My team is in charge of developing integration software for our customers. The customer integrates their system with our platform in order to use our services.
Numerous customers avoid managing their accounts on our platform and simply want to "use" our system, so we manage their accounts for them.
Since we are required to create accounts for them, we also have to authenticate these accounts on the software that we create for them, so we have to store their own credentials in a safe place.
This data is encrypted, but we decrypt it temporarily to install the credentials in the software, then it can no longer be accessed. No other teams or external entities can access this data.
Is this GDPR compliant, given that our team members temporarily directly manage passwords and have access to this data when an installation is required?
Or is it mandatory that only the customer should be able to install their authentication on the commissioned software?
If this is GDPR compliant, does the customer have to explicitly consent to this (although this is implied, the customer refuses to manage their accounts anyways and we dedicate them our own account managers)?