Access Control Policy

Access Control Policy

TieredUp Tech, Inc.

Version 1.0 — Effective May 24, 2026

Next Review: May 24, 2027

---

1. Purpose

This Access Control Policy establishes the rules and procedures TieredUp Tech, Inc. ("the Company") follows to control who can access Company information systems, what level of access each person receives, and how access is granted, reviewed, and revoked. This Policy supplements the Information Security Policy and applies to all systems described therein.

2. Scope

This Policy applies to:

• All systems listed in Section 1 of the Information Security Policy
• All physical premises owned or leased by the Company
• All persons (officers, employees, contractors, vendors) who access Company systems or premises
• All credentials, API tokens, OAuth grants, and SSH keys used to authenticate to Company systems

3. Guiding Principles

The Company applies the following principles to all access decisions:

• Least Privilege. Each person is granted only the minimum access required to perform their job function.
• Need to Know. Access to sensitive data is granted only when a documented business need exists.
• Separation of Duties (where possible). Critical functions are split across multiple persons where the size of the organization allows. Where not possible due to the Company's single-administrator structure, compensating controls are documented in the Information Security Policy.
• Default Deny. Access is denied by default and granted only by explicit authorization.
• Accountability. Every access event is attributable to an identified individual through a unique account.

4. Account Categories

Category	Description	Examples
Administrative	Full or elevated rights to a system; can change configuration, view all data, manage other users	cPanel admin, Hub admin, Shopify Admin, Plaid Dashboard, GitHub org owner
Operational	Limited business access for daily work; cannot change system configuration	RepairDesk technician, RepairDesk POS user
Service / API	Programmatic access used by automated systems	Plaid access tokens, Shopify Admin API tokens, RepairDesk API keys, GitHub deploy keys
Read-only	View-only access for monitoring or reporting	Reserved for future use

5. Current Access Assignments

Person	Role	Access Granted
Coby Poluk	President & sole administrator	Administrative on all systems in Information Security Policy §1
Lindsey Poluk	VP / phone technician	Operational: RepairDesk user account, dedicated OS user on shop POS computer
Charles Bray	General Manager	Operational: RepairDesk user account, dedicated OS user on shop POS computer

No other persons have system access. Future grants must follow the request and approval procedure in Section 7.

6. Authentication Requirements

Unique identity. Every person accessing Company systems must do so under a unique account assigned to that individual. Account sharing is prohibited.

Password requirements. All passwords for Company systems must meet these minimums:

• At least 16 characters in length
• Randomly generated
• Stored only in the Company-approved password manager (Proton Pass)
• Unique per system — no reuse across services
• Rotated immediately upon any suspected compromise

Multi-Factor Authentication (MFA). MFA is required on every system that supports it, including all systems listed in Information Security Policy §7. The Company prefers TOTP authenticator apps; SMS-based MFA is used only when no TOTP option is available.

Recovery codes. MFA recovery codes are stored in the password manager and are not shared.

Session management.

• RepairDesk: 2-minute inactivity timeout enforced, PIN re-entry required to resume
• Shop POS computer (shared hardware, separate OS users): 2-minute inactivity timeout; OS password required to unlock
• Hub administrative login: session expires on browser close or after 24 hours, whichever first
• cPanel: per cPanel default session policy

7. Access Request & Approval

All access requests follow this procedure:

1. Requester submits a written request to the Information Security Officer specifying: (a) the person, (b) the system, (c) the level of access, (d) the business justification.
2. The Information Security Officer evaluates the request against the principle of least privilege.
3. If approved, the Information Security Officer grants access, sets up MFA, and documents the grant.
4. The requester receives credentials via the password manager's secure sharing feature or in person; credentials are never sent in plain text via email or chat.
5. The new user acknowledges receipt and reads the Information Security Policy before first use.

