Our freelance marketing team needs earn a portion of every online sale. They will receive notification via email upon each sale. The trust in the system needs be instilled by a secure and permission based method. Meaning I need them to have full faith in the initial programming and confident it cannot be changed without tehir expressed permission.
Solution proposed: Lock editing of the payment file on the server only allowing access to editing with two passwords. My password and the marketing teams password would be necessary to edit. I was thinking a tree of folders with .htaccess on each ultimately allowing access to the bottom tier where the payment file resides.
Suspected Issue: The webmaster could FTP download the file and re-upload it without consent and unnoticed.
Can anyone offer an easier method to accomplish this monitoring of our good faith contract or am I on the best track. I feel there's an easier way, maybe even ready made I could implement.