1. Purpose and Scope
The purpose of this Access Management Policy is to establish guidelines and procedures for managing access to Speak AI Inc.’s (“Speak AI”) information systems and data. This policy aims to ensure that access is granted appropriately based on the principle of least privilege and that it is managed and monitored effectively to protect the confidentiality, integrity, and availability of information.
2. Policy Statement
Speak AI is committed to protecting its information assets by ensuring that access to its systems and data is controlled and restricted to authorized individuals only. This policy outlines the processes for granting, reviewing, and revoking access, as well as the responsibilities of all users in maintaining secure access controls.
3. User Access Management- User Account Creation: Access to Speak AI’s internal systems and data will only be granted to individuals with a legitimate business need.
- Authentication: All users must authenticate using strong authentication methods, including complex passwords. Multi-factor authentication (MFA) is enforced for Google Workspace sign-in and our main administrative systems, and is being extended to remaining internal tools.
- Authorization: Access rights will be assigned based on the user’s role and responsibilities, ensuring adherence to the principle of least privilege.
- Security Controls: Security measures are in place to prevent unauthorized access, including rate-limiting authentication attempts and recording login activity.
Staff location and production access: Speak AI personnel are located in Canada (Mississauga and London, Ontario), with one engineering team member temporarily located in India. Production access is role-scoped: a small number of executive and engineering staff hold write access to production systems, some staff hold read-only access, and other staff have no production access. Access levels are reviewed by the Speak AI team.
4. Access Reviews and Audits- User Access Reviews:
- Standard user accounts are reviewed as people and roles change, and access is removed within 24 hours of someone leaving.
- Privileged access to production is limited to a small number of named staff and is reviewed by the Speak AI team when roles change.
- Logs: Application and infrastructure logs are centralised in AWS CloudWatch and retained for 90 days, and login activity is recorded separately. Logs are reviewed during incident investigation and pre-release security checks; automated scanning (Aikido Security, GitHub Dependabot) runs continuously on our code.
5. Access Revocation- Termination of Access: Access rights will be revoked immediately upon termination of employment or contract. Managers are responsible for notifying the IT Security Team to deactivate accounts and remove access.
- Role Changes: Access rights will be adjusted appropriately if a user changes roles within the organization. This ensures that users retain access only to the resources necessary for their new role.
6. Privileged Access Management- Definition of Privileged Access: Privileged access refers to accounts with elevated permissions that allow for administrative control over systems and data.
- Controls for Privileged Accounts:
- Privileged accounts must be strictly controlled and monitored.
- Users with privileged access must use separate accounts for administrative tasks and regular activities.
- Monitoring and Review:
- Privileged account usage is logged and reviewed.
- Privileged access is limited to a small number of named staff and is reviewed by the Speak AI team when roles change.
7. Remote Access- Multi-Factor Authentication (MFA): Remote access requires multi-factor authentication to ensure an additional layer of security.
- Encrypted Communications: Secure protocols such as TLS 1.2+ are used for all remote connections.
8. Third-Party Access- Vendor and Partner Access: Third-party vendors and partners who require access to Speak AI’s systems must comply with this Access Management Policy. Access will be granted based on contractual agreements and will be limited to the minimum necessary.
- Monitoring and Audits: Third-party access will be monitored and audited to ensure compliance with Speak AI’s security policies and procedures.
9. Responsibilities- IT Team: Responsible for implementing and maintaining access controls, conducting regular access reviews, and ensuring compliance with this policy.
- Speak AI Team: Responsible for approving access requests, conducting periodic reviews of user access, and notifying the IT Security Team of any role changes or terminations.
- All Users: Responsible for adhering to access management policies, safeguarding their authentication credentials, and reporting any suspicious activities or security incidents.
10. Policy Review
This policy will be reviewed annually or as needed to ensure its effectiveness and alignment with industry best practices and regulatory requirements. Changes to the policy will be communicated to all users.
11. Contact Information
For any inquiries or issues related to this Access Management Policy, please contact the IT Team at success@speakai.co.