Trust Centre › 2. Who can see your data
Who can see your data
In short
People can only see their own company's records. The database rules refuse everything else. Every request is checked on Google's servers: by DIANO's database rules and by the server code. The web browser is never trusted to say who you are or what you may do.
Roles inside your company
- Each person in your company has one role: Company Admin, Finance User, Sales, Delivery, Procurement, Accountant, Auditor or HR Payroll. The role decides what they can see and change.
- Some steps need a set role. For example, only a Company Admin or Finance User can issue an invoice, and only a Company Admin can export all the company's data.
Give each person the smallest role that lets them do their work. A Company Admin can change a person's role.
Signing in
- Passwords must be at least 8 characters long.
- Since 19 October 2026, the Administration area asks every DIANO platform owner account for two-step sign-in: a password or Google sign-in, plus a code from an authenticator app. The older administration page (/admin-classic) does not ask for the code yet, and DIANO's servers do not yet refuse an owner account that signed in without it.
- Two-step sign-in is not available yet for the people in your company. Today they sign in with a password or with Google sign-in.
- Every sign-in is recorded with the time, the account and the internet (IP) address.
DIANO's own staff
- DIANO's staff access is held by one person: the platform owner, Jonathan Diale, Director of DIALE Consulting. He uses three owner accounts, one of them kept only for emergencies.
- The platform owner can read your company's records. This is needed to set up companies and to help when you ask. DIANO's pages do not let the platform owner read your audit trail or your users' private details.
- As the owner of DIANO's Google Cloud project, the platform owner could also reach all data with Google's own tools.
- Changes are logged, whoever makes them, but reading a record is not logged one record at a time yet.
Zero trust, in plain words
Zero trust means nothing is believed just because it says so. Every request is checked on Google's servers: by DIANO's database rules and by the server code. The web browser is never trusted to say who you are or what you may do. People can only see their own company's records. The database rules refuse everything else.
Roadmap: planned, not true yet
- Planned — target October 2026: DIANO's servers refuse a platform owner account that did not sign in with the authenticator code, and the older administration page asks for the code too.
- Planned — target November 2026: Two-step sign-in comes to the people in your company: required for Company Admins, with 7 days to set it up, and open to every user.
- Planned — target October 2026: Each time the platform owner reads your company's records, it is logged in the locked archive.
- Planned — target January 2027: The platform owner reads a company's records only through a support grant that the company approves, with each read logged.
Targets can move. When an item is done, it moves up into the page with its proof. The whole roadmap.
For your IT team / auditor
Each statement on this page, how it was checked and when. Every check was read-only. The full evidence (commands and their output) is available to auditors on request.
| Statement | How it was checked | Checked |
|---|---|---|
| People can only see their own company's records. The database rules refuse everything else. | DIANO's live database rules (sameCompany(companyId) on every company path; rules gate DIANO's deploy tools). | 2026-10-19 |
| Every request is checked on Google's servers: by DIANO's database rules and by the server code. The web browser is never trusted to say who you are or what you may do. | DIANO's live database rules (request.auth: Google-verified sign-in token); callables check request.auth (e.g. DIANO's live server code, DIANO's live server code exportAuditLog). | 2026-10-19 |
| Each person in your company has one role: Company Admin, Finance User, Sales, Delivery, Procurement, Accountant, Auditor or HR Payroll. The role decides what they can see and change. | DIANO's live database rules (roleIsAnyOf with these eight role names). | 2026-10-19 |
| Some steps need a set role. For example, only a Company Admin or Finance User can issue an invoice, and only a Company Admin can export all the company's data. | DIANO's live database rules (invoiceIssuer: Company Admin, Finance User); DIANO's live server code (EXPORT_ROLES = Company Admin). | 2026-10-19 |
| Passwords must be at least 8 characters long. | Google Cloud sign-in and access settings (read-only check, 2026-10-20) (password policy ENFORCE, minPasswordLength 8). | 2026-10-19 |
| Since 19 October 2026, the Administration area asks every DIANO platform owner account for two-step sign-in: a password or Google sign-in, plus a code from an authenticator app. The older administration page (/admin-classic) does not ask for the code yet, and DIANO's servers do not yet refuse an owner account that signed in without it. | release/production DIANO's records live through the deploy guard on 19 Oct 2026 at 19:47 UTC (21:50 SAST): DIANO's release record of 2026-10-19 ("A3 owners LIVE on production (19 Oct, 21:50 SAST)": end-to-end enrolment 11/11; an owner account enrolled at 20:14 UTC; the two other owner accounts not enrolled); the page's check: DIANO's published pages (DIA_TWO_STEP_V1: "every platform-owner account needs two-step sign-in"). Not enforced by the servers: DIANO's live server code (DIA_TWO_STEP_ENFORCE=off "until Stage A4"), DIANO's live database rules (isPlatformOwner(): no second-step check); DIANO's published pages (/admin-classic: no two-step script). Build X, 20 Oct 2026 (corrects build U's "not required yet", Jonathan's brief: "live on production since 19 Oct 21:50"). | 2026-10-20 |
| Two-step sign-in is not available yet for the people in your company. Today they sign in with a password or with Google sign-in. | DIANO's release record of 2026-10-19 (A3 for platform owners only; an enrolled Company Admin "cannot sign in to the client portal or /admin-classic once enrolled, until full A3"; enrolled second factors on production: 0). | 2026-10-19 |
| Every sign-in is recorded with the time, the account and the internet (IP) address. | Google Cloud logging and alerts (read-only check, 2026-10-20) (sink audit-logs-to-storage: identitytoolkit requests + diano_security); DIANO's live server code. | 2026-10-19 |
| DIANO's staff access is held by one person: the platform owner, Jonathan Diale, Director of DIALE Consulting. He uses three owner accounts, one of them kept only for emergencies. | DIANO's release record of 2026-10-19 (owner claim: 3 accounts, all Jonathan's, Jonathan 19 Oct; one is the break-glass owner); Google Cloud sign-in and access settings (read-only check, 2026-10-20) (roles/owner: 1 user). | 2026-10-19 |
| The platform owner can read your company's records. This is needed to set up companies and to help when you ask. DIANO's pages do not let the platform owner read your audit trail or your users' private details. | DIANO's live database rules (companies/{id} and records: DIANO's records; auditLog and users: no platform-owner clause, comments "support grant later"). | 2026-10-19 |
| As the owner of DIANO's Google Cloud project, the platform owner could also reach all data with Google's own tools. | Google Cloud sign-in and access settings (read-only check, 2026-10-20) (roles/owner: 1 user). | 2026-10-19 |
| Changes are logged, whoever makes them, but reading a record is not logged one record at a time yet. | Google Cloud server functions (read-only check, 2026-10-20) (audit* triggers on writes only); data-access logging is on for Cloud Storage only (DIANO's release record of 2026-10-17, "Access logging ON … for Cloud Storage"). | 2026-10-19 |