Security best practices for your organization
UniAsset handles the platform side. These are the things that are yours.
Assign the minimum role
Access is your main control. Most people asking for "more access" need Manager, not Admin.
| Role | Grants |
|---|---|
| Owner | Everything, including billing, user management, and organization deletion |
| Admin | Full asset, category, and maintenance management, including deletion |
| Manager | Create and update assets, assign, manage maintenance, view reports |
| Employee | Read and update assets, complete maintenance, check items out and in |
| Viewer | Read-only |
There should be one Owner. To change who it is, transfer ownership.
Review roles periodically. People change jobs and keep permissions they no longer need.
Offboard properly
Deactivate the user. Access ends immediately, on their next request — not at their next sign-in — and their history stays attributed to them.
Then:
- Check in anything they have out, or it stays checked out and overdue.
- Reassign their assets and open work orders.
- Archive the Person if they have left entirely — an archived person cannot receive assignments or borrow assets.
- Revoke API keys they created or had access to.
On Cosmos, directory sync can deactivate leavers automatically. It runs daily — for an urgent revocation, deactivate manually.
Look after API keys
(Odyssey and above)
One key per integration. Then revoking one does not break the others, and the activity log tells you which system did what.
Minimum scopes. A telemetry pipeline needs iot:signal:ingest and nothing else. A key that can do everything is a key whose compromise costs you everything.
Store it in a secret manager. The key is shown once and cannot be retrieved — which is a security property, not an inconvenience. Never put it in source control or anything a browser can reach.
Use the IP allowlist where the calling system has a fixed address.
Revoke promptly when a system is decommissioned, a key may have been exposed, or someone with access leaves. Revocation is immediate.
Verify your webhooks
If you consume webhooks, always verify the signature against the raw request body using a constant-time comparison.
Without verification, anyone who learns your endpoint URL can post to it.
Be careful what goes in free-text fields
Descriptions, notes, and custom fields hold whatever people type. Personal data in an asset description is personal data you now have to account for.
Decide what belongs there, and tell your team.
Review these periodically
Sign-in history — yours at Settings → Profile. Anything unfamiliar means change your password and tell your Owner.
User list — who still has access, and at what role.
API keys — what exists, what it can do, and when it was last used.
The integration activity log — what your keys have actually been doing.
What is already handled
So you know where the line is:
- Passwords are hashed, never stored readably, never logged or emailed
- Every organization's data is isolated, with identity resolved on the server and never taken from client input
- Role, plan, and deactivation are re-read on every request, so revocation is immediate
- Files are stored under a per-organization prefix
- History is append-only and cannot be edited by anyone
- Raw errors and infrastructure detail are never shown to users
- Webhook targets must be HTTPS
Related articles
Need Help?
If you have questions not covered in this article, our support team is here to help.
Contact Support