Access controls — LADLE security

Access-control complexity scales with organizational size. LADLE is small, so its access model is small. Everything is documented; nothing is discretionary.

People with production access

The founderFull read/write; MFA required; audit-logged

Total2 people. That's it.

What 'production access' means

Ability to log into the Supabase console (with row-level security still in effect for user data by default; RLS-bypassing service-role access is separately audited).
Ability to deploy to the Vercel production environment (via GitHub-linked deploys with mandatory PR review).
Ability to view aggregate logs (application logs, error tracking, uptime monitoring).
Ability to see billing metadata in Stripe (payment method last-four, subscription state; not full card numbers — Stripe holds those).

What production access does NOT include

Automatic browsing of user chat content. Reading a specific user's chats requires either (a) an explicit customer-support ticket where the user has granted access, or (b) a direct legal-process obligation. Both routes are logged.
Bypassing user-level rate limits or usage caps for personal accounts.
Deleting content on behalf of users without a documented request.
Overriding the no-training-on-chats guarantee with Anthropic; this is contractual, not a toggle.

Audit logging

What's loggedEvery production-console access, every deploy, every service-role query against customer data

Retention12 months

Access to the audit logSame 2 people; log entries include actor identity

External reviewQuarterly self-review; annual review will move to a third-party auditor once SOC 2 engagement begins (2027-Q1)

Onboarding new production access

As of publication, one person — the founder — holds standing production access, and we have no plan to add a second in the next six months. If we do, the process is (1) written confidentiality agreement, (2) MFA setup, (3) documented reason for access, (4) named revocation trigger on departure or role change, and (5) this page updated before access is granted rather than after. The count is deliberately published: if this page says one, the answer is one.

Customer-side access

For team plans, the workspace admin has the ability to add/remove members, view billing, and (on explicit request, with user notification) export a specific member's data. Admins cannot browse other members' chats. This is per-design and not a toggle — see /help/teams-and-seats/admin-controls for the reasoning.

REPORT AN ACCESS-CONTROL CONCERN · PRIVACY@LADLE.CHAT

Who at LADLE can access what.