Control de acceso

CrowdHandler employs robust access control policies to restrict access to systems and data only to authorized individuals. Our logical access control procedures include:

End Users

End users of our client's applications are anonymous and identified only by a randomized token. They have no login rights or access to any CrowdHandler systems or data. There is no method by which an end user session can be promoted to an admin panel user.

Admin Portal Users

Client administrators access our admin portal to configure settings and review reports. Access is controlled via:

  • Dedicated logins - Each client admin has a unique username and password to login to our portal. Passwords are stored using secure hashing/salting.
  • Role-based access - Admins are assigned either standard "User" or privileged "Admin" roles to determine what portal functionality they can access. Only admin roles can access billing info or make user management changes.
  • Two-factor authentication (optional) - Admins can enable two-factor authentication on their portal accounts using Google Authenticator or a similar app for an added layer of security.

AWS Users (CrowdHandler Staff Only)

CrowdHandler staff access our AWS environment through secure VPN and MFA-protected logins to administer infrastructure and application components. Access is controlled using:

  • Dedicated IAM users - Each staff member has a unique IAM username and password to login to the AWS console and CLI. Passwords are complex and rotated every 90 days.
  • Strictly least-privilege access - IAM policies are used to grant only the minimum permissions needed for a staff member's responsibilities. All access is monitored and audited.
  • Multi-factor authentication - All AWS access requires MFA verification using a hardware security key or Google Authenticator.
  • Credential rotation - Access keys and passwords are rotated every 6 months at a minimum.

CrowdHandler's access control policies are designed to limit privileged access to systems and client data only to authorized individuals. Multiple safeguards such as MFA, secure credential storage, and least-privilege access aim for maximum security of login credentials and accounts. Audit logging provides transparency into how access rights are being used. Our policies follow industry best practices for identity and access management to minimize risks from compromised access.