OAuth 2.0 Tokens

• OAuth 2.0 is used for delegated authorization — allowing third-party services to access resources on a user's behalf without exposing raw credentials.
• Access tokens are short-lived and scoped to the minimum permissions required.
• Refresh tokens are stored securely and never exposed to the client-side frontend.
• Tokens are transmitted only over HTTPS/TLS — never over plain HTTP.

JSON Web Tokens (JWTs)

• JWTs are used for session authentication within Payzario's platform (managed via Base44).
• Tokens are signed using a secure algorithm (e.g., RS256 or HS256) to prevent tampering.
• Token expiration (exp claim) is enforced — sessions have a defined lifetime and require re-authentication upon expiry.
• Tokens are validated server-side on every request — client-side token manipulation is rejected.
• Sensitive data is never stored inside JWT payloads.

API Keys & Secret Management

• API keys for Stripe, Plaid, and other services are stored as encrypted environment variables — never hardcoded in source code.
• Keys are scoped to the minimum required permissions (principle of least privilege).
• Keys are rotated immediately upon any suspected compromise or team member departure.
• All API key access is logged and auditable.

Centralized Authentication

• All Payzario user authentication is centrally managed through Base44's identity platform — a single, consistent entry point for all app users and admins.
• No siloed or shadow authentication systems are permitted outside of the central platform.
• Session management, token issuance, and expiration are handled uniformly across all users.

Unified Access Rights Management

• Role-based access control (RBAC) is enforced — users are assigned roles (admin, user) that determine their permissions across all systems.
• Access rights are reviewed centrally during the monthly access review process.
• Privilege escalation requires explicit admin approval and is logged.

Access Activity Monitoring

• All login events, access grants, and permission changes are logged centrally.
• Audit logs provide a unified view of who accessed what, when, and from where.
• Anomalous activity (e.g., failed logins, unusual access patterns) triggers investigation.

Compliance & Visibility Benefits

• Centralized IAM simplifies compliance reporting by providing a single source of truth for all access records.
• Reduces risk of orphaned accounts, over-privileged users, and access drift.
• Supports rapid deprovisioning — access across all connected systems can be revoked promptly from one location.

Core Zero Trust Principle

"Never trust, always verify." Every access request — regardless of origin — must be authenticated and authorized before access is granted. No user, device, or service is implicitly trusted.

• All access requests are validated against current identity and permission state, not assumed from prior sessions.
• Lateral movement within Payzario's systems is restricted — access to one component does not grant access to others.

Multi-Factor Authentication (MFA)

• MFA is mandatory for all admin accounts across every platform (see MFA Policy for full details).
• MFA serves as the primary enforcement mechanism for zero trust identity verification.
• Authenticator apps are the preferred MFA method; SMS is accepted as a fallback only.

Continuous Monitoring

• Authentication and authorization events are logged continuously and reviewed for anomalies.
• Unusual access patterns (unexpected geolocation, repeated failures, off-hours activity) trigger investigation.
• Access logs are retained for a minimum of 90 days to support incident response and audits.

Micro-Segmentation

• Access to Payzario systems is segmented by role and function — users can only access the resources required for their specific responsibilities.
• Admin functions are isolated from general user access. Super admin controls are further restricted by email allowlist.
• Third-party integrations (Stripe, Plaid) operate with scoped, minimal permissions — they cannot access unrelated Payzario resources.
• Backend functions enforce server-side authorization checks independently of frontend controls.

Immediate Revocation on Termination

• All system access must be revoked within 24 hours of an employee or contractor termination.
• This includes access to Base44, Stripe, Plaid, email accounts, domain registrar, and any other Payzario-connected service.
• API keys and shared credentials associated with the departing individual must be rotated immediately.
• Active sessions are terminated and login credentials are disabled across all platforms.

Access Modification on Role Transfer

• When an employee changes roles, access rights are adjusted to match new responsibilities within 24 hours.
• Permissions from prior roles are removed — access is never additive without explicit re-approval.
• The principle of least privilege is re-evaluated at every role change.

Process & Checklist

• A standardized off-boarding checklist is followed for every departure or role change, covering all systems listed in the Employee Access Review Policy.
• The admin is responsible for executing the checklist and confirming completion.
• All de-provisioning actions are logged with timestamps and reviewer identity for audit purposes.

Minimizing Insider Threat Risk

• Prompt de-provisioning eliminates the window of opportunity for unauthorized access by former team members.
• Access logs are monitored for any activity from recently de-provisioned accounts as a post-termination check.
• Any detected access attempt after de-provisioning is treated as a security incident and escalated immediately.

Review Frequency

• Monthly: Full access review across all platforms (Base44, Stripe, Plaid, email, domain) — see Employee Access Review Policy for the full checklist.
• Immediately: Triggered by any personnel change, security incident, or suspected unauthorized access.
• Annually: Comprehensive audit of all roles, permissions, and access policies to ensure alignment with current business needs.

What Is Reviewed

• All active user and admin accounts across every connected platform.
• Role assignments — confirming each user's access level matches their current responsibilities.
• API keys and service credentials — confirming ownership and continued necessity.
• Inactive accounts — accounts with no activity in 30+ days are flagged for removal or suspension.
• Overprivileged accounts — any account with more access than required is downgraded.

Remediation Process

• Excessive or outdated permissions identified during a review are revoked immediately.
• Any account that cannot be confirmed as active and necessary is suspended pending verification.
• All remediation actions are logged with the date, reviewer, and change made.

Documentation & Compliance

• Each access review is documented with the date, reviewer name, systems checked, findings, and actions taken.
• Records are retained for a minimum of 3 years to support compliance audits.
• Review records are available to auditors upon request as evidence of ongoing access governance.

Principle of Least Privilege

• Every user, employee, and contractor is granted only the minimum level of access required to perform their job function — nothing more.
• Default access is set to the most restrictive level; elevated permissions must be explicitly requested and approved.
• Access rights are re-evaluated at every role change, project transition, or access review cycle.

Role-Based Access Controls (RBAC)

• Access to all Payzario systems is governed by predefined roles aligned to job responsibilities.
• Roles are documented and updated whenever team structure or system capabilities change.
• No individual is assigned permissions outside their defined role without admin approval and documentation.

Granting, Modifying & Revoking Access

• Granting: Access is provisioned only upon admin approval, limited to what the role requires, and logged at time of creation.
• Modifying: Changes to access rights require explicit re-approval; permissions from prior roles are removed before new ones are added.
• Revoking: Access is revoked within 24 hours of termination or role change, and all revocations are logged with timestamps.

Policy Maintenance & Compliance

• This access control policy is reviewed annually and updated to reflect changes in team structure, system landscape, or regulatory requirements.
• All updates are versioned, documented, and communicated to relevant team members.
• Adherence to this policy is verified through monthly access reviews and annual audits.
• Non-compliance is treated as a security incident and addressed immediately.