Acceptable Use Policy¶

Purpose. Defines how everyone at Soon must use company information, accounts, devices and tools. It covers day-to-day use, messaging (email/Slack), video calls and screen sharing, and social media. Every new joiner reads and acknowledges this policy at onboarding.

1. Scope¶

Applies to all Soon employees and contractors, and to anyone else granted access to Soon systems or data. It covers all company accounts and tools (AWS, GitHub, Google Workspace/email, Slack, Stripe, Intercom, Sentry, PostHog, Netlify and any other approved service) and any device used to access them. Soon is fully remote and has no offices or data centres, so this policy applies wherever you work.

2. Policy¶

2.1 General¶

You must follow Soon's information security policies. Breaches may lead to disciplinary action.
Use of Soon systems may be logged and monitored for lawful security and operational purposes.
Use company systems primarily for business. Reasonable personal use of the internet on your device is fine as long as it does not interfere with work or break the law or this policy.
Do not use Soon systems to create, store or send material that is illegal, offensive, discriminatory or harassing.

2.2 Accounts and credentials¶

Your accounts are yours alone: never share credentials or use someone else's account. Shared/generic accounts are not permitted.
Follow the password and MFA rules in the Access Control Policy (minimum password length 12, MFA wherever supported).
Do not attempt to access systems or data you have not been authorised to access, or to bypass security controls.
Lock your screen when leaving your device unattended.

2.3 Handling information¶

Handle information according to its classification (Public, Internal, Confidential, Restricted — see the Asset Management Policy).
Store and share company data only in approved services. Do not copy customer data or other Confidential/Restricted information to personal accounts, personal cloud storage or unapproved tools. Approved AI tools and their connectors on personal paid plans are covered by §2.6.
Customer personal data must be handled per the Privacy and Personal Data Protection Policy; Soon is a GDPR data processor.
Do not paste secrets (API keys, passwords), customer personal data or Restricted information into any service not approved for that data. AI tools and assistants have their own rules — see §2.6.

2.4 Devices¶

Only use devices that meet the requirements of the Mobile Device / BYOD policies (disk encryption, screen lock, up-to-date OS) to access company data.
Do not disable security controls (encryption, screen lock, endpoint protection) on a device used for work.
Be cautious with attachments, downloads and links; only install software you trust and are licensed to use (see the IP & Copyright Compliance Policy).

2.5 Cloud services¶

Only use cloud/SaaS services approved by Soon for company data. Adopting a new service requires approval per the Cloud Services Policy.

2.6 AI tools and assistants¶

Soon is three founders, and AI assistants are part of how the company is run: writing code, answering support, handling email and documents, checking billing, and investigating production issues. This section describes that practice and the controls around it.

Approved tools (reviewed 2026-10-16): Claude and Claude Code (Anthropic), ChatGPT and Codex (OpenAI), Cursor, Gemini. They are used on individually held paid plans (for example Claude Max or ChatGPT Pro). Business plans that bill per API call are not affordable at our usage.

Approved connectors: GitHub, Linear, Gmail, Google Drive, Intercom, Stripe, the Soon app, and read access to production. Founders use them to operate the business.

Controls¶

Paid plan, work identity. Never a free tier. Sign in with your Soon Google account (@soonapp.io), which carries Google's 2-step verification. An @soon.works login is also fine, provided MFA is on.
Training off. Claude: Settings → Privacy → "Help improve Claude" off. ChatGPT: Data controls → "Improve the model for everyone" off and, for Codex, "Include environments" off. That is a separate switch the main one does not cover.
No feedback buttons (thumbs up/down, "share feedback") on conversations with Soon or customer material. On consumer plans, feedback can put the whole conversation into training even with training off.
Read-only where the tool allows it. Stripe through a restricted read-only key. Production through a read-only role, never a write credential. Changes to production, billing or customer accounts are made by a person, not by the agent.
Ask for what the task needs. Pull the ticket, email or record you are working on, not a bulk export. No exports of customer personal data, such as full user lists or database dumps, into an AI conversation.
Customers with contractual restrictions are out of bounds. Customers flagged restrictedExternalProcessors in the product (currently GXO) are never queried, read or discussed through an AI tool or connector. Their contracts restrict which processors may handle their data.
Secrets never go in. Credentials, API keys and tokens stay in the secrets manager (§2.2). Each repository blocks secret files (.env, *.pem, key files, ~/.aws, ~/.ssh) from agent reads: .claude/settings.json for Claude Code, .cursorignore for Cursor.
Checked every quarter. The quarterly device attestation includes a screenshot of each tool's training setting and its connected apps.
On leaving: delete Soon conversations and projects, disconnect connectors, and revoke the tool's OAuth grants (GitHub, Google, Stripe, Intercom). This is recorded on the termination checklist.

