Is customer data ever accessed by support staff, and if so, how is access controlled and logged?

To provide fastest and most precise support, our (human) agents may choose to access some data necessary to solve your issue. Such access is allowed only to whitelisted personnel, and behind a MFA authentication (even if your application does not require it). Furthermore, any such access is reported by email to all of your application administrators. Any action performed by our agents is logged standardly as internal users, and the log is replicated to an independent storage to prevent any tampering.

This type of access for our support agents can be disabled on demand, while keeping in mind that it may significantly increase time to resolve certain support tickets.

Additionally, SIEM is used to detect any suspicious behaviour and an independent WAF and to automatically block it.