Skip to main content

Accounts and their approvers

The Accounts tab on a service lists the accounts that use it: since when, until when, and under which contract, if you track that. Add account picks one from the service's organization. Setting an end date keeps the record that an account used it; taking an account off removes it. Either way, the service's History keeps the change.

Each row also shows how many of the account's contacts may approve changes to the service.

[!IMPORTANT] An account without approvers is marked No approvers: Change Management can't ask that account for approval until someone is added.

On the account's page​

An account that uses services gets three more sections on its page, under its contacts:

  • Services: the services it uses, with their dates and contract.
  • Change approvers: the people at the account who approve changes to the services it uses. They will approve on their portal, signed in, once Change Management is on. Each approver covers all the services the account uses, now and later, or only the ones picked; click the services next to a name to change it.
  • Notice contacts: who gets maintenance notices and incident updates. If there are none, notices go to the approvers.

Add approver and Add notice contact pick one of the account's own contacts.

History of approvers and notice contacts lists every change, newest first, with who made it. Nothing in it is ever edited, so it answers the auditor's question “was this person an approver for this account when they approved?” for any date. The history keeps only a reference to the contact: if a contact is erased (a privacy request), the history shows “an erased contact” and holds nothing personal about them.

You see the approvers who are contacts you can see; the others are counted (“2 more you can't see”).

What the accounts are responsible for​

Also on the Accounts tab: the part of running the service that is up to the accounts using it, one line each, such as “Keep the list of your users who may use the VPN up to date” or “Approve or reject changes within two working days”. Assurance reports (ISAE 3402, SOC 2) list these as complementary user entity controls, so writing them down here means they are ready when the report is.