Legal
This Access Control Policy defines how MarineOps manages user identity, permissions, authentication, and access to subscriber data. It applies to all subscriber accounts, staff members, and internal MarineOps personnel.
The purpose of this policy is to ensure that access to MarineOps systems and subscriber data is granted only to authorized individuals, is limited to what is necessary for their role, and is protected by appropriate authentication controls — particularly for users who can access financial data connected through Plaid.
Every staff member in MarineOps is assigned one of the following roles. Each role defines a baseline set of permissions. Account owners can further customize permissions for individual staff members.
| Role | Financial Access | MFA Required | Typical Use |
|---|---|---|---|
| Owner | Full | Yes | Business owner — full access to all features |
| Manager | Full | Yes | Shop manager — all features except billing settings |
| CPA | Financial only | Yes | External accountant — invoices, reports, reconciliation |
| Advisor | Configurable | If financial permissions granted | Service writer — ROs, scheduling, customers, invoices |
| Technician | None by default | No (unless financial permissions granted) | Field tech — schedule and assigned repair orders only |
MFA is required for any subscriber account that has access to financial features, including bank reconciliation, invoices, and financial reports. This includes Owners, Managers, CPAs, and any Advisor or Technician account that has been granted financial permissions.
Technician accounts with no financial permissions are exempt from MFA to support shared-device workflows common in RV service shops where tablets may be locked to a specific station.
MarineOps uses email-based one-time password (OTP) for MFA. After entering a correct password, a 6-digit code is sent to the user's registered email address. The code is valid for 10 minutes and single-use. The code is stored as a bcrypt hash in the database and is never stored or transmitted in plaintext after delivery.
After successfully completing MFA, a user may choose to trust their current device for 30 days. A cryptographically random token is issued and stored as a SHA-256 hash in the database, with the plaintext token stored only in an HttpOnly, Secure, SameSite=Lax browser cookie. On subsequent logins from the same browser on the same device, MFA is bypassed for the duration of the trust period. Trusted device records expire automatically after 30 days.
New staff members are added by the account owner through the Staff Management section of MarineOps. The owner assigns a role and initial temporary password. The new user is required to sign in and should change their password on first use.
When a staff member is deactivated in MarineOps, their account is immediately disabled. All active authentication tokens for that user are invalidated, and all trusted device records are purged. Deactivated accounts cannot be used to log in.
Account owners should deactivate staff accounts immediately when an employee leaves the organization.
Daily Defense Solutions LLC personnel access production systems only for the purpose of maintaining the platform, investigating support tickets at subscriber request, or responding to security incidents. Production database access is restricted to authorized personnel via SSH-tunneled connections. No MarineOps employee can view a subscriber's Plaid access token in plaintext.
Internal system access for Daily Defense Solutions LLC personnel is reviewed quarterly. Subscriber accounts are self-managed — account owners are responsible for reviewing and maintaining the access of their own staff members.
Violations of this access control policy — including sharing login credentials, attempting to access data beyond one's assigned role, or circumventing MFA — may result in account suspension or termination per the Terms of Service.
Questions about this policy may be directed to: