Access begins with the company boundary.

Company scope

Company membership is the primary access boundary. Company records carry their company context, and connected Google settings are associated with that same context.

Role and Task visibility

Roles determine who can manage company settings and financial information. Ordinary Tasks can be visible to the company team, while restricted Tasks are limited to authorised people.

Least privilege

Connected services should receive only the access needed for their job. The Google Drive integration uses drive.file instead of broad read access to the entire Drive.

Session and release controls

Authentication is handled through the production identity service. OPS Lab includes release recovery controls intended to prevent colleagues from remaining on an obsolete cached application version.

Responsible use

• Never share account passwords through Tasks, comments or files.
• Remove former team members promptly.
• Review roles and restricted Task participants regularly.
• Report unexpected access or data exposure immediately.

Report a concern

Send security concerns to marketing@jndesign.com.my with the affected company, what you observed and how we can contact you. Do not include passwords or other secrets.