16Security and access control
Control who can see what, and keep every company apart
Authenticator-app sign-in, roles and data scopes, audited support access and strict separation between companies. Described plainly, including what we do not claim.
What is security and access control?
ZimraStudio protects a workspace with authenticator-app multi-factor sign-in, role-based access control with data scopes, an audit trail, strict separation between companies, and file-type and content checks on uploads. We hold no third-party security certifications and do not claim any.
Who is it for?
- Admins who decide who can see which module and whose records
- Organisations that want a second step at sign-in
- Anyone who needs to explain access and audit to a board or a donor
Sign-in
Multi-factor sign-in with an authenticator app
Turn on a second step with any authenticator app. You scan a code once, confirm with a six-digit code, and save ten recovery codes in case you lose the phone. The same step applies in the web app and the Android app.
- Authenticator app. Works with Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden.
- Recovery codes. Ten one-time codes are shown once so you are never locked out.
Who sees what
Roles, data scopes and an audit trail
Access is by role, per module and per action. Data scopes decide whether someone sees their own records, their team's, or the whole company. A missing permission means no access. Changes to roles and permissions are recorded with who, when and what changed.
- Role-based access control. Roles can inherit from a hierarchy you draw.
- Audited support access. When platform support needs to look at a company's workspace, that access is recorded.
- Tenant isolation. Every request is checked against the company it belongs to, on the server.
To do
In progress
Done
Uploads
File-type and content checks
Uploads are inspected before they are stored. Programs, scripts, macro-enabled documents, archives that hide them, and files whose content does not match their name are refused. This is a policy check, not an antivirus.
- File-type checks. Dangerous types are refused.
- Content checks. A file that is not what its name says is refused.
How it works
How it works, in 3 steps
Give roles
Create roles and decide which modules and data scope each one gets.
Turn on MFA
Each person opens their security settings and adds an authenticator app.
Review the audit trail
Check who changed roles and permissions, and when.
| Topic | Position |
|---|---|
| Multi-factor sign-in | Authenticator app, with recovery codes |
| Access control | Roles, data scopes and an audit trail |
| Separation between companies | Checked on the server for every request |
| Uploads | File-type and content checks (not an antivirus) |
| Certifications (SOC 2, ISO 27001 and similar) | None held, none claimed |
| End-to-end encrypted chat | No. Chat is encrypted in transit. |
Questions
Questions about security and access control
Does ZimraStudio support multi-factor authentication?
Yes. Each person can add an authenticator app and confirm sign-in with a six-digit code. Ten recovery codes are shown once during setup.
Which authenticator apps work?
Any app that supports standard time-based codes, for example Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden.
How are companies kept apart?
Each company is its own tenant, and the server checks the company on every request that reads or changes data.
Can ZimraStudio staff see my data?
Platform support access to a company's workspace is audited, so it is recorded. Ask us for the current details of how support access is granted.
Do you hold SOC 2 or ISO 27001?
No. We hold no third-party security certifications and do not imply that we do.
Do you scan uploads for viruses?
We check file types and content and refuse dangerous or disguised files. That is a policy check and not a replacement for an antivirus.
Is chat end-to-end encrypted?
No. Messages are encrypted in transit but not end-to-end, because the platform stores, searches and routes them.
Last updated . Checked against the product by the ZimraStudio team.
See it with your own work in it
Start a trial, or book a short walkthrough and bring a real example. We will set it up with you.
New companies start on a 14-day trial of the Growth plan.