Access is by invitation only. Authentication, authorization and data access are enforced server-side.