1. Purpose
This policy defines how SlashLogixx grants, reviews, and revokes access to production systems, customer data, source code, and administrative tooling for the Spark platform and all SlashLogixx-operated products.
2. Scope
Applies to every SlashLogixx employee, contractor, automated agent, and third-party subprocessor who can authenticate to any SlashLogixx system or environment that processes, stores, or transmits customer data.
3. Identity
- Every person has a single, named identity. Shared accounts are prohibited in production.
- Automated agents and services use dedicated service identities, scoped per integration, with no human use.
4. Authentication
- Passwords are never reused across systems and must satisfy a minimum entropy bar (NIST 800-63B aligned).
5. Authorization — Least Privilege
- Access is granted on a need-to-know, need-to-use basis. Default posture is deny; permissions are explicit.
- Production access (write access to customer data, infrastructure, or release pipelines) is scoped to the smallest set of personnel required to operate the platform.
6. Key & Secret Management
- Encryption keys for data at rest are managed in a key-management service (KMS).
- Cryptographic secrets are never transmitted by email, chat, or ticket; they are exchanged only through the managed secrets backend.
7. Revocation
- Suspected credential compromise triggers immediate revocation of the affected credential and forensic review under the Incident Response policy.
8. Audit Logging
- Privileged platform actions — code commits, service reloads, schema migrations, secret rotations, backups, and security scans — are recorded to an append-only audit log.
- Each entry is cryptographically hash-chained to the entry before it. Any later edit, deletion, or reordering of a record breaks the chain, and the break is detectable when the chain is re-verified.
9. Customer-Side Access (Spark Connect & Connect BYOK)
For the VPC-hosted components of Spark Connect and Spark Connect BYOK — and, on Connect BYOK, the customer-owned LLM endpoint — SlashLogixx has no operational access; the customer is the sole administrator. This policy governs SlashLogixx-operated systems, including the hosted Spark control plane; customers operating Spark components on their own infrastructure are responsible for an equivalent control set on their side.
10. Exceptions
Exceptions require a written request, a documented business justification, a stated expiration date, and approval from the Security owner. Open exceptions are reviewed monthly.
11. Contact
Questions, evidence requests, or reports of suspected access misuse: security@slashlogixx.com.