Skip to content

HR Security Policy

Purpose. People handle Soon's most sensitive assets: customer workforce data, production access, and source code. This policy sets the security requirements for the full employment lifecycle — before, during, and after — for Soon's small, fully remote team of employees and contractors. It also defines how security misconduct is reported and handled.

1. Scope

All Soon employees and contractors, from first contact as a candidate through termination and beyond (surviving confidentiality obligations). It covers screening, contractual security requirements, awareness, disciplinary handling, reporting of misconduct, and offboarding. Day-to-day system access rules live in the Access Control Policy; device rules live in the Mobile Device Policy.

2. Policy

2.1 Before employment — screening

Before granting any access, the hiring manager verifies for every new employee or contractor:

  1. Identity — government-issued ID checked (remote video check is acceptable for a remote team).
  2. References or verifiable track record — at least one professional reference, or verifiable work history (prior clients, public track record) for contractors.
  3. Qualifications — claimed degrees or certifications verified only where they are relevant to the role.

That is the whole check. A.6.1 requires screening proportionate to the business requirements, the classification of the information accessed, and the perceived risks — proportionality is part of the control, not an exception to it. At Soon's current size (four founder-shareholders and one external consultant, all known to each other personally and for years before Soon existed) the list above is what proportionate means. We do not run criminal-record checks (VOG or local equivalent), drug tests, driving-record checks or credit checks, and we do not intend to at this size. The trigger for revisiting that is in §2.6.

Founders were not screened on joining — they founded the company. That is recorded as such rather than back-filled with a checklist written after the fact. Screening applies from the first non-founder hire onwards.

The completed check is recorded on the Employee Screening Checklist and retained in the personnel file. No production or customer-data access is granted before screening is complete.

2.2 During employment

Contracts. Every employment contract and contractor agreement includes: a confidentiality/NDA clause covering Soon and customer information (surviving termination), a commitment to comply with Soon's information security policies (including the Acceptable Use Policy), and clarity on ownership of work product and IP. See Guidelines for Inclusion in Employment Contracts and the Non-Disclosure Agreement form.

Awareness. Everyone completes security awareness training at onboarding and at least annually thereafter, covering phishing, credential hygiene (MFA, SSO, password manager), data handling, and how to report security events. Delivery (confirmed 2026-08-13): the /isms:onboard command in this repository walks each person through ESSENTIALS.md and appends a completion row to the Training & Awareness Log via pull request, so the git history is the evidence. Quarterly for everyone, plus on joining. No external platform.

Role changes. When someone changes role, access is adjusted to the new role (added and removed) per the Access Control Policy, and continuing confidentiality obligations are restated.

2.3 Disciplinary process

Suspected breaches of security policy are handled through one compact process:

  1. Investigate. The person's manager (or Olaf Jacobson if the manager is involved) establishes the facts before any action. The person is heard.
  2. Respond proportionately. Outcomes range from feedback and refresher training (good-faith mistakes) to formal warning or termination (deliberate or repeated violations, e.g. sharing credentials, exfiltrating customer data). Honest mistakes that are self-reported promptly are treated as learning events, not misconduct.
  3. Document. The finding and outcome are recorded in the personnel file; any related security incident is handled under incident management.

All action complies with the applicable employment contract and labour law. TODO(owner): confirm which labour law applies to each employee/contractor (Dutch law expected for NL-based staff — verify, including for foreign contractors).

2.4 Reporting concerns (whistleblowing)

Anyone who suspects misconduct — fraud, deliberate policy violation, misuse of customer data, or pressure to act insecurely — reports it to Olaf Jacobson. Where the concern involves Olaf, it goes instead to Thomas Picauly, who handles it with the other founders and without Olaf's involvement. Thomas is named rather than Melvin Jacobson because Melvin and Olaf are family; for a concern involving Andrea Cardinali or CyberSquad, Alessandro Cardinali steps back for the same reason (see Roles & Responsibilities §1.7).

  • Reports are treated confidentially; the reporter's identity is shared only with those strictly needed to investigate.
  • No retaliation. Good-faith reporting never results in negative consequences for the reporter, even if the concern proves unfounded.
  • Every report is acknowledged, investigated, and the reporter informed of the outcome where legally possible.

There is no anonymous hotline and no external ombudsman. With five people a formal channel would be anonymous in name only, and the EU Whistleblower Directive as implemented in the Wet bescherming klokkenluiders obliges internal reporting channels from 50 workers. The trigger for building one is in §2.6.

Ordinary security events (phishing, lost device, suspected compromise) go through the Information Security Event Reporting Procedure.

2.6 What we do not do yet — and when we will

These are deliberate decisions for Soon's current size, reviewed annually with this policy and at each trigger below. They are recorded here so that the absence is a documented judgement rather than an oversight.

We do not Trigger to introduce it Then
Criminal-record checks (VOG or equivalent) First hire with standing production access to customer personal data who is not a founder, or headcount reaches 15 VOG requested pre-start for that role and every later one like it; §2.1 gains it as a fourth check
Formal/anonymous whistleblowing channel Headcount reaches 50 workers (Wet bescherming klokkenluiders), or the first hire outside the founder group who does not report to a founder Internal reporting procedure meeting Wbk, with a route that bypasses all founders
Independent HR function for disciplinary cases First employee with no founder relationship in their reporting line External HR advisor retained for investigation and outcome review
Structured performance/competence reviews Headcount reaches 10 Documented cycle feeding the competence records under ISMS-DOC-07-1

Whoever is Information Security Manager checks these triggers at the annual review of this policy and records the outcome — "checked, none triggered" is itself the evidence.

2.5 Termination

On the last working day (or immediately on summary termination):

  1. Access revoked same day — SSO/IdP account disabled first, then all remaining accounts (AWS, GitHub, Stripe, Intercom, Sentry, PostHog, Netlify, etc.) per the Access Control Policy; shared secrets the person had access to are rotated.
  2. Assets returned — company devices and any credentials/tokens are returned or verifiably wiped, per the Mobile Device Policy.
  3. Obligations restated — the person is reminded in writing that confidentiality/NDA obligations survive termination.

Completion is recorded on the Termination and Change of Employment Checklist.

3. Roles & responsibilities

  • Hiring manager — runs screening before access is granted; leads disciplinary investigations for their reports.
  • Olaf Jacobson (management) — approves exceptions, receives whistleblowing reports, owns disciplinary decisions and termination sign-off; checks the §2.6 triggers at each annual review.
  • Thomas Picauly — receives and handles reports that concern Olaf (§2.4).
  • Security responsible — executes access revocation and secret rotation at termination; keeps this policy current.
  • Everyone — completes training, complies with policies, reports concerns.

Change log

Version Date Author Comments
0.1 2023-12-11 Alessandro Cardinali First draft document HR Security Policy
0.2 2026-07-18 Andrea Cardinali Rewritten lean and Soon-specific (ISMS overhaul). Absorbs Employee Screening Procedure, Employee Disciplinary Process, and Whistleblowing Policy.
0.3 2026-09-04 Olaf Jacobson Screening reduced to what Soon actually does and the proportionality rationale stated (no VOG at current size); whistleblowing route to Olaf with Thomas Picauly named as the alternate, no anonymous channel below the Wbk 50-worker threshold; new §2.6 recording these decisions with the triggers that reverse them. Approved by Olaf Jacobson 2026-09-04.