Support access that cannot be quiet

Ask a software vendor whether their staff can read your data and you usually get a careful answer. The honest answer is almost always yes. The useful question is a different one: would you know?

How ours works

Our staff cannot browse your workspace. Entering it requires:

• A reason, written down. Not a dropdown. A sentence, recorded against the session.
• A single-use link that expires. The token is stored hashed, so a leaked copy of our own database is not a set of live keys to customers' workspaces.
• A banner your users see. For the whole session, on every page, naming the operator and the reason, with a button to end it.
• An entry in your audit trail. Not only in ours.

What stays shut

Areas protected by the Financial Security PIN remain closed to us, because unlocking one needs the PIN itself and we do not have it. Support can see that payroll exists and what state a run is in. It cannot open a payslip.

Why it reaches suspended workspaces

Support access works even when a subscription has lapsed — and so does your own help page. The moment you most need to reach your supplier is the moment something has gone wrong with the account, and a service that answers that with a payment wall has mistaken billing for support.

The part that is just a promise

None of this stops a determined insider with infrastructure access. What it does is make the ordinary path auditable and the extraordinary path obvious. We would rather tell you exactly where the line is than imply there is no line.