<p>Access to personal data is restricted based on the principle of least privilege. Employees and contractors access user data only when necessary for their role and only through authenticated, logged, and monitored systems.</p><ol class="mb-3"><li>Multi-factor authentication required for all employee access to production systems</li><li>Role-based access control with quarterly access reviews and immediate revocation upon role change</li><li>Privileged access management with session recording for KYC and financial data access</li><li>Separate production and development environments with anonymised test data</li><li>API authentication using OAuth 2.0 and API key rotation policies for Seller Panel integrations</li></ol>