Support access
Ownrecord staff can't see your customers, invoices, ledger or settings unless you let them, for a reason, a mode and a time you approve. Every request they make is in your audit log and Access log.
Ownrecord staff run the platform, but your organization's data stays yours. A platform role never opens your customers, invoices, ledger, secrets or settings by itself. When support needs to look inside your console, they ask for support access: time-boxed access to your organization, for a reason you see, which you decide on and can end at any time.
The policy
Your organization's support-access policy decides what happens when staff ask:
| Policy | What happens |
|---|---|
on_request (the default) | Staff ask with a reason, a mode and a duration of up to 24 hours. An owner or admin approves or denies each request. |
always_read | Staff get read access without approval, for up to 24 hours at a time. Every request is still logged and shows in your inbox. Write access still needs approval. |
off | Staff can't ask. Turning it off also denies waiting requests and revokes active grants. |
Only organization owners change the policy, in Organization → Security → Access log or with support_access.update_policy, after signing in within the last 15 minutes. Moving away from always_read revokes the grants it approved without a person.
A request and its decision
A request names the staff member, the reason (often a ticket number), the mode and the duration:
- read: they use your console as a
viewer. They can read everything a viewer can, including customers, invoices and the ledger, and change nothing. - write: they use your console as an organization admin without secrets: they can read and change your organization's data and settings, but never API keys, processor keys, webhook endpoints, members and invitations, agents and apps, approval decisions, security settings or data exports. Those stay read-only, because they hold secrets or create access that would outlive the grant.
Your owners and admins get an email from Ownrecord with the reason and a link to the request in Security → Access log, and a SUPPORT_ACCESS_REQUESTED alert appears in your live-mode inbox. Approving needs a sign-in within the last 15 minutes (support_access.approve). Deny it with a reason the staff member sees (support_access.deny). Nobody can approve their own request, and only people approve: API keys, agents and apps can't. A request nobody decided lapses after 24 hours.
The grant starts when it is approved and ends after the requested duration (expiresAt). You can revoke it at any time (support_access.revoke), and the staff member ends it as soon as the work is done. A staff member has at most one open request or grant per organization.
While a grant is active
A red banner shows on every page of your console while a grant is active: "Support access by name, expires time", with a link to review or revoke it. The staff member sees the same banner in your console.
Every request made under a grant is recorded, reads included: it goes to your audit log with the grant's ID (supportGrantId, also on the actor), and the Access log lists it under the grant: what was done (the operation), to which object, in which entity or brand, in which mode and when.
The Access log
Organization → Security → Access log lists every request and grant, newest first, with who asked, why, the access, the status and the window, and how many requests were made under each. Open one to see what was done. Owners, admins and anyone who holds audit:read read it, in the console or through:
support_access.list: requests and grants, filtered by status (requested,approved,denied,expired,revoked);support_access.get: one, with its count of actions;support_access.list_actions: what was done under one grant.
Statuses are read at the time of the request: an undecided request older than 24 hours, or a grant past its end, is expired.
What staff can always see
Without a grant, Ownrecord staff see only your organization's metadata: its name, slug, country, status, plan and subscription with Ownrecord, size (entities, brands, members) and the volume Ownrecord meters for billing, plus the registry facts and documents of a legal entity you submitted for verification. Decrypted processor secrets are never visible to anyone after you enter them, staff included.