Volunteer Accounts Inactivity Guidelines

Access to systems that contain member data are only available on an as-needed basis to facilitate volunteer-led efforts including but not limited to new installations, support, and maintenance. The following process helps to ensure user privacy by disabling access to sensitive systems during periods when a volunteer steps away. Volunteers are more than welcome to re-request access (see below).

Systems

The following systems used by NYC Mesh volunteers contain different amounts and types of member data.

• OS Ticket
• MeshDB
• Private Slack Channels (#install-team)
• Invoice Ninja
• Stripe

Access to each individual system is provided to volunteers on an “as-needed” basis. Not all volunteers have or need to have access to these systems. Access within each system is also restricted. For example, there are fewer administrators than general users of each system.

Volunteer Administrator Responsibilities

As a volunteer administrator of a sensitive system at NYC Mesh, you are responsible for ongoing access audits to carry out these guidelines. This responsibility should be carried out at least quarterly. Once an access audit is completed, post in #audit, optionally including statistics (but not names) about the outcome.

When carrying out these guidelines, keep the following in mind:

• When possible, deactivate instead of delete the account as we hope the volunteer will return.
• When practical, inform the deactivated user of deactivation and describe the steps to reactivation (consider linking to these guidelines).
• When practical, configure the system to describe the steps for reactivation after an inactive user attempts to login.
• Resilience is important. Avoid deactivating other volunteer administrators or active volunteers without trying to reach out to them, waiting some time, and then gathering consensus with other volunteer administrators if needed.
• If a volunteer administrator is to be removed, ensure there are a sufficient number of backup volunteer administrators.
• Consult with other volunteer administrators when edge cases are encountered.
  

Inactivity

Volunteer accounts shall be deactivated after 90 days of unplanned inactivity. For the purposes of these guidelines, that means not logging into or using the specific system for 90 days.

Requesting Reactivation

Reach out to #audit or other volunteers in slack to request reactivation. There is much to do, we are happy for your return!