Access Control Policy

Last updated: October 22, 2026

Access to systems and customer data is granted on least privilege, protected by single sign-on and MFA, and reviewed twice a year.

Scope

GCP organization and projects, source code repositories, identity provider, production databases, internal tools and all SaaS tools holding company or customer data.

Policy

Identity and authentication

1. Each person has a unique account; shared accounts are not allowed except where technically required, and then are stored in a password manager with an owner.
2. Google Workspace is the identity provider and central identity source; SSO is used wherever supported.
3. MFA is required for all accounts. This includes GCP and source code administrators.

Granting and removing access

4. Access is requested and approved in writing, and recorded in the access log with the date, system, role, approver and date granted. The approver is the system owner or Security Officer, and never the person receiving access.
5. Access follows least privilege and role-based groups. GCP IAM roles are granted to groups, not individuals, and basic roles (Owner, Editor) are avoided in production.
6. Access is removed in a timely manner when someone leaves (Human Resource Security Policy).

Reviews and monitoring

7. The Security Officer reviews access to GCP, source code, the identity provider and production databases twice a year. Access that is no longer needed is removed in a timely manner, and the review is recorded as evidence.
8. GCP Cloud Audit Logs (Admin Activity and Data Access for production) are enabled and retained as set out in the Operations Security Policy.

Service accounts and keys

9. GCP service accounts have one purpose each and the minimum roles needed. Service account keys are avoided in favor of workload identity; any existing key is rotated regularly.
10. Secrets are stored in a secrets manager, never in source code.

Customer access

11. Customer users authenticate to the product with strong passwords or SSO.