# Access Control Policy

Rendro (www.rendro.net). Version 1.0, effective 2026-10-29. Owner: Franklin Lupichuk, Founder.

Who can reach customer data, and how customers control access to their own workspace.

## Inside Rendro

- Access to production systems and provider accounts is limited to the founder.
- We don't look at customer content except when the customer asks for support or to investigate a security or reliability problem.
- Anyone who joins later gets only the access their work needs, and loses it the day they leave.

## Customer accounts

- Sign-in uses email and password: at least 12 characters, email confirmation required, and rate limits against guessing.
- Each workspace has four roles: owner, admin, editor and reviewer. Reviewers can comment and suggest but can't approve, export or change settings.
- Owners and admins invite and remove members and change roles; these actions are recorded in the audit log.
- Two-factor sign-in and single sign-on (SAML) are not available yet; both are on our roadmap.

## Data access

- The database itself refuses to return another workspace's rows (row-level security), even if application code had a bug.
- Files are stored privately in a per-workspace folder. Downloads use signed links that expire after 60 seconds.
- AI search only looks at the requesting workspace's documents.

Published at https://www.rendro.net/trust/policies/access-control