Access reviews
By Mira Holm · created 3 Apr 2023, 09:20 UTC · last updated 26 Oct 2026, 13:40 UTC · version 13
access-reviewsiso-27001compliance
Owner: Maja Schulz · Every quarter. Each system's owner confirms who has access and why; anything nobody can explain is removed.
What we review
| System | Owner | What |
|---|---|---|
| AWS (each region) | Mira | Who can reach production, and with which role |
| Production databases | Mira | Direct access (should be nobody day to day) |
| GitHub (acme-identity-service, acme-portal, acme-notifier) | Rafael | Organisation owners and admins of each repository |
| Jira and Confluence | Ines, Lukas | Site and project administrators |
| Google Workspace | Maja | Administrators |
| Support sessions | Ines | Who may open a support session to a customer's organisation |
| Mailcrest, Textbridge | Elif | Who can sign in to their consoles |
| Emargen | Ana | Administrators, and personal tokens used by coding agents |
Log
| Quarter | Done | Removed | Notes |
|---|---|---|---|
| Q4 2025 | 12 Dec 2025 | 6 | Two leavers' GitHub access |
| Q1 2026 | 27 Mar 2026 | 3 | |
| Q2 2026 | 26 Jun 2026 | 4 | GitHub evidence incomplete: a minor finding in the ISO audit |
| Q3 2026 | 9 Oct 2026 | 5 | Piet de Vries's access confirmed removed after the contract ended in July; Jonas Berg's and Pia Lang's access checked |
| Q4 2026 | due 11 Dec 2026 | Starts 30 November |
Added for Q4
Personal tokens in Emargen that Codex and Claude Code use (Jonas, Aiko) are in the review from Q4: each token belongs to one person, and its owner confirms it is still needed. (Maja, 26 October)
Joiners and leavers
Managers ask for access through a Jira task in OPS when someone joins and the day they leave. Leavers lose everything on their last day; Maja checks within a week.