Support Access
Who this guide is for: Tenant administrators who want Embay support staff to be able to sign in to their environment to investigate an issue — on the admin’s explicit, time-limited consent.
Embay platform staff cannot log in to your environment unless you grant access. A grant is time-boxed (1 hour to 7 days), can be revoked instantly, and every grant, revocation, and login is recorded in an audit history you control. This is modelled on the “Grant login access” pattern from Salesforce and Gainsight.
How it works
- You grant support access for a chosen duration (with an optional note).
- While the grant is active, an authorized Embay super administrator can open a single, single-use login session into your tenant.
- That session automatically ends when the grant expires or when you revoke it — whichever comes first.
- Everything is audit-logged on both sides (grant created / revoked / accessed).
Step-by-step
Grant access
- Go to Settings → User Management → Support Access.
- Under Grant support access, choose a Duration: 1 hour, 8 hours, 24 hours, or 7 days.
- Optionally add a Note (e.g. a ticket number).
- Click Grant access. The page now shows the active grant with its expiry.
Granting a new access automatically supersedes any earlier active grant, so there is only ever one live grant at a time.
Revoke access
While a grant is active, click Revoke access. Embay staff lose the ability to sign in immediately, and any active support session ends on its next request.
Review history
The Access history table lists every grant — when it was created, its expiry, who granted it, its status (Active / Revoked / Expired), and when it was accessed (if a support session was opened). This is your SOC 2 evidence of authorized access.
Configuration reference
| Field / control | Where | Behaviour |
|---|---|---|
| Duration | Grant form | How long the grant stays valid: 1h / 8h / 24h / 7d. |
| Note | Grant form | Optional free text stored with the grant (e.g. a support ticket id). |
| Grant access | Grant form | Creates the grant; supersedes any active one. |
| Revoke access | Active grant card | Ends access immediately. |
| Access history | Page table | Read-only log of all grants for SOC 2 evidence. |
Security & compliance
- Embay staff have no standing access — access exists only while a grant is active (ADR-010-B, PRD §7.3.3).
- The platform login uses a signed, 10-minute, single-use token; it can only be redeemed once, only on your tenant, and only while the grant is live.
- The support session cannot create new grants and expires with the grant.
- Audit events (
grant.created,grant.revoked,grant.accessed) are written for both your tenant and the platform — CC6.3 (access authorization) and CC6.6 (monitoring of system access).
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Embay says they can’t log in | No active grant, or it expired | Grant access again from Settings → User Management → Support Access. |
| The login link stopped working | Single-use token already redeemed, or grant revoked/expired | Grant a fresh access — each grant allows one support login. |
| You want to end a session early | Investigation finished | Click Revoke access; the session ends on its next request. |