Start free
Home / Trust & legal / Secure Configuration Checklist

Secure Configuration Checklist

A practical checklist for workspace owners and admins. Stelaah is built to protect your data by default; this is how to configure your own workspace for least privilege and a clean audit trail.

Last updated July 24, 2026 Ask a security question
Least privilege Clean offboarding Retention control Audit-ready
Who this is for: workspace owners and admins. Work through it once when you set up, then revisit the membership and admin checks each quarter.

1 Set up roles with least privilege

Access follows plan, then workspace, then role and per-person grants. Give each person the least they need.

  • Keep the owner and admin count small. Only a few people should have owner or admin rights. Everyone else should be a member.
  • Assign members, not admins, by default. New teammates start as members and are elevated only when a real need exists.
  • Use per-person grants for exceptions. When one person needs a little more or less, use grants and restrictions rather than promoting them to admin.

2 Review membership regularly

Access is enforced at the database, so removing a member removes their ability to query your data, not just their menu.

  • Deactivate people who leave promptly. Remove access as part of offboarding, the same day where possible.
  • Reassign their work. Move open tasks, projects, and client ownership to an active teammate.
  • Re-check admin list quarterly. Confirm every owner and admin still needs that level.

3 Tune per-member access

The interface decides what to show; the database decides what a person is allowed to query. Keep the two aligned to least privilege.

  • Enable only the features each role needs. Use workspace toggles and per-member access so people see the modules relevant to their work.
  • Restrict sensitive areas. Billing, settings, and exports should be limited to owners and admins.

4 Configure retention & deletion

Owners and admins control how long each class of record is kept, and can place legal holds before anything is purged.

  • Set retention policies by record class. Define how long each type of record is kept, based on your legal and business needs.
  • Place legal holds where required. Hold records that must not be deleted while a matter is open.
  • Review purge blockers. Check active blockers before scheduling a purge, so nothing needed is removed.
  • Confirm your obligations first. Stelaah provides the policy engine and evidence trail; review your own legal obligations before setting schedules.

5 Export an Audit Pack

For security reviews, procurement, or your own records, owners and admins can export operational evidence from Settings.

  • Export the Audit Pack when reviewed. It includes CSV evidence, retention and deletion evidence, a security scorecard, and a printable review summary.
  • Trust the redaction. Secrets and credential-like fields are redacted from exported payloads.

6 Share client portals safely

Client portals and account-free links let clients act without a full account. Scope them to just what the client needs.

  • Share only what the client needs. Give each client access to their own records, not the whole workspace.
  • Treat portal links as sensitive. Anyone with an active link can use it, so share it with the intended person and revoke when done.

7 Understand AI routing

Aria routes requests through the provider configured by authorized Stelaah platform operators. Workspace content is not used to train third-party foundation models, and provider keys stay server-side.

  • Review the current provider list. The Subprocessors page identifies the providers that may process an Aria request.
  • Brief your team on AI use. Anything Aria generates is labelled AI-generated and should be verified before you rely on it.

8 Keep owner & billing current

Recovery and continuity depend on the right people being reachable.

  • Keep at least two owners. So you are never locked out if one owner is unavailable.
  • Protect owner and admin logins with two-factor. Sign in with a Google account that has two-factor authentication enabled, so your highest-privilege accounts are the hardest to compromise.
  • Keep billing and contact details current. So renewals, receipts, and important notices reach the right person.

9 Report issues

If you spot a security problem, or something in your configuration you're unsure about, tell us. Report vulnerabilities to security@stelaah.com rather than exploiting them. We support good-faith research and will not pursue action against researchers who follow responsible disclosure.

Related: Security overview, Security & Privacy FAQ, and Data Processing Addendum.

Back to top