Review risk: Unauthorised access to the privileged credential vault

The credential vault holds the administrator passwords and keys for the hosting platform and for customer environments. Someone who got into it would reach most of what customers trust Tidewell IT with.

Measures

Access needs a hardware security key and is limited to named engineers, and every retrieval is logged and reviewed each month. The vault runs on its own hardened servers inside the management network.