1. Purpose
Define how access to Vertex CRM systems and data is granted, reviewed, and revoked.
2. Principles
- Least privilege: users receive only permissions required for their role
- Organization isolation: tenant data is scoped by organization id in the application
- Need to know: platform operators access production data only for support/incident response under confidentiality
3. User access
Accounts are created by organization administrators or platform onboarding. Access is enforced via authentication middleware and RBAC profiles (object-level list/read/create/update/delete). Inactive users should be deactivated promptly by the customer admin.
4. Privileged access
Super-admin / platform capabilities are limited to designated operator accounts. Production secrets (DB, SECRET_KEY, Meta app secret) are stored in environment configuration, not in source control.
5. Integration credentials
Meta and other OAuth tokens are stored per organization and encrypted at rest when configured. Customers may revoke by disconnecting integrations or via Meta’s app removal / data-deletion flow.
6. Review & revocation
Customers should review user roles periodically. Offboarding: deactivate login, rotate API keys, disconnect integrations. Platform access is revoked when operator employment/engagement ends.
7. Related
Security hub · Account deletion · Encryption
Last updated: August 2026.