Access Control Policy

1. Purpose and scope

This policy ensures that only authorised people can access Seba Agency systems and data, and only to the extent they need for their work. It applies to every system in the access register (section 7), including n8n, the Hetzner/Coolify server, Notion, Tally and TikTok Shop access.

2. Principles

• Least privilege: everyone gets the lowest level of access their tasks require. Admin rights are limited to the Managing Director unless he approves otherwise in writing.
• Need to know: access to personal data, such as creator data, is given only to people working on that integration or client.
• Named accounts: everyone uses their own account. Shared accounts are avoided; where one cannot be avoided, its credentials are kept in the password manager and recorded in the register.
• 2FA: required for every account in the register.

3. Granting access

1. Access is requested from, and approved by, the Managing Director.
2. The person confirms the security baseline (Information Security Policy, section 4) and signs the confidentiality commitment (Internal Data Protection Policy, Annex).
3. Access is set up at the lowest suitable role and recorded in the access register with the date.

4. Changing and removing access

• Access is reduced when someone’s role changes.
• Access is removed within 24 hours of someone leaving or an engagement ending. Any shared credentials they knew are rotated at the same time.
• Access to client systems (e.g. client ad accounts, TikTok Shop seller accounts) is removed when the client contract ends.

5. Service accounts and API tokens

• API tokens (e.g. TikTok and Notion integration tokens) use the narrowest scopes available and are dedicated to a single integration.
• Tokens are stored only in n8n’s encrypted credential store.
• Tokens are rotated when someone who knew them leaves, after any suspected compromise, and at least once a year.
• The Notion integration is connected only to the databases it needs, not the whole workspace.

6. Access reviews

Every quarter the Managing Director compares the access register with the actual accounts in each system, removes unused or unnecessary access, and records the review date below.

7. Access register

Last access review: October 13, 2026 · Reviewed by: Joshua Omosebi