-limited at the edge and the application.

Exceptions

Exceptions require written approval by the founder, a stated expiry and a compensating control, and are recorded in the audit log.