Access Control Policy

← Back to the Trust Centre

1. Purpose

This policy sets out how access to Clara and to the information in it is controlled. It covers two things: how an organisation's own people, AI agents and clients get access inside the Clara platform, and how xlabs (Pty) Ltd ("xlabs", "we") controls its own access to the production systems that run Clara.

It applies to every Clara organisation at getclara.co.za and its organisation sub-domains, and to everyone at xlabs who works on Clara. Read it with the POPIA Statement.

2. Principles

Access to Clara follows four principles:

• Least privilege: people and agents get only the access their work needs, and nothing by default.
• Explicit grants: access is given on purpose, by a named person, never assumed.
• Checked on the server: every request is checked against the caller's access before any data is returned, whatever screen or tool it comes from.
• Traceable: grants, changes and sensitive actions are recorded in an audit log.

3. Who can access Clara

4. Access inside an organisation

Each organisation's data is held in its own separate database. Inside it, access is narrowed in layers. A person must pass every layer that applies.

These checks apply equally to the Clara assistant, in text chat and voice. It reads only through the same access checks, so it never shows a person something they could not open themselves.

5. Admin roles

Each organisation decides who its admins are. Admins add and remove users, set module and policy-type grants, assign client owners and connect integrations. We recommend organisations keep the number of admins small and review it regularly.

Admin rights do not bypass policy-type grants, and admins do not see other users' Requests. A small number of xlabs platform administrators can view an organisation's Requests to give support; this access is limited to named xlabs staff and is covered in section 8.

6. Client portal

An organisation can give its clients access to a client portal. The portal is kept apart from the staff platform:

• Sign-in is by a six-digit code, or a one-click link, sent to the client's email. There are no passwords.
• Codes expire after 10 minutes, are single-use and allow at most five attempts. Each login also has a daily limit on attempts, and repeated failures are throttled.
• Codes and session tokens are stored only as hashes. The session cookie is secure, cannot be read by scripts and is limited to the organisation's own sub-domain. Sessions expire after seven days.
• A portal session cannot reach staff pages or staff APIs. The portal shows a client only their own records, through a filtered view that leaves out costs, internal notes and other clients.
• Staff invite, disable and re-enable each portal login. Archiving a client disables all of its logins.

7. Connected accounts

Users and admins can connect email, calendar, file storage, accounting and messaging accounts to Clara. For each connection:

• A person chooses to connect it, and it asks only for the access the feature needs.
• Passwords, API keys and tokens are kept in an encrypted vault. They are write-only from the app and never shown again after saving.
• Email sent by a person goes from that person's own account. Automations send as their named owner.
• A connection can be disconnected at any time, which stops Clara's access to that account.

8. xlabs access to production systems

xlabs staff need some access to run and support Clara. We control it as follows:

• Least privilege: by 30 November 2026, staff will have access to production systems only where their role needs it, and only to the systems needed.
• Named accounts: by 30 November 2026, every person will use their own account on every production system, and shared logins will not be used.
• Secrets in a vault: production keys and credentials are kept in encrypted secret stores, never in code, documents or chat.
• Changes to production databases go through the reviewed, staged rollout process, not ad hoc edits.
• Support access to an organisation's data is used only to resolve an issue the organisation has raised, or to keep the service secure and running.

9. Multi-factor authentication

Multi-factor authentication (MFA) means signing in with a second step, such as a code from an authenticator app, as well as a password.

• In Clara, MFA is required for admin accounts. Other staff users and client portal users do not use MFA in Clara today.
• xlabs staff must use MFA on every third-party system that holds client data, source code, production access or billing. This must be enabled by 30 November 2026 on the systems below.
• MFA is checked as part of every quarterly access review. An account without MFA on a system that requires it has its access removed until MFA is on.

10. Joiners, movers and leavers

By 30 November 2026, these steps will follow a written joiner, mover and leaver checklist, with a record of who approved each change.

Inside Clara, organisations manage their own joiners, movers and leavers. When someone leaves, an admin should deactivate their account and reassign the clients and Requests they own.

11. Access reviews

• From 30 November 2026, xlabs will review who has access to Clara's production systems at least every quarter, check MFA is on, remove access that is no longer needed, and record each review. The first review will be completed by that date.
• Platform administrator access will be reviewed at the same time.
• We recommend each organisation reviews its users, admins and grants at least every quarter. Grants and owner changes are recorded in the audit log to support this.

12. Logging and monitoring

Sign-ins, grant changes, owner changes, shares and portal logins are recorded. Every change to key records is written to an audit log with who made it, whatever made the change. Security testing of access controls is ongoing, and findings are tracked until resolved.

13. Reporting a problem

If you think someone has access they should not have, or you find a weakness in Clara's access controls, email miles@xlabs.co.za. We treat it as a security incident and respond without undue delay.

14. Contact

Information Officer, xlabs (Pty) Ltd: Miles Marshall, CEO, miles@xlabs.co.za.
Information Regulator (South Africa): inforegulator.org.za

15. Review

We review this policy at least once a year, and whenever Clara's access controls change materially. The version and effective date above identify the current version.