Access control and audit logs

Three perspectives

1. Who can access (people / service accounts)
2. What they can access (data / features / environments)
3. Record who did what and when (audit log)

The principle of least privilege

Start every permission from the minimum necessary and expand as needed. "Broad just in case" is the source of accidents.

RBAC (role-based access control)

Assigning permissions to roles rather than to individuals, and assigning roles to individuals, is easier to manage.

Example roles:
- Admin       … all permissions (a very small number)
- Operator    … read/write through production tools
- Support     … read-only access to customer data
- Developer   … development and staging only
- Auditor     … read-only access to the audit log

Access to secrets and tokens

• ReceiptRoller client secret → production service accounts only
• Customer access tokens → the app runtime user only; hide them from humans
• Webhook secret → the receiving server only

Audit log

Recording who did what is essential for detecting misuse, investigating incidents, and responding to compliance requirements.

Events to record

• Login / logout to the production environment
• Retrieval of secrets and tokens
• Viewing customer data (especially bulk retrieval)
• Data deletion / export
• Changes to app settings
• Granting / revoking permissions

Items each record should include

• Timestamp (UTC)
• Actor (user_id / service_account_id)
• Action (read, write, delete, etc.)
• Target (resource_type + resource_id)
• Result (success / failure)
• Client IP / User-Agent
• Related request ID

Retention

• Storage dedicated to audit logs (write-only, tamper-proof)
• At least 1 year (3–7 years in some industries)
• Stored separately from application logs

Periodic review

• Quarterly: inventory granted permissions and revoke unneeded ones
• Monthly: check the audit log for anomalous patterns
• On offboarding: immediately disable the account and rotate related secrets
• Annually: review the entire access control policy

Multi-factor authentication (MFA)

Make MFA mandatory for all users who can access the production environment. We recommend TOTP (Google Authenticator, etc.) or FIDO2 over SMS.

Related guides

• How to think about data protection
• Best practices for production operation
• Rotating secrets
• Back to the developer help index