Who can reach what, and how that is enforced
Access control covers both the customers using a workspace and the RapidRoot team operating the platform. This page describes what exists today and what is planned.
Accounts and roles
This page is maintained by RapidRoot to answer common security and privacy questions about our platform. It describes practices that are in place today and clearly labels anything that is planned. It is not a certification, an audit result, or independent verification.
Every person who uses RapidRoot has an individual account. Shared logins are discouraged because they make attribution — and revocation — impossible.
| Role | Typical use | Scope |
|---|---|---|
| Administrator | Owner or operations lead | Workspace settings, billing, members, credentials |
| Manager | Team lead | Configuration, automations, reporting across the workspace |
| Agent | Front-line responder | Assigned conversations and the tools needed to handle them |
| Read-only | Analyst or auditor | View access without the ability to change configuration |
Authorisation is enforced on the server for every request. The interface hides what a role cannot use, but hiding a button is treated as a usability detail, never as the security control.
Sessions and passwords
- Sessions expire and can be ended by signing out; tokens are refreshed rather than issued indefinitely.
- Passwords are salted and hashed by the managed authentication layer.
- Weak and previously breached passwords are discouraged at sign-up.
- Administrators can remove a member, which revokes their workspace access.
Stronger authentication
Email and password sign-in
In place todayAvailable today through our managed authentication layer.
Multi-factor authentication
PlannedMFA is on the roadmap and is not available today. We will not describe it as available until it ships.
SAML single sign-on
PlannedEnterprise SSO is planned. Talk to us during evaluation if it is a procurement requirement.
Audit log of admin actions
In progressAdministrative events are being expanded into a customer-visible audit trail.
Internal access
RapidRoot is a small, focused team. Production access is limited to the people who operate the platform, uses individual credentials rather than shared accounts, and is intended for operating and supporting the service — for example diagnosing a delivery failure a customer has reported.