This policy governs who may access the CC Charges Tracker application and its underlying systems, and how that access is granted, controlled, and removed.
All access to consumer financial data is managed through a single, centralized identity and access management system: the application's own account directory. Identity creation, authentication, role assignment, multi-factor enrollment, and de-provisioning are all performed through this one system — there is no separate or unmanaged path to the data.
Each user has a unique, named account. Shared or anonymous accounts are not permitted for accessing consumer financial data.
Users are granted the minimum access required for their role. Roles separate read-only users from administrators who can link accounts and manage settings.
The application owner reviews the list of active users, their roles, and access/authentication logs periodically (at least every six months) and removes access that is no longer needed.
Consent to access financial data is obtained from the account holder through Plaid Link at the time of connection, and a record of each consent (institution, scope, time, and granting user) is retained for audit purposes.
Passwords are stored only as salted hashes. API keys and secrets are stored in access-restricted files on the server, encrypted where applicable, and are never committed to source control or exposed to users.