Access-control complexity scales with organizational size. LADLE is small, so its access model is small. Everything is documented; nothing is discretionary.
People with production access
What 'production access' means
- Ability to log into the Supabase console (with row-level security still in effect for user data by default; RLS-bypassing service-role access is separately audited).
- Ability to deploy to the Vercel production environment (via GitHub-linked deploys with mandatory PR review).
- Ability to view aggregate logs (application logs, error tracking, uptime monitoring).
- Ability to see billing metadata in Stripe (payment method last-four, subscription state; not full card numbers — Stripe holds those).
What production access does NOT include
- Automatic browsing of user chat content. Reading a specific user's chats requires either (a) an explicit customer-support ticket where the user has granted access, or (b) a direct legal-process obligation. Both routes are logged.
- Bypassing user-level rate limits or usage caps for personal accounts.
- Deleting content on behalf of users without a documented request.
- Overriding the no-training-on-chats guarantee with Anthropic; this is contractual, not a toggle.
Audit logging
Onboarding new production access
As of publication, we don't have a plan to add a third person with production access in the next 6 months. If we do: the process is (1) written confidentiality agreement, (2) MFA setup, (3) documented reason for access, (4) named revocation trigger (departure or role change). The number of people with production access is publicly visible; if this page says 2, the answer is 2.
Customer-side access
For team plans, the workspace admin has the ability to add/remove members, view billing, and (on explicit request, with user notification) export a specific member's data. Admins cannot browse other members' chats. This is per-design and not a toggle — see /help/teams-and-seats/admin-controls for the reasoning.
REPORT AN ACCESS-CONTROL CONCERN · PRIVACY@LADLE.CHAT