Hardening & security
Overview
The most effective measures are few and boring. They are listed here in order of usefulness, not novelty.
Access
Two-factor sign-in for every account with administrative permissions. It is the only measure that still catches a stolen password.
Permissions by need, not by convenience. The roles are cut so that someone can work without being allowed everything. A second administrator makes sense; a third is usually a shortcut nobody withdraws later.
External access uses separate accounts. Customer and freelancer access runs through a separate area with its own sign-in; they are not staff accounts with fewer permissions.
Operations
TLS for every address, including brand domains and published sites.
Credentials outside the application. They belong in the environment configuration, not in the database and not in a backup next to the data.
Background processes under their own service account that may only reach what it needs.
Currency. Updates are idempotent and quick; a postponed update is the most common avoidable gap.
What the system does itself
- Every writing action creates an audit entry with before/after and the acting identity — also
when the AI acted.
- Permissions are evaluated per brand: a permission in one brand is not a permission in all.
- The customer portal area is fail-closed: what is not explicitly released does not exist there.
Common problems
A user sees more than they should. Check their memberships: permissions add up across all active memberships.
An account still works after the person left. Accounts have to be deactivated; deleting an employee record alone is not enough.