What this does not cover, and how that is handled¶

On consumer plans there is no data processing agreement between Soon and the AI provider. When customer personal data reaches the provider through a connector, it is therefore not covered by the sub-processor contract that GDPR Article 28(4) and our customer DPAs expect. Soon does not hide this:

The AI providers are listed in the Vendor & Sub-processor Register for this use, and disclosed to customers in the sub-processor list and in the next customer notification.
The gap is a recorded risk, R-29, accepted by top management with the controls above. It moves to a covered plan when the first of these happens: a customer objects or asks, a customer contract or questionnaire requires it, the first non-founder hire, or business plans becoming affordable. For scale, Claude Team and ChatGPT Business start at about $20–25 per seat, with a two-seat minimum.

In-product AI providers are a separate matter¶

Providers the platform calls on customers' behalf are sub-processors: they are listed in the register, disclosed to customers, and covered by a data processing agreement and a transfer mechanism. Adding one is a sub-processor change, not a tooling choice (risk R-23).

Adding a tool or connector needs the ISM's agreement and an entry in the Vendor & Sub-processor Register.

2.7 Electronic messaging (email and Slack)¶

Use Soon-provided accounts (company email, Slack) for business communication — never personal accounts.
Messages sent from company accounts are company records and may be reviewed for lawful purposes.
Do not send Confidential or Restricted information (including customer personal data) over channels not approved for that classification; check recipients before sending, and beware of address auto-completion.
Be alert to phishing: if a message looks suspicious, do not open attachments or click links — report it immediately (see 2.9).
Do not auto-forward company email to external or personal addresses.

Use only Soon-approved tools for meetings and collaboration.
Restrict meeting access to invited participants (links, waiting rooms or passcodes where the tool supports them).
Announce before recording a meeting; protect recordings according to the classification of what was discussed, and keep personal data out of recordings intended for publication.
When screen sharing, close or hide anything not intended for the audience (email, chats, credentials, customer data). Take the same care with cameras when discussing sensitive matters in shared or public spaces.

Only people authorised as part of their role may post from Soon's corporate accounts or speak publicly for Soon.
Never share customer information, personal data or other non-public company information on social media.
On personal accounts, make clear that opinions about Soon-related topics are your own; refer official queries to Soon's channels.
Keep personal and corporate accounts separate. Data protection and confidentiality obligations apply to personal posts too.

2.10 Reporting security incidents¶

If you spot or suspect a security incident, weakness, phishing attempt or lost device, report it immediately per the Information Security Incident Response Procedure — report via the Slack #Security channel (@-mention) or security@soon.works. (Formerly asked to confirm the channel, e.g. a dedicated Slack channel or email alias).

3. Roles & responsibilities¶

All employees and contractors — follow this policy and sign the acknowledgement at onboarding; report incidents and suspected phishing.
Managers — ensure their team members have read and acknowledged the policy and that access matches roles.
Policy owner (Olaf Jacobson, ISM) — maintains this policy, reviews it annually and answers questions about acceptable use.

Change log¶

Version	Date	Author	Comments
0.1	2023-12-11	Olaf Jacobson	First draft document
0.2	2026-07-18	Andrea Cardinali	Rewritten lean and Soon-specific (ISMS overhaul); absorbs Electronic Messaging Policy (ISMS-DOC-A05-10-3), Online Collaboration Policy (ISMS-DOC-A05-10-6) and Social Media Policy (ISMS-DOC-A05-1-1)
0.3	2026-10-16	Olaf Jacobson	§2.6 rewritten: personal paid AI plans permitted for source code and internal material under eight conditions (training off, no feedback, no connectors to customer data, no production keys in coding agents, quarterly check, offboarding). Customer data remains barred from every AI tool. Recorded as risk acceptance R-29.
0.4	2026-10-16	Olaf Jacobson	§2.6 rewritten to describe actual practice (sign-in with the `@soonapp.io` Google account, or `@soon.works` with MFA): personal paid plans with connectors (Gmail, Drive, Intercom, Stripe, the Soon app, read-only production), under nine controls. Customers with contractual processor restrictions (GXO) excluded. The remaining gap, no processing agreement under consumer terms, is disclosed and recorded as R-29.