Code of conduct and acceptable use policy

Conduct#

1. Act honestly with customers, colleagues and regulators. Do not make claims about our products that are not true of the code (see the universal baseline red lines).
2. Treat customer data as the customer's. Look at it only to operate, support or secure the service, and only as much as the task needs.
3. Report security concerns, suspected incidents and policy violations at once, to the Security Owner or through the anonymous channel [describe channel] COM-06. Nobody is penalised for a report made in good faith.
4. Declare conflicts of interest to the directors.

Acceptable use#

1. Accounts. Use your own named accounts. Never share a password, MFA device, session, or SSH key. Never use a customer's account.
2. MFA is on for every work account that supports it.
3. Passwords come from a password manager, are unique per system, and are never written in code, chat, tickets, or notes.
4. Devices used to reach production or customer data meet the endpoint baseline: full-disk encryption, screen lock at 5 minutes or less, supported OS with automatic updates, built-in malware protection on, firewall on. The device is listed in the asset inventory ACC-17.
5. Customer data stays in approved systems. Do not copy it to personal devices, personal cloud storage, personal email, chat tools, or AI tools that are not approved for that data in the app register.
6. No production data in development unless it is masked, or the Security Owner has approved a specific, time-limited exception.
7. Software on work devices comes from trusted sources. Do not disable security tooling.
8. Lost or stolen devices are reported within 1 hour so access can be revoked.
9. Leaving. Return or wipe devices and hand over credentials through the offboarding process on the last day.

Enforcement#

A violation is investigated by the People Owner with the Security Owner. Outcomes range from a recorded conversation to termination of the contract and, where the law requires, a report to authorities. The process and outcome are recorded GOV-09.

Acknowledgement#

I have read and will follow this policy and the information security policy set.