Kleidi - SaaS Admin Console with Consented Support Access and a Full Audit Trail

Home, tenant search, a Tenant 360 with 7 tabs for each of the 24 tenants, support access with 6 tabs and data requests, inside an app shell with the environment strip, search and elevation requests.

Elevated rights such as revealing personal data need someone else's approval and last at most 4 hours. Break-glass is capped at 60 minutes and needs an open incident and an on-call lead as second approver.

Due dates run from receipt, turn amber at 7 days and red at 3, and can be extended once by up to two further months. Deletions need a second approver.

Hotels in 6 countries, each with properties, 12 tenant users and 12 Stripe invoices, plus 14 staff, 18 support sessions (3 break-glass), 18 data requests, 3 incidents and 4 plans.

Shared Logins and Raw SQL

Support worked from a database replica, engineers shared one superadmin account and plans were edited by hand. Nobody could say who had looked at a hotel's housekeeper records last month, or why.

Processor for Someone Else's Data

For the personal data inside a tenant, the hotel is generally the controller and Myrtaki its processor under GDPR Article 28, acting on the tenant's documented instructions. For its own customer contacts, Myrtaki is the controller. Each request has to be handled in the right capacity.

Deadlines on Every Request

Access, erasure and portability requests must generally be answered within one month, extendable by two further months for complex cases with notice. At the end of a contract the tenant's data must be deleted or returned. A shared inbox could not keep that clock.

Evidence for Customers and Auditors

SOC 2 and ISO/IEC 27001 audits generally look for least privilege, and Myrtaki's contract says staff enter a tenant's workspace only with a tenant admin's consent, except break-glass during a declared incident. Both need a record that shows who, when, why and with whose approval.