People security and training policy

Before access#

1. A written role description exists for every role with access to in-scope systems GOV-07.
2. A confidentiality agreement or contract clause is signed before any access GOV-05.
3. Background verification is completed for anyone who will have production or customer-data access, within what the law of their country allows: identity, education, and previous employment. Records are kept by the People Owner, not in the evidence store GOV-06.
4. Access is requested and approved under 13 Access control.

Onboarding checklist#

• [ ] Contract and NDA signed
• [ ] Background verification complete
• [ ] Policies acknowledged GOV-04
• [ ] Security awareness training complete within 30 days GOV-08
• [ ] Device enrolled and meets the endpoint baseline
• [ ] Accounts created with approvals on record

Training#

• Security awareness training at hire and yearly: phishing, passwords and MFA, data classification, handling customer data, reporting incidents, using AI tools with company data.
• Engineers additionally: secure coding (OWASP Top 10, the playbook's security defaults), the SOC 2 gate, and 17 AI coding agents.
• Completion is recorded per person with a date.

Offboarding#

1. All access is removed within 1 business day of the last working day, and immediately for a termination for cause ACC-05.
2. Checklist, with the time each item was done: workforce identity, GitHub, Cloudflare, cloud console, production access and SSH keys, Gate admin, email, password manager shares, shared secrets they knew (rotate), devices returned or wiped.
3. Confidentiality obligations continue after departure; this is stated in the exit communication.