Owner: Multibook Philippines Inc. · Version 1.2 · Last reviewed 2026-10-20 · Reviewed annually.
Purpose & scope
Defines how special-purpose, high-privilege access to ANTE’s production estate (servers, OS, databases, cloud consoles) is granted, authenticated, used, logged, and reviewed. Scope: the current production server fleet on DigitalOcean (SGP1), its PostgreSQL databases, the DigitalOcean and Cloudflare control planes, the Vercel project, and the application’s in-app administrative roles.
Principles
- Least privilege — access only to those who need it, at the minimum scope required.
- Named individuals only — no shared logins for human access; every privileged action is attributable to a person.
- Strong authentication — key/identity-based only; no reusable passwords for server or database administration.
- Auditability — privileged operations are logged and reviewable.
Server / OS administration
- Access method: SSH with public-key authentication only. Password and keyboard-interactive authentication are disabled fleet-wide.
- Network path: administrative SSH is reachable only over a private Tailscale (WireGuard) network; public port 22 is closed on production servers. Tailscale provides identity-based access with per-device authorization and revocation.
- Key holders: privileged SSH access to production servers is held by one designated engineer (Lead Developer / DevOps Engineer), who maintains the key-holder list. Other developers have no production server access; they work through the deployment pipeline.
- Brute-force protection: fail2ban (sshd jail) is active on the servers as defence-in-depth.
Deployment
Production deployments run from a CI runner that we operate inside the private VPC and reach servers over the private network. Deployment actions are attributable through GitHub Actions logs.
Database administration
PostgreSQL is bound to localhost (127.0.0.1) on each host and is not reachable from the network or internet; only the co-located application and on-host administrators connect. There is no public database endpoint.
Cloud control planes
DigitalOcean, Cloudflare, and Vercel console access is held by the designated Lead Developer / DevOps Engineer, with provider-side MFA enabled where available. API tokens / deploy keys are scoped to the minimum capability required and stored as CI secrets, never committed to the repository.
In-application administrative privilege
- Three-tier model: full-access flag, developer flag, and per-scope RBAC.
- Sensitive operations (payroll posting, journal-entry administration, chart-of-accounts changes) require an additional OTP confirmation.
- Support “log in as”: Multibook support can open a customer user’s session from the internal developer panel only at the customer’s request or with prior approval. It requires a one-time code issued to Multibook’s internal security channel and is recorded in the audit log. Customer administrators have their own audited “Log in as this user” feature (8-hour session, visible banner).
- All administrative actions are recorded in the append-only audit service (retained up to 24 months).
Logging & attribution
Privileged in-app actions → append-only audit database (up to 24 months). Deployments → GitHub Actions logs (per actor/commit). Server access → SSH/auth logs + Tailscale device logs.
Rotation & annual review
SSH keys and cloud tokens are rotated on personnel change; a person’s access is revoked immediately when they no longer need it, and removal is verified. At least once per year the list of privileged accounts is reviewed, and any access not required is removed.