Skip to main content
Data Security and Reliability

Access Control, Activity Logs, and Secure Administration

Roles, 2FA, activity logs, and administrator practices for secure account management.

Last updated 13 days ago

Correct roles, 2FA, and regular account reviews reduce the risk of unauthorised access and accidental changes.

How Hanna controls access

Hanna uses role-based access control. The modules and actions available to a user depend on their role, permissions, and organisation settings. Two-factor authentication can be enabled, and administrators can apply sign-in restrictions required by the organisation's security policy.

User and administrator actions are logged. Records may include sign-ins and the creation, editing, export, or deletion of records. This supports change tracing and investigation of unusual activity. Activity logs are retained for at least 12 months.

  1. Build roles around actual job duties and apply the principle of least privilege.
  2. Grant administrator permissions only to employees who need them.
  3. Require 2FA and explain how employees enrol and recover their second factor.
  4. Test each new account with its assigned role before handing it over.
  5. Update permissions promptly when duties change, and disable accounts when employees leave.
  6. Review active accounts, administrator permissions, integrations, and API keys regularly.
  7. Use activity logs to investigate suspicious sign-ins or unexplained changes.

API keys and integration accounts

Give an API key only the permissions required by its integration. Use separate keys for unrelated systems whenever possible. Revoke and replace a key when its owner changes or exposure is suspected.

Do not store keys in chats, email, documents, or source code visible to unauthorised people. Send Hanna Customer Support only a key name or identifier, never the secret value.

If you suspect unauthorised access

  1. Disable or restrict the affected account.
  2. Replace compromised credentials and revoke related API keys.
  3. Review activity logs, timestamps, affected records, and exports.
  4. Record the company Hanna address, user, time with time zone, and observed actions.
  5. Contact Hanna Customer Support immediately. Do not send passwords, 2FA codes, recovery links, or access tokens.

Was this helpful?

Still need help? Ask the team