Owner: Multibook Philippines Inc. · Version 1.2 · Last reviewed 2026-10-20 · Reviewed annually.
Commitment
Multibook Philippines Inc. does not access a customer’s data without that customer’s request or prior approval. Customer data entered into ANTE belongs to the customer; Multibook acts only as the operator of the platform and as the customer’s personal information processor (see the Data Processing Addendum).
When Multibook personnel may access customer data
Access is limited to legitimate operational needs and only with an auditable basis:
- At the customer’s request — e.g. a support ticket asking us to investigate or correct something.
- With the customer’s prior approval — e.g. a maintenance or migration activity agreed in advance (email/ticket trail).
- Where strictly required to keep the service running or secure — e.g. responding to an incident — in which case the access is logged and the customer is informed.
In all cases access is the minimum necessary to perform the task.
Who can access
Production server and database access is limited to the designated engineer in the Privileged Access Policy, authenticated by key and identity, never by shared credentials. Third-party providers that host or support the service are listed on the Trust Center.
Application-level support access (“log in as”)
Multibook support can open a customer user’s session (“log in as”) from the internal developer panel only at the customer’s request or with the customer’s prior approval. The action requires a one-time code issued to Multibook’s internal security channel (Slack) and is recorded in the audit log, attributable to the person who performed it. Customer administrators (the highest two access levels) also have their own audited “Log in as this user” feature, which opens an 8-hour session with a visible banner.
How access is controlled and recorded
- Servers/databases are reached only over the private Tailscale admin network (public SSH closed); databases are bound to localhost and are not internet-reachable.
- Production-server access is separate from application support access; both are logged.
- In-application data operations by administrators are captured in the append-only audit service (retained up to 24 months), attributable per account.
- Credentials and tokens are encrypted at rest; OAuth tokens and API keys are AES-256 field-encrypted in the application.
High-risk action approvals
Certain destructive actions, for example payroll unposting, or deleting all journal entries or the chart of accounts, require a one-time code issued through Multibook. This is an extra control. The code message goes to Multibook’s internal security channel (Slack) and carries only the requester’s identity (name, email and company) and the action, not the business records.
Configuration changes affecting the customer
After go-live, configuration changes that affect the customer’s environment are made only after the customer’s approval (email/ticket).
Customer rights
On request, the customer may receive a summary of administrative access to their data drawn from the audit trail.