Northgate: auditors flag shared logins at Preston and Warrington

Project: Support
Type: Question
Status: Closed Won't Do
Priority: Medium
Organization: Northgate
Reporter: Rachel Owusu <rachel.owusu@northgate.example>
Assignee: Ines Costa <ines.costa@acme-hq.example>
Labels: northgateauditsign-in
Components: identity-service
Created: 10 Feb 2026, 10:40 UTC
Updated: 11 Feb 2026, 09:15 UTC
Resolved: 11 Feb 2026, 09:15 UTC

Description

Our Q4 audit report came back. The auditors flag that night drivers at Preston and Warrington share logins (PRESTON-NIGHTS, WARR-YARD), so requests made under them can't be tied to a person. About 400 of our drivers have no company email. What can we do?

Linked issues

relates to SUP-862 Northgate: when do phone codes come? Done
relates to SUP-940 Northgate: move site workers to phone codes Done

Comments (4)

Ines Costa · 10 Feb 2026, 13:05 UTC

Hi Rachel, the auditors are right that a shared login can't tell you who asked or who can open what. Today everyone needs an email address to sign in, so the options are:

personal email addresses, where drivers agree to it;
addresses on a Northgate domain, one per driver, even if nobody reads them.

Signing in without email is a request we hear from other logistics customers too; I've added Northgate's audit finding to it.

Ben Carter · 10 Feb 2026, 14:00 UTCInternal note

Rachel says personal emails won't fly with their union. They'll keep the shared logins for nights until there's another way.

Rachel Owusu · 11 Feb 2026, 08:50 UTC

We'll note it as a known gap for the auditors. Please tell us if sign-in without email comes.

Ines Costa · 11 Feb 2026, 09:15 UTC

Will do. Closing for now.