Panther Ridge Community Association · Pelham, AL

Access Control Policy

Who may reach our systems, and how · Effective October 25, 2026

1. Purpose

This policy sets out how access to the Association's production systems, databases and resident information is authorized, granted, managed and removed. Its purpose is to reduce the risk of unauthorized access, data misuse and security incidents, and to support the Association's operational, legal and recordkeeping obligations.

2. Who and what this covers

This policy applies to every current member of the Board of Directors, every administrative person authorized by the Board, and every contractor, vendor or service provider granted access to Association systems or data. Those people are referred to here as authorized users.

It governs the systems the Association uses, including the resident portal and its web hosting account, the Neon database that stores portal records, the Stripe payment account, the Twilio messaging account, the Association's Google Workspace email and Drive accounts, the domain registrar and DNS account for pantherridge.live, and any identity provider or other service connected to them.

3. Precedence

Where this policy conflicts with applicable law, with the Association's governing documents, or with a written contract approved by the Board, that law, document or contract controls to the extent of the conflict.

4. Responsibilities

Board of Directors

Approves access roles, authorizes administrative users and vendors, and designates one or more people responsible for administering access.

Authorized users

Keep credentials confidential, use Association systems only for authorized purposes, and report a suspected compromise or unauthorized access promptly.

Vendors

Comply with this policy and with any contractual security requirement the Association imposes, including multi-factor authentication, logging and access termination obligations.

5. Access principles

5.1 Least privilege

An authorized user is granted only the minimum access needed to carry out their specific Association duties. Access is limited in scope, in duration and in permissions so far as is reasonably practicable.

5.2 Role based access

Access rights are assigned according to the user's role, such as officer, director, administrator or vendor, and the responsibilities that go with it, rather than on an individual basis, except where the Board or its designee expressly approves otherwise.

5.3 Multi-factor authentication

Multi-factor authentication is enabled and enforced for all administrative or privileged access to critical systems, including any identity provider, payment platform, administrative console and back end database.

5.4 Unique credentials

Each authorized user accesses Association systems through credentials assigned uniquely to that individual. Shared, generic or group administrative accounts are prohibited unless the Board approves one in writing for a limited purpose and with compensating safeguards in place.

6. Granting and removing access

6.1 Onboarding

Access is granted only after the person has been formally elected or appointed, or a vendor agreement authorizing access has been executed, and after any security or privacy orientation the Board requires has been completed. Each access request is documented and identifies the systems, the role and the permissions requested.

6.2 Offboarding

When an authorized user departs, changes role, is removed, or a vendor engagement ends, access is revoked or modified promptly and in all events within twenty-four hours where feasible. Where automation is available, credentials are disabled and the user is removed from the applicable directories and administrative groups. Every revocation is confirmed and recorded.

7. Reviews, monitoring and audit

The Board, or an officer or committee it designates, reviews access at least quarterly to confirm that active accounts are still necessary, that permission levels still match current roles, and that inactive or unnecessary accounts have been disabled or removed. The Association may monitor administrative access and keep audit logs as reasonably necessary for security, compliance and incident response.

8. Enforcement

Noncompliance with this policy may result in immediate suspension or termination of access, and may expose the individual or vendor to further action under applicable law, the Association's governing documents or any applicable contract. The Association may investigate suspected noncompliance and put remediation measures in place.

9. Review

This policy is reviewed periodically and updated as necessary to reflect changes in the Association's systems, vendors or obligations. Updates are approved by the Board or its designee.