Skip to content

HR Security Policy

Purpose. People handle Soon's most sensitive assets: customer workforce data, production access, and source code. This policy sets the security requirements for the full employment lifecycle — before, during, and after — for Soon's small, fully remote team of employees and contractors. It also defines how security misconduct is reported and handled.

1. Scope

All Soon employees and contractors, from first contact as a candidate through termination and beyond (surviving confidentiality obligations). It covers screening, contractual security requirements, awareness, disciplinary handling, reporting of misconduct, and offboarding. Day-to-day system access rules live in the Access Control Policy; device rules live in the Mobile Device Policy.

2. Policy

2.1 Before employment — screening

Before granting any access, the hiring manager verifies for every new employee or contractor:

  1. Identity — government-issued ID checked (remote video check is acceptable for a remote team).
  2. References — at least one professional reference, or verifiable work history (e.g. prior clients, public track record) for contractors.
  3. Qualifications — claimed degrees or certifications verified where they are relevant to the role.
  4. Criminal-record check (VOG or local equivalent) — only where proportionate to the role, e.g. roles with production access to customer personal data or financial systems. TODO(owner): confirm current practice — are VOG checks requested today, and for which roles?

Screening is proportionate: we do not run drug tests, driving-record checks, or credit checks. The completed check is recorded on the Employee Screening Checklist and retained in the personnel file. No production or customer-data access is granted before screening is complete.

2.2 During employment

Contracts. Every employment contract and contractor agreement includes: a confidentiality/NDA clause covering Soon and customer information (surviving termination), a commitment to comply with Soon's information security policies (including the Acceptable Use Policy), and clarity on ownership of work product and IP. See Guidelines for Inclusion in Employment Contracts and the Non-Disclosure Agreement form.

Awareness. Everyone completes security awareness training at onboarding and at least annually thereafter, covering phishing, credential hygiene (MFA, SSO, password manager), data handling, and how to report security events. Delivery (confirmed 2026-08-13): the /isms:onboard command in this repository walks each person through ESSENTIALS.md and appends a completion row to the Training & Awareness Log via pull request, so the git history is the evidence. Quarterly for everyone, plus on joining. No external platform.

Role changes. When someone changes role, access is adjusted to the new role (added and removed) per the Access Control Policy, and continuing confidentiality obligations are restated.

2.3 Disciplinary process

Suspected breaches of security policy are handled through one compact process:

  1. Investigate. The person's manager (or Olaf Jacobson if the manager is involved) establishes the facts before any action. The person is heard.
  2. Respond proportionately. Outcomes range from feedback and refresher training (good-faith mistakes) to formal warning or termination (deliberate or repeated violations, e.g. sharing credentials, exfiltrating customer data). Honest mistakes that are self-reported promptly are treated as learning events, not misconduct.
  3. Document. The finding and outcome are recorded in the personnel file; any related security incident is handled under incident management.

All action complies with the applicable employment contract and labour law. TODO(owner): confirm which labour law applies to each employee/contractor (Dutch law expected for NL-based staff — verify, including for foreign contractors).

2.4 Reporting concerns (whistleblowing)

Anyone who suspects misconduct — fraud, deliberate policy violation, misuse of customer data, or pressure to act insecurely — can report it confidentially to Olaf Jacobson, or, where the concern involves him, to TODO(owner): designate an alternative confidential channel (e.g. external advisor or board contact).

  • Reports are treated confidentially; the reporter's identity is shared only with those strictly needed to investigate.
  • No retaliation. Good-faith reporting never results in negative consequences for the reporter, even if the concern proves unfounded.
  • Every report is acknowledged, investigated, and the reporter informed of the outcome where legally possible.

Ordinary security events (phishing, lost device, suspected compromise) go through the Information Security Event Reporting Procedure.

2.5 Termination

On the last working day (or immediately on summary termination):

  1. Access revoked same day — SSO/IdP account disabled first, then all remaining accounts (AWS, GitHub, Stripe, Intercom, Sentry, PostHog, Netlify, etc.) per the Access Control Policy; shared secrets the person had access to are rotated.
  2. Assets returned — company devices and any credentials/tokens are returned or verifiably wiped, per the Mobile Device Policy.
  3. Obligations restated — the person is reminded in writing that confidentiality/NDA obligations survive termination.

Completion is recorded on the Termination and Change of Employment Checklist.

3. Roles & responsibilities

  • Hiring manager — runs screening before access is granted; leads disciplinary investigations for their reports.
  • Olaf Jacobson (management) — approves exceptions, receives whistleblowing reports, owns disciplinary decisions and termination sign-off.
  • Security responsible — executes access revocation and secret rotation at termination; keeps this policy current.
  • Everyone — completes training, complies with policies, reports concerns.

Change log

Version Date Author Comments
0.1 2023-12-11 Alessandro Cardinali First draft document HR Security Policy
0.2 2026-07-18 Andrea Cardinali Rewritten lean and Soon-specific (ISMS overhaul). Absorbs Employee Screening Procedure, Employee Disciplinary Process, and Whistleblowing Policy.