1. Purpose

This policy defines the rules and procedures for granting, reviewing, modifying, and revoking access to Payzario's systems, data, and infrastructure. The goal is to ensure the principle of least privilege is enforced at all times.

2. Scope

This policy applies to all Payzario employees, contractors, and third-party vendors who require access to Payzario systems, databases, APIs, or customer data.

3. Principle of Least Privilege

Access to systems and data is granted based on the minimum level of access required to perform a job function. No user shall have access beyond their role requirements.

4. Access Roles

• Admin: Full access to all systems, configurations, and customer data. Reserved for founders and designated technical leads.
• User: Access limited to their own account data and permitted application features.
• Vendor/Third-Party: Scoped API access only (e.g., Plaid, Stripe). No direct database access.

5. Access Provisioning

• All access requests must be approved by an admin before provisioning.
• Access is granted using role-based access controls (RBAC).
• Multi-factor authentication (MFA) is required for admin accounts.
• Plaid API credentials are stored in environment secrets and never shared.

6. Access Revocation

Access must be revoked within 24 hours of an employee's termination, role change, or contract end. Plaid and Stripe API keys must be rotated immediately upon suspected compromise.

7. Shared Accounts

Shared or generic accounts are prohibited. Each user must have a unique, individually identifiable account for all system access.

8. Policy Review

This policy is reviewed semi-annually or upon any significant organizational or system change.