Software Policy¶

Purpose. Control what software runs on Soon devices and which SaaS tools handle Soon data, so we stay licensed, secure, and aware of where our data is.

1. Scope¶

All software installed on devices used for Soon work, and all SaaS tools used to process Soon or customer data. Applies to all personnel. Product dependencies are governed by the Secure Development Policy.

2. Policy¶

2.1 Approved software only¶

Only approved software may be installed on work devices. Standard tooling (browser, IDE, collaboration apps in Soon's stack) is pre-approved; anything else requires approval from the security responsible before installation.
Software must come from official sources (vendor site, OS app store) per the Endpoint Protection Policy.

2.2 SaaS adoption¶

Adopting a new SaaS tool — especially one that will hold Soon or customer data — requires prior approval under the Cloud Service Policy, including a quick check of the vendor's security posture and data location.
Customer data must not be put into unapproved SaaS tools (see the Data Handling & Deletion Policy).

2.3 Licensing¶

All software must be properly licensed; unlicensed or pirated software is prohibited. Licence obligations (including open-source licences in the product) follow the IP and Copyright Compliance Policy.

2.4 Inventory¶

Approved software and SaaS tools must be recorded in an inventory, reviewed at least annually to remove unused tools and licences. The software and SaaS inventory is maintained in the Information Asset Inventory, section D. (Formerly asked whether this is tracked in the asset inventory or a separate list)?

3. Roles & responsibilities¶

All personnel: install only approved software; request approval for new tools.
Security responsible: approves software and SaaS requests, maintains the inventory, runs the annual review.

Change log¶

Version	Date	Author	Comments
0.1	2023-10-23	Olaf Jacobson	First draft document
0.2	2026-07-18	Andrea Cardinali	Rewritten lean and Soon-specific (ISMS overhaul)