Daniel Brecht has no second factor
Their Finance role carries 2 irreversible permissions — approve a payout, adjust a wallet. A password is the only thing in front of those, and a password is the thing that gets phished. Until 2FA is on, this account is the cheapest way into the platform.
The master admin is not gated by anything
Rania Haddad holds every permission, bypasses every second signature, and cannot be demoted or deleted by anyone here. That was chosen deliberately for incident speed. What it means in practice: one credential is the whole platform, so that account’s 2FA and its recovery path are the two things worth being paranoid about.
Admins97 active
Without 2FA2of any state
Can move money3payout or wallet adjustment
Roles in use6of 6 defined
echoSignals staff
Master admin first, then active by name, then everybody inactive
| Admin | Role | Permissions | Reach | 2FA | State | Last seen | |
|---|---|---|---|---|---|---|---|
Rania Haddad rania@echosignals.io | Master admin | 23 / 23 | 6 irreversible | On | Active | 14 Sep 13:30:00 12m ago | |
Ana Duarte ana@echosignals.io | Commercial | 7 / 23 | none | On | Active | 12 Sep 13:42:00 2d ago | |
Daniel Brecht daniel@echosignals.io | Finance | 6 / 23 | 2 irreversible | Off | Active | 13 Sep 10:42:00 1d ago | |
Khalid Aziz khalid@echosignals.io | Fleet ops | 9 / 23 | 1 irreversible | On | Active | 14 Sep 11:42:00 2h ago | |
Mei Tanaka mei@echosignals.io | Fleet ops | 9 / 23 | 1 irreversible | On | Active | 14 Sep 07:42:00 6h ago | |
Omar Farouk omar@echosignals.io | Compliance | 6 / 23 | none | On | Active | 14 Sep 12:42:00 1h ago | |
Sofia Marchetti sofia@echosignals.io | Finance | 6 / 23 | 2 irreversible | On | Active | 14 Sep 09:42:00 4h ago | |
Priya Raman priya@echosignals.io | Fleet ops | 9 / 23 | 1 irreversible | On | Suspended | 24 Aug 13:42:00 21d ago | |
Tomas Nilsen tomas@echosignals.io | Read-only | 4 / 23 | none | Off | Invited | 05 Sep 13:42:00 9d ago |
Five rules on this page
What the controls will and will not let you do
- The master admin cannot be demoted, suspended or deleted from this page, by anyone, including themselves. The controls are absent rather than disabled — a greyed button is something people ask to have enabled.
- Only the master admin can invite an admin or change a role. No other role can be given that permission — it is not in the role editor and not in any dropdown. Compliance can read this page and change nothing on it.
- Everybody else holds exactly one role. Authority is changed by changing the role, never by granting one person an extra permission, which is what keeps the Roles page an honest answer to “what can Finance do”.
- Every action here is on the audit trail with the actor, the role they held at the time, and the reason. Granting a permission is an action like any other.
- An invited admin has no access until they accept and set up a second factor. An invitation that is never accepted expires rather than sitting open — a stale invite is an unclaimed account with a role attached.