ACCESS CONTROL & API SECURITY POLICY

This Policy establishes controls for user access, privileged access, authentication, application interfaces and APIs used by CYBERVED AI PRIVATE LIMITED to protect systems, customer information, transaction data, gift-card/voucher services and partner integrations.

• Apply least-privilege and need-to-know access.
• Prevent unauthorised access to systems and data.
• Protect API credentials, tokens and integration secrets.
• Secure partner and internal API communications.
• Maintain access logs and accountability.
• Detect and respond to suspicious access activity.

This Policy applies to employees, contractors, administrators, applications, APIs, servers, cloud environments, databases, endpoints and third-party integrations used for Company operations.

• Least privilege
• Need-to-know
• Role-based access
• Segregation of duties
• Unique user identity
• Periodic review
• Prompt de-provisioning

1. Business owner identifies the requirement.
2. Access level is defined according to role.
3. Authorised approver reviews the request.
4. IT/administration provisions access.
5. Access is recorded and periodically reviewed.

Users shall have unique accounts wherever technically feasible. Shared accounts shall be avoided and, where unavoidable, controlled and monitored.

• Appropriate authentication shall be required for protected systems.
• Multi-factor authentication should be enabled for privileged and sensitive access where feasible.
• Authentication secrets shall be protected from disclosure.
• Failed or suspicious authentication activity should be monitored.

Administrative and privileged access shall be restricted to authorised personnel, used only when required and subject to enhanced monitoring and periodic review.

Access shall be created, modified or revoked promptly when personnel join, change roles or leave the Company.

Access to critical systems, customer data, production environments and privileged functions shall be reviewed periodically based on risk.

• Use authenticated and authorised API access.
• Validate all input and request parameters.
• Apply appropriate rate limiting and abuse controls.
• Protect API keys, tokens and secrets.
• Use secure transport for sensitive communications.
• Log relevant security and transaction events.
• Return secure error messages without unnecessary sensitive information.

APIs shall verify the identity and permissions of calling applications/users and enforce access restrictions at the appropriate endpoint and data level.

API keys, client secrets, tokens, signing keys and similar credentials shall be securely generated, stored, transmitted and rotated according to risk.

API requests shall be validated for format, type, length, permitted values and authorisation context to reduce injection, manipulation and abuse risks.

Critical or public-facing APIs shall use appropriate rate limits, throttling, monitoring or other controls to reduce automated abuse and denial-of-service risk.

• Authentication failures
• Authorisation failures
• Unusual request volume
• Sensitive endpoint activity
• Administrative actions
• Material configuration changes
• Relevant error patterns

Material API changes shall follow documented change management, compatibility and testing procedures. Deprecated interfaces shall be retired or restricted within appropriate timelines.

Applications and APIs shall be developed and tested using appropriate secure coding, code review, dependency management and security testing practices.

External partners shall receive only the access required for their approved integration. Partner credentials and access permissions shall be periodically reviewed.

Production access shall be restricted, authorised and monitored. Development or test credentials shall not be reused in production unless specifically approved and secured.

Direct database access shall be restricted to authorised personnel and services. Privileged database activity should be logged and monitored where appropriate.

Remote administrative access shall use approved secure mechanisms and appropriate authentication. Unauthorised remote access is prohibited.

Suspected credential compromise, unauthorised access, token leakage or API abuse shall be escalated under the Cyber Incident Response & Cyber Fraud Policy.

Access shall be revoked or suspended when no longer required, when credentials are compromised or when security/risk circumstances justify restriction.

Exceptions shall be documented, risk-assessed, time-bound where appropriate and approved by authorised management.

Access requests, approvals, access reviews, privileged activity, API credentials and material security events shall be retained according to applicable requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in systems, APIs, partner integrations, access architecture, security threats or applicable requirements.