8. Periodic Access Review

The Information Security Officer conducts an access review every quarter (within 30 days of each calendar quarter end). The review covers:

• All active user accounts on each system in the Information Security Policy
• Permission levels assigned to each account
• All Service / API credentials, with verification that each is still in use
• OAuth application grants in Google Workspace, GitHub, Shopify, and similar
• SSH keys deployed to servers
• Inactive accounts (no login in 90 days) are flagged for review and disabled if not justified

Findings are recorded in the quarterly self-audit log maintained by the Information Security Officer.

9. De-Provisioning

When a person's access is no longer required (separation, role change, project completion, or contract end), the following steps are executed within 24 hours:

1. RepairDesk account disabled (Admin → Employees → deactivate)
2. OS user account on shop POS computer disabled or deleted
3. Any shared password manager vault access revoked
4. Email forwarding configured if needed for business handoff; mailbox archived
5. Personal device wiped of Company data if applicable
6. Physical keys / alarm codes returned and codes rotated if compromised
7. De-provisioning logged with date, person, and verifying signature

10. Service Account & API Credential Management

Service accounts and API credentials (Plaid access tokens, Shopify Admin API tokens, RepairDesk API keys, GitHub tokens, etc.) follow these rules:

• Each credential is tagged with a clear purpose (which application / which integration)
• Credentials are stored in the password manager or in environment variables that are not committed to source control
• Plaid access tokens are stored encrypted at the application layer in the Hub database
• Credentials are rotated immediately upon any suspected compromise
• Credentials no longer in use are revoked within 24 hours of decommissioning
• The full inventory of credentials is reviewed during the quarterly access review

11. Physical Access

Physical access to the Company's premises at 1812 N 16th St, Orange, TX 77630 is controlled as follows:

• Entry doors are locked outside of business hours
• Alarm system is armed when the premises are unoccupied
• Video surveillance covers the customer area
• Equipment in for repair is stored in a locked area accessible only to authorized personnel
• The shop POS computer is physically located behind the counter, not accessible to customers
• Workstations are not left unattended while logged in (enforced by the 2-minute auto-lock)

12. Remote & Off-Premises Access

Administrative access to Company systems from off-premises locations is permitted only when:

• The connection is over HTTPS / TLS 1.2 or higher
• The remote device meets the endpoint security requirements in Information Security Policy §8
• Access is from a network the user controls or trusts; access from public Wi-Fi requires a VPN
• The user is the sole administrator (Coby Poluk); operational users (Lindsey, Charles) access RepairDesk only from the shop POS or their own personal devices, never on shared/public hardware

13. Account Lockout

Systems are configured to lock accounts after repeated failed login attempts where supported:

• RepairDesk: per RepairDesk default policy
• Shop POS computer OS: Windows / OS-default lockout policy
• Hub: rate limiting on login endpoint
• cPanel, Shopify, Plaid, GitHub: per their default policies

Account lockouts are investigated as potential security events when they occur on administrative accounts.

14. Privileged Access

The Information Security Officer holds the highest level of privilege in all Company systems. To reduce risk of privilege misuse:

• Administrative actions on production systems are performed in a deliberate, logged manner
• Where possible, administrative actions on Restricted-Financial data are taken from a known workstation with full-disk encryption
• The Information Security Officer does not use the same credentials for development and production where systems support credential separation
• Recovery codes, master passwords, and root credentials are stored only in the password manager and not in any other location

15. Exceptions

Any deviation from this Policy must be documented as an exception:

1. The exception is recorded with: justification, compensating controls, expected duration, and review date
2. Exceptions are reviewed quarterly
3. Exceptions are closed (and the deviation remediated) at the earliest practical date

16. Enforcement

Violations of this Policy may result in:

• Immediate revocation of system access
• Disciplinary action up to and including termination
• Civil or criminal liability where applicable

17. Policy Review

This Policy is reviewed annually on or before the effective-date anniversary, and after any significant change to systems, personnel, or scope.

18. Contact

For questions about this Policy or access requests:

Coby Poluk, President & Information Security Officer
TieredUp Tech, Inc.
1812 N 16th St
Orange, TX, 77630, US
Email: security@tiereduptech.com

---

This Policy is published at https://tiereduptech.com/pages/access-control-policy and is the authoritative version.