Access Control Policy

Field	Value
Owner	Puneet Gupta (Co-Founder)
Classification	Internal (shareable under NDA)
Version	1.0
Effective date	2026-06-11
Next review	2027-06-11

1. Purpose

Ensure access to systems and data used to deliver the Pixis service is granted on a least-privilege, need-to-know basis and is reviewed and revoked appropriately.

2. Principles

• Least privilege — users and services receive the minimum access required.
• Segregation of duties — administrative/superadmin capabilities are separated from regular user functions.
• Need to know — data access is restricted to those who require it for their role.

3. Tenant data isolation

Customer data is logically isolated using PostgreSQL Row-Level Security (RLS) scoped by organization_id, enforced on every table. Each request additionally carries an organization context and a JWT organization claim that is validated server-side. Administrative (superadmin) functions are gated separately from tenant-scoped access.

4. Provisioning & deprovisioning

• Access is provisioned based on role when a user/account is created, and tied to an authenticated identity.
• Access is revoked promptly when a person leaves or a role no longer requires it.
• Inactive accounts are disabled or removed after 90 days of inactivity.

5. Access reviews

User and privileged access is reviewed at least quarterly to confirm it remains appropriate.

6. Authentication

Authentication requirements (password strength, MFA) are defined in the Password & Authentication Policy. MFA for high-risk and administrative access is on the roadmap. (Planned.)

7. Production access

Access to production infrastructure is restricted to authorized engineering personnel through the cloud provider's access controls and authenticated channels; there is no open or public administrative access to production systems.

Revision history

Version	Date	Author	Change	Approved by
1.0	2026-06-11	Puneet Gupta	Initial draft	Puneet Gupta (Co-Founder)