Protect the company

Security, Backups & Offboarding

Security is an operating process, not one setting. Use least privilege, separate identities, backups, audit logs and immediate offboarding.

IridesceuxHVNCommandCloudflare

Security baseline

Every person gets a unique identity.
MFA for every Command user; strongest MFA for privileged users.
Command hostname fully protected by Access.
JWT validation enabled after values are verified.
Never store secrets in Git.
Code Studio only for Technical Admin/Super Admin.
Review audit logs after major changes.
Use separate production/test broadcast feeds.

Offboard an employee — exact order

1

Disable them in Command

Super Admin → Team & Access → set account inactive. This blocks the internal role immediately.

2

Remove Access permission

Remove their email/group membership from the Command Access policy.

3

Disable/revoke company identity

Suspend or remove their Google Workspace/identity-provider account according to company policy.

4

Revoke other platform access

GitHub, Cloudflare dashboard, OBS machine, social accounts, storage, shared tools.

5

Rotate exposed secrets

If the person knew privileged shared secrets, rotate them and update the affected services.

6

Review the audit log

Confirm the final actions and preserve offboarding documentation.

v20.4 authentication baseline

CF_ACCESS_TEAM_DOMAIN configured.
CF_ACCESS_AUD configured.
COMMAND_REQUIRE_ACCESS_JWT=true.
COMMAND_ALLOW_HEADER_AUTH absent/false in production.
Command hostname fully behind Access.
Incognito test confirms an unauthorized identity cannot reach Command.