Access follows the workspace and the person.

Private records require a verified account and authorized agency or customer workspace membership. Account protection and workspace permissions work together.

Agency and client roles stay separate

Agency team roles and customer workspace roles grant different actions. Selecting an agency or workspace is a navigation preference, not an access grant. Backend membership checks and database policies enforce record access. A client viewer does not receive agency-wide or library access.

Optional authenticator protection

Account-wide authenticator-app two-factor authentication is available. Enrollment requires verification of a code. When enabled, private access requires the appropriate verified session. A second authenticator can provide another way to produce a current code.

SMS enrollment, mandatory organization-wide 2FA policies and downloadable recovery codes are not available. Losing access to all authenticators requires support and identity verification; no automatic bypass is promised.

Provider credentials stay on the backend

Direct library authorization tokens are encrypted and are not returned to the browser. Source authorization is separate from Google identity sign-in. Each customer’s CRM connection belongs to its workspace; each agency’s library sources belong to that agency.

Disconnecting a library connection removes its stored tokens and cancels active imports. Previously imported references remain until removed through an authorized process. Provider account settings also allow authorization revocation.

Private records and files

Database permissions restrict agency and customer data to authorized records. Creative references use private storage and temporary signed URLs. Previously issued signed URLs can remain usable until their normal expiry; removing membership cannot recall data already downloaded.

Operational limits

Authorized operators may access data when necessary for maintenance, support, security or an authorized request. Infrastructure backup retention depends on the configured service. A documented isolated restore drill and complete lost-authenticator recovery rehearsal remain pending.

This page describes implemented controls. It does not claim an external security certification, an uptime guarantee or completed recovery certification.

Report an account or security issue

Contact faheemshah693@gmail.com with a description and the affected workflow. Do not include credentials or customer lead data. Read the privacy policy for processing, storage and removal details.