Review local access
Use separate named local accounts. Review Users & business access and Roles & permissions whenever responsibilities change. Limit business and payment-account grants to the work a user performs. Technical administration and financial approval are separate responsibilities.
Password changes, account disablement and access changes revoke existing sessions. Keep an authorised System Administrator available for recovery; the last active administrator is protected against removal. Do not distribute that administrator's password as a shortcut around role configuration.
Protect the deployment
Serve only public/ over HTTPS. Keep configuration, schema, installer, engine, modules and storage outside the public root. Preserve mode-0700 private directories and mode-0600 generated files where the release requires them. Do not display PHP errors publicly.
Private PHP diagnostics are written to storage/logs/php-error.log. Give logs the same careful handling as financial records: do not publish them or include full files in a community post. Remove secrets, customer data and payment references from any support excerpt.
Keep keys with the backup
Protect config/accounts.php, original encryption keys, the external licence identity and database backups. Loss of encryption keys can make protected records unrecoverable. Rotate compromised provider credentials through the provider and local configuration, and review queued work before sending again.
Configure only the SMTP and payment services you actually use. The product licence authority does not receive local staff passwords, customer records or merchant secrets as part of activation.