Access Control Policy

This Access Control Policy ("Policy") describes how MiseCentral LLC ("MiseCentral," "we," "us," or "our") governs logical access to the Services, production systems, and Customer Data. This Policy applies to MiseCentral personnel, authorized contractors, Customers, Authorized Users, Partners, and automated credentials.

Capitalized terms not defined herein have the meanings set forth in the MiseCentral Legal Library Defined Terms or the applicable Agreement.

1. Purpose and Scope

1.1. Purpose. MiseCentral implements access controls to ensure that only authorized individuals and systems can access resources commensurate with their role, and that access is attributable, reviewable, and revocable.

1.2. Scope. This Policy covers:

(a) Customer organization access through role-based permissions, seat licensing, and delegation controls;

(b) MiseCentral staff access through internal role separation and Support Mode;

(c) Partner access through Partner RBAC and Partner Support Mode under Customer delegation;

(d) non-human credentials, including API Clients and Service Accounts; and

(e) administrative access to production infrastructure.

2. Access Control Principles

2.1. Least Privilege. Users, service accounts, and integrations receive the minimum permissions necessary to perform authorized functions.

2.2. Separation of Duties. MiseCentral separates platform operator capabilities from Customer tenant administration. Customer administrators cannot assign internal MiseCentral platform roles. Partner permissions are independent from Customer employee RBAC.

2.3. Default Deny. Access is denied unless explicitly granted through role assignment, delegation, or credential authorization.

2.4. Attribution. Actions performed in the Services are attributable to the acting user, service account, Support Mode session, or Partner Support Mode session as applicable.

2.5. No Cross-Tenant Access. MiseCentral staff APIs and operational tools enforce organization scoping. Cross-tenant data access is prohibited except through authorized, audited Support Mode or Partner Support Mode sessions tied to a specific Customer organization.

3. Customer Access Controls

3.1. Authorized Users and Seats. Customers authorize natural persons as Authorized Users subject to licensed seat limits. Assigned Users plus pending invitations must not exceed licensed seats as stated in the Order Form.

3.2. Role-Based Access Control. Customers assign roles and permission profiles to Authorized Users according to hospitality operational needs, including adaptive profiles for scheduling, work execution, quality, food safety, and administration. Documentation describes available roles and permissions.

3.3. Administrators. Customer administrators manage organization settings, security policies including organization MFA mode, user provisioning, Connected Services, Connected Devices, API Clients, Service Accounts, and Partner delegations.

3.4. Service Accounts and API Clients. Service Accounts and API Clients are non-human credentials authorized by Customer administrators. Customers must protect credentials, rotate secrets according to internal policy, and scope permissions narrowly. Service Accounts may be exempt from organization MFA mandates when configured by Customer.

3.5. Connected Services and Connected Devices. Customers govern registration, authorization, and revocation of Connected Services and Connected Devices through organization controls. Access granted to integrations is limited to authorized scopes.

3.6. Marketplace. Where Marketplace is enabled, Customer administrators control which offerings are installed or enabled for their organization subject to Marketplace governance rules.

4. MiseCentral Staff Access

4.1. Platform Roles. MiseCentral personnel access internal operations surfaces, including the MiseCentral Operations Center, through platform roles assigned under least privilege. Access to /mise and platform routes requires platform capabilities enforced by middleware.

4.2. Support Mode. MiseCentral staff do not impersonate Customer users. Assistance is provided through Support Mode, which requires a valid support ticket, documented reason, duration limit, confirmation, and customer-visible notification. While Support Mode is inactive, Customer context in staff tools is read-only for diagnostic purposes unless otherwise permitted in Documentation.

4.3. Support Mode Permissions. Mutations to Customer configuration or data during Support Mode require appropriate staff permissions and generate audit records. Sensitive metadata such as passwords and tokens is excluded from assistance replay and audit exports.

4.4. Session Limits. Support Mode sessions auto-expire at the configured duration. Staff must end sessions when assistance is complete.

4.5. Platform MFA for Support Mode. MiseCentral requires multi-factor authentication for staff and partner roles performing Support Mode or Partner Support Mode, independent of Customer organization MFA settings, as described in the MFA Policy.

5. Partner Access Controls

5.1. Partner Organizations. Partners belong to Partner Organizations distinct from Customer organizations and MiseCentral staff identity. Partner Users receive permissions through Partner RBAC.

5.2. Customer Delegation. Partners access a Customer organization only when the Customer grants an active delegation with defined scope, duration, and permissions. Delegation is revocable by the Customer at any time.

5.3. Partner Support Mode. Partners assist Customers through Partner Support Mode under the same non-impersonation, ticket-linked, audited, and customer-visible principles as MiseCentral Support Mode.

5.4. Commercial Boundaries. Partners do not receive visibility into Customer invoices, payment methods, or subscription billing details unless commercially authorized through a separate written arrangement with MiseCentral and consent from the Customer.

5.5. Customer Data Control. Customer remains the controller of Customer Data. Partner access does not transfer ownership or independent processing rights beyond delegated assistance.

6. Provisioning and Deprovisioning

6.1. Provisioning. Access is provisioned upon verified authorization: employment or contract for MiseCentral staff; Customer administrator action for Authorized Users; Customer delegation for Partners; Customer administrator registration for API Clients and Service Accounts.

6.2. Deprovisioning. Access is revoked promptly upon termination of employment or contract, expiration or revocation of delegation, seat removal, role change, credential compromise, or Customer request. MiseCentral staff access is revoked through internal identity lifecycle procedures.

6.3. Periodic Review. MiseCentral reviews staff and contractor access periodically. Customers are responsible for reviewing Authorized User access, delegations, and non-human credentials within their organizations.

7. Privileged Access

7.1. Privileged access to production infrastructure is limited to authorized personnel, requires strong authentication including MFA, and is logged.

7.2. Break-glass or emergency access procedures exist for continuity scenarios and require post-event review and documentation.

7.3. Privileged access is not used to bypass Support Mode or Partner Support Mode requirements for Customer-facing mutations.

8. Access Violations

8.1. Unauthorized access attempts are monitored and may result in account lockout, session termination, and investigation.

8.2. Suspected access control violations must be reported to security@misecentral.com.

8.3. MiseCentral may suspend access where necessary to protect the Services, Customer Data, or other parties, consistent with the Agreement.

9. Policy Maintenance

9.1. MiseCentral reviews this Policy at least annually and upon material changes to access architecture or partner programs.

9.2. Customers configure organization access controls through the Services as described in Documentation.

10. Contact

MiseCentral LLC Attn: Security 8 The Green, Suite A Dover, DE 19901 United States security@misecentral.com