Acceptable Use Policy¶

Purpose. Defines how everyone at Soon must use company information, accounts, devices and tools. It covers day-to-day use, messaging (email/Slack), video calls and screen sharing, and social media. Every new joiner reads and acknowledges this policy at onboarding.

1. Scope¶

Applies to all Soon employees and contractors, and to anyone else granted access to Soon systems or data. It covers all company accounts and tools (AWS, GitHub, Google Workspace/email, Slack, Stripe, Intercom, Sentry, PostHog, Netlify and any other approved service) and any device used to access them. Soon is fully remote and has no offices or data centres, so this policy applies wherever you work.

2. Policy¶

2.1 General¶

You must follow Soon's information security policies. Breaches may lead to disciplinary action.
Use of Soon systems may be logged and monitored for lawful security and operational purposes.
Use company systems primarily for business. Reasonable personal use of the internet on your device is fine as long as it does not interfere with work or break the law or this policy.
Do not use Soon systems to create, store or send material that is illegal, offensive, discriminatory or harassing.

2.2 Accounts and credentials¶

Your accounts are yours alone: never share credentials or use someone else's account. Shared/generic accounts are not permitted.
Follow the password and MFA rules in the Access Control Policy (minimum password length 12, MFA wherever supported).
Do not attempt to access systems or data you have not been authorised to access, or to bypass security controls.
Lock your screen when leaving your device unattended.

2.3 Handling information¶

Handle information according to its classification (Public, Internal, Confidential, Restricted — see the Asset Management Policy).
Store and share company data only in approved services. Do not copy customer data or other Confidential/Restricted information to personal accounts, personal cloud storage or unapproved tools.
Customer personal data must be handled per the Privacy and Personal Data Protection Policy; Soon is a GDPR data processor.
Do not paste secrets (API keys, passwords), customer personal data or Restricted information into consumer AI tools or any service not approved for that data. Approved AI tools (confirmed 2026-08-13): Claude, ChatGPT, Cursor and Gemini may be used for work. Never paste customer personal data, credentials, secrets or access tokens into any AI tool, approved or not. Source code may be shared with the approved coding tools. Anything not on this list needs the ISM's agreement first. In-product AI providers are managed separately as sub-processors (risk R-23).

2.4 Devices¶

Only use devices that meet the requirements of the Mobile Device / BYOD policies (disk encryption, screen lock, up-to-date OS) to access company data.
Do not disable security controls (encryption, screen lock, endpoint protection) on a device used for work.
Be cautious with attachments, downloads and links; only install software you trust and are licensed to use (see the IP & Copyright Compliance Policy).

2.5 Cloud services¶

Only use cloud/SaaS services approved by Soon for company data. Adopting a new service requires approval per the Cloud Services Policy.

2.6 Electronic messaging (email and Slack)¶

Use Soon-provided accounts (company email, Slack) for business communication — never personal accounts.
Messages sent from company accounts are company records and may be reviewed for lawful purposes.
Do not send Confidential or Restricted information (including customer personal data) over channels not approved for that classification; check recipients before sending, and beware of address auto-completion.
Be alert to phishing: if a message looks suspicious, do not open attachments or click links — report it immediately (see 2.9).
Do not auto-forward company email to external or personal addresses.

Use only Soon-approved tools for meetings and collaboration.
Restrict meeting access to invited participants (links, waiting rooms or passcodes where the tool supports them).
Announce before recording a meeting; protect recordings according to the classification of what was discussed, and keep personal data out of recordings intended for publication.
When screen sharing, close or hide anything not intended for the audience (email, chats, credentials, customer data). Take the same care with cameras when discussing sensitive matters in shared or public spaces.

Only people authorised as part of their role may post from Soon's corporate accounts or speak publicly for Soon.
Never share customer information, personal data or other non-public company information on social media.
On personal accounts, make clear that opinions about Soon-related topics are your own; refer official queries to Soon's channels.
Keep personal and corporate accounts separate. Data protection and confidentiality obligations apply to personal posts too.

2.9 Reporting security incidents¶

If you spot or suspect a security incident, weakness, phishing attempt or lost device, report it immediately per the Information Security Incident Response Procedure — report via the Slack #Security channel (@-mention) or security@soon.works. (Formerly asked to confirm the channel, e.g. a dedicated Slack channel or email alias).

3. Roles & responsibilities¶

All employees and contractors — follow this policy and sign the acknowledgement at onboarding; report incidents and suspected phishing.
Managers — ensure their team members have read and acknowledged the policy and that access matches roles.
Policy owner (Olaf Jacobson, ISM) — maintains this policy, reviews it annually and answers questions about acceptable use.

Change log¶

Version	Date	Author	Comments
0.1	2023-12-11	Olaf Jacobson	First draft document
0.2	2026-07-18	Andrea Cardinali	Rewritten lean and Soon-specific (ISMS overhaul); absorbs Electronic Messaging Policy (ISMS-DOC-A05-10-3), Online Collaboration Policy (ISMS-DOC-A05-10-6) and Social Media Policy (ISMS-DOC-A05-1-1)