Credentials must never be sent in plain text across regular messages, emails, or chat threads. All sensitive access details, API secrets, and server keys must be handed over via encrypted, time-limited secret links or platform-level collaborator invites managed through the Ask Xylo chat on this portal.
Acceptable methods for credential transfer
The Technology department requires all external credentials to be passed using methods that guarantee end-to-end encryption and automated expiration.
We accept two primary methods of credential handover:
1. Delegated collaborator access: Where the third-party platform permits (such as Shopify, GitHub, Cloudflare, AWS, or Figma), do not share a primary login. Send an organisation or team invite directly to the technical user account specified by our team. This preserves audit trails and removes the need to transmit raw passwords. 2. Encrypted, single-view secret links: If direct account delegation is unavailable and a specific username and password must be shared, use a zero-knowledge secret-sharing tool (such as a 1Password secure share or an encrypted single-use secret link). The link must be configured to expire after one view or within 24 hours. Paste only the secure link into the Ask Xylo chat on this portal; never paste the actual password into the chat window.
Never transmit multi-factor authentication (MFA) recovery codes alongside passwords in the same transmission.
Scoping access: the principle of least privilege
Before generating access for Xylora Studios, review the permission tier you are granting. The client is responsible for scoping credentials appropriately:
* Staging over production: If the project scope is confined to staging or development environments, do not provide production database access or live hosting logins. * Role-based permissions: Select developer, editor, or technical manager roles rather than root or account owner privileges. Account owner access is only requested when transferring domain ownership or configuring core merchant account billing. * Dedicated accounts: Do not share your personal administrative credentials. Create a separate, named profile for Xylora Studios so that actions can be attributed correctly and revoked cleanly once the engagement concludes.
Step-by-step handover sequence
The handover process follows a strict operational timeline handled exclusively during our standard studio hours (Monday to Thursday, 09:00-17:00 GMT):
1. Requirement notification: The Technology department sends an itemised access request through the Ask Xylo chat, stating the exact systems and permission tiers required. 2. Client provisioning: You create the scoped accounts or generate encrypted secret links containing the credentials and MFA seed codes (if required). 3. Transmission: You post the secure link or confirm the invitation dispatch inside the Ask Xylo chat. 4. Ingestion and verification: Our team retrieves the credentials within our first reply target of 24 hours, imports them into our centralised, encrypted studio vault, and verifies connectivity. Once retrieved, we acknowledge receipt in the chat. 5. Completion and revocation: At project sign-off, or when a phase finishes, our team notifies you that access is no longer required. You must then revoke or rotate those credentials immediately on your systems.
Credential compromises and remediation
If credentials are submitted incorrectly, our team will intervene to maintain system hygiene:
* Plain text transmissions: If you paste raw passwords, private keys, or credentials directly into the Ask Xylo chat or support threads, our team will immediately purge the message containing the data. You will be instructed to rotate the exposed credentials immediately on your provider's platform before work can proceed. * Expired links: If an encrypted link expires before our team accesses it, you will need to re-issue a fresh link in the chat. Note that repeated link expirations may introduce project delays, particularly if generated outside studio working days (Friday through Sunday). * MFA lockouts: If a login requires an SMS or authenticator prompt, coordinate the login window with our team via Ask Xylo chat during studio hours to avoid automated account lockouts.
Credential handover checklist
Before transmitting access details, confirm the following steps:
* [ ] Direct collaborator or organisation invites were used where supported. * [ ] Staging access was selected over live production systems wherever possible. * [ ] The assigned role is limited to the minimum necessary for the brief (no unnecessary owner rights). * [ ] The password is unique and not reused across your other business platforms. * [ ] Passwords and API tokens are packaged inside an encrypted, single-view link set to expire within 24 hours. * [ ] The secure link has been delivered via the Ask Xylo chat on this portal.