Yes. But only during client setup and support, and restricted to defined roles. The approval of access rights is segregated from the implementation, and user access rights are handled in according to the principle of least privilege.
Yes. When necessary, granting and approving access requests to Scoped Systems and Data is segregated in order to minimize risks.
Yes. Both physical and remote access to all of QR Planet's systems, whether storing or processing scoped or other data, is restricted on a need-to-access-basis.
Yes. Access rights are reviewed periodically and also when a Constituent's role changes, and are adjusted if necessary, especially privileged access rights.