Skip to content

The essentials

Everything in our security policies that actually applies to you, day to day. Five minutes. The long versions live in the document register — this page never contradicts them, it just skips the ceremony.

Your quarterly refresher: open the repo in Claude Code and run /isms:onboard. It walks you through this page and logs your training automatically. See Get set up.

The twelve rules

  1. Protect your login. Unique passwords, minimum 12 characters, MFA on everything that supports it — no exceptions for production. (Access control)

  2. SSO first. Sign in with SSO wherever it's offered. Separate local logins are only OK for accounts that touch nothing sensitive.

  3. Secrets never leave the secret manager. No API keys, passwords or tokens in code, chat, docs, or config files — ever. If you spot one, report it and rotate it. (Cryptography)

  4. Your laptop is the office. Disk encryption on, screen lock on, OS updated. It's where customer data lives, so treat it that way. (Remote working · BYOD)

  5. See something, say something — immediately. Phishing, a lost device, a weird login, a scammer abusing a feature. Fast beats perfect; reporting is never punished. Slack first (@-mention #Security, #DevOps, #Development or #General — whichever fits, or #General if unsure), email second (security@soon.works, for the paper trail). (Event reporting)

  6. Customer data stays in our systems, in the EU. Never paste it into personal accounts or consumer AI tools (ChatGPT, Gemini, etc.). Same for our source code. (Privacy & data protection)

  7. Least privilege. Ask for the access you need, hand back what you don't. Production access is personal, MFA-protected, and reviewed quarterly.

  8. Everything ships through a PR. Code and policies alike — review is our change control. Nobody pushes to main. (Change management)

  9. No random software on machines that touch production or customer data. That includes browser extensions. When in doubt, ask Thomas first. (Software policy)

  10. Someone leaving, or a device lost? Access gets revoked the same day — tell Thomas immediately, then sort the rest.

  11. Working in public? Lock before you walk. Mind shoulder-surfing on trains, cafés, planes. (Clear desk & screen)

  12. A rule doesn't fit reality? Say so. Don't quietly ignore it — raising it is how the system improves, and it's never a problem to flag one.

When something goes wrong

  1. Tell someone now — Slack (@-mention #Security or #General) and security@soon.works. Don't sit on it.
  2. Olaf coordinates, Thomas handles the technical side.
  3. If customer data may be involved, we notify affected customers without delay — that's why your speed matters.

Who does what
Olaf Security lead (ISM), privacy, audits — first stop for questions
Thomas Tech & infrastructure security, access requests
Andrea (CyberSquad) External consultant, runs our internal audit

Last distilled from the full policy set: 2026-07-02. If this page and a policy ever disagree, the policy wins — and please flag it (rule 12).