Access Control Policy

1 · Purpose

This policy governs who can access Nxt7a's systems and data, and ensures access is granted on the principle of least privilege and removed when no longer needed.

2 · Scope

Applies to all systems, applications, cloud resources (Google Cloud, BigQuery, Firebase), repositories, and data stores, and to all identities – human and service accounts – that access them.

3 · Policy Statements

Least privilege. Users and services are granted the minimum access required for their role or function, and no more. Broad or standing privileged access is avoided.

Identity and SSO. Access is tied to identity via `@nxt7a.com` single sign-on wherever possible, with multi-factor authentication enforced. Shared or generic accounts are prohibited except where technically unavoidable and individually approved.

Joiner – mover – leaver. Access is provisioned on a documented request when someone joins or changes role, and revoked promptly on departure or role change. Offboarding revocation is time-bound and verified (linked to the Employee Handbook exit process).

Privileged access. Administrative and elevated access (e.g. GCP IAM admin, production data, KMS keys) is restricted, individually justified, logged, and reviewed.

Client data isolation. Access to client, partner and platform data respects the platform's data-isolation model; cross-client access is not permitted. Access to Indigenous community data carries the additional controls in the Data Sharing & Indigenous Data Sovereignty Policy.

Service accounts and keys. Machine identities follow the same least-privilege and review rules. Keys and secrets are stored in approved secret management, rotated, and never embedded in code or shared in plaintext.

Access reviews. Access rights are reviewed periodically (at least annually, and after major change) and corrected where excessive.

4 · Roles & Responsibilities

• Information Security Officer defines access standards and runs access reviews.
• System/resource owners approve access requests for their systems.
• Users request only the access they need and report excess or anomalies.

5 · Compliance, Monitoring & Breach

Access is logged and monitored. Unauthorised access attempts or sharing of credentials are security incidents handled under the Incident Response Policy and the Code of Conduct.

6 · Related Documents

Information Security Policy · Acceptable Use & IT Policy · Data Classification & Retention Policy · Incident Response Policy · Data Sharing & Indigenous Data Sovereignty Policy.

7 · Standards Mapping

• B Corp: Customers.
• ISO/IEC 27001:2022: A.5.15–5.18 (access control, identity, authentication, access rights); A.8.2–8.5 (privileged access, information access restriction, secure authentication).

8 · Version History