Controlled access. Documented changes. Human review.
How Jace Haus handles access, permissions, and operational control to keep your MSP and your clients secure.
1. Client-owned accounts
We strongly recommend that all automation infrastructure, logic, and accounts live within your own tenants. We do not want to host your automated logic. You should own the keys.
2. Least-privilege permissions
We request only the minimum API scopes necessary to execute the agreed-upon workflow. We do not require global admin access to your PSA or RMM unless absolutely necessary for a specific requested automation.
3. Human approval for sensitive actions
By default, any automation that modifies production data, sends client-facing communication, or executes destructive actions must include a "human-in-the-loop" approval step via Teams or Slack before execution.
4. Test environments where possible
We prefer to build and test in sandbox environments. If you cannot provide a sandbox, we build using read-only API calls until the logic is verified, and use safe test records during deployment.
5. Execution logs
All delivered workflows include comprehensive logging. Every action taken by the automation is recorded, providing a clear audit trail of what happened, when, and what data was processed.
6. Error handling
Automations are built to fail safely. Unhandled exceptions trigger alerts to your designated team channel, and the workflow stops gracefully rather than proceeding with incomplete data.
7. Documentation and handoff
Every sprint concludes with a handoff document detailing the system boundary, API keys used, required permissions, and how to safely pause or kill the automation in an emergency.
8. Data retention
We do not ingest or store your client data on our own servers. Data is processed in-memory within the automation platform (e.g., Make.com, n8n, or AWS Lambda) and discarded after the run completes.
9. Subprocessors
If third-party AI models (like OpenAI or Anthropic) are required, we mandate the use of enterprise API endpoints that guarantee zero data retention for training purposes.
10. Incident communication
In the event that an automation behaves unexpectedly, we maintain direct communication channels with your team to rapidly diagnose, patch, or disable the workflow until the issue is resolved.
Disclaimer
Jace Haus does not claim SOC 2 certification unless certification is actually obtained. Security requirements are reviewed before access is granted. High-risk or regulated workflows may be declined. Legal and data-processing agreements can be reviewed for appropriate engagements.