Access control policy
How First Six decides who can see and do what — enforced in the database itself: row-level security on every table, deny by default, least privilege for staff, and no standing First Six access to identifiable student records. A model that exists in code, not an aspiration.
What this policy commits us to
- Row-level security is on for every application-owned table; the boundary lives in Postgres, below the application.
- Deny by default: both access paths must pass a check before any row is readable.
- Sign-in is SSO-only (OIDC, live with Microsoft Entra); First Six stores no passwords, and MFA is delegated to the institution's own IdP.
- The only route to an identifiable student record is a consented break-glass grant: one student, at most 72 hours, customer-revocable, redacted, dual-audited.
- Staff offboarding revokes live sessions in the same action as deactivation, with the audit trail preserved.
- A daily database-security sweep continuously checks RLS coverage, grants, and the anonymous-executable baseline.
Controls mapped to this policy
Mapping controls to the policy is how we check adherence. A green dot marks a control that is operating and traceable to evidence; an amber dot marks one that is documented and scheduled but has not run yet.
- SSO-only authenticationIdentity and access control
- Row-level security tenant isolationIdentity and access control
- Role-based access with least privilegeIdentity and access control
- Staff scope confinementIdentity and access control
- Server-side session revocationIdentity and access control
- Staff leaver deactivationIdentity and access control
- No standing provider access (break-glass only)Identity and access control
- Privileged function gating with anonymous-surface ratchetIdentity and access control
- Quarterly access reviewIdentity and access control
- Daily database security sweepMonitoring
- Sensitive-record read auditingMonitoring
- Log access restrictionMonitoring
Standards mappings
Through its controls, this policy maps to the following standards and frameworks. Each entry states our real relationship with the standard.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.5.16Identity management
- A.5.17Authentication information
- A.8.5Secure authentication
- A.5.15Access control
- A.8.3Information access restriction
- A.5.18Access rights
- A.8.2Privileged access rights
- A.8.18Use of privileged utility programs
- A.8.16Monitoring activities
- A.8.15Logging
SOC 2 (AICPA Trust Services Criteria)InfoSec complianceAligned
Controls are explicitly mapped to the criteria — change management to CC8, logging and monitoring to CC7, access control to CC6 — but no SOC 2 attestation of any type exists. Independent attestation is a tracked roadmap item, offered as a contractual milestone for a pilot.
- CC6.1Logical access security
- CC6.3Access modification and removal
- CC7.1Detection of security events
- CC7.2Monitoring for anomalies
HECVAT (Higher Education Community Vendor Assessment Toolkit)Higher educationSelf-assessed
A full HECVAT answer pack is maintained and kept current for university procurement, deliberately honest about gaps (no SOC 2 or ISO attestation, no independent penetration test, PITR not enabled). It is a vendor self-assessment, not an externally validated response, backed by a full internal HECVAT-aligned self-audit.
- DeprovisioningTimely removal of leaver access
- MonitoringContinuous security monitoring of the hosted environment
- AuditAudited access to institutional data
FERPA (US Family Educational Rights and Privacy Act)PrivacyAligned
For US-institution contexts, the platform addresses FERPA expectations through verifiable controls — tenant isolation, the append-only audit log behind record-access accountability, erasure, and a breach-notification path — rather than asserting a compliance label. The position is self-assessed as partial, with the audit-trail erasure carve-out disclosed as a live residual. A control you can verify is worth more than a label.
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.