Skip to content

The essentials

Everything in our security policies that actually applies to you, day to day. Five minutes. The long versions live in the document register — this page never contradicts them, it just skips the ceremony.

Your quarterly refresher: open the repo in Claude Code and run /isms:onboard. It walks you through this page and logs your training automatically. See Get set up.

The twelve rules

  1. Protect your login. Unique passwords, minimum 12 characters, MFA on everything that supports it — no exceptions for production. (Access control)

  2. SSO first. Sign in with SSO wherever it's offered. Separate local logins are only OK for accounts that touch nothing sensitive.

  3. Secrets never leave the secret manager. No API keys, passwords or tokens in code, chat, docs, or config files — ever. If you spot one, report it and rotate it. (Cryptography)

  4. Your laptop is the office. Disk encryption on, screen lock on, OS updated. It's where customer data lives, so treat it that way. (Remote working · BYOD)

  5. See something, say something — immediately. Phishing, a lost device, a weird login, a scammer abusing a feature. Fast beats perfect; reporting is never punished. Slack first (@-mention #Security, #DevOps, #Development or #General — whichever fits, or #General if unsure), email second (security@soon.works, for the paper trail). (Event reporting)

  6. AI tools: paid plan, training off, read-only, least data. Claude, ChatGPT/Codex, Cursor and Gemini are approved on paid plans, with connectors to GitHub, Gmail, Drive, Intercom, Stripe, the Soon app and read-only production. Keep training off (on Codex, "Include environments" too), never press the feedback buttons, pull only what the task needs (no bulk exports of customer data), and let a person, not the agent, change production or billing. Never for customers flagged restrictedExternalProcessors (GXO): their contract forbids it. Never paste secrets. Checked every quarter. (Acceptable use §2.6 · Privacy & data protection)

  7. Least privilege. Ask for the access you need, hand back what you don't. Production access is personal, MFA-protected, and reviewed quarterly.

  8. Everything ships through a PR. Code and policies alike — review is our change control. Nobody pushes to main. (Change management)

  9. Install software deliberately. On a machine that touches production or customer data, install from the vendor or an app store — never from a search result or a link someone sent you. Ask Thomas first for anything that (a) needs admin rights or a system extension, (b) can read your screen, keystrokes or clipboard, or (c) signs into a work account. That covers most browser extensions, meeting recorders and clipboard managers. Keep work in its own browser profile: an extension can read every site that profile is signed into. What is already installed is reviewed at the quarterly device check. (Software policy · Device Security Standard)

  10. Someone leaving, or a device lost? Access gets revoked the same day — tell Thomas immediately, then sort the rest.

  11. Working in public? Lock before you walk. Mind shoulder-surfing on trains, cafés, planes. (Clear desk & screen)

  12. A rule doesn't fit reality? Say so. Don't quietly ignore it — raising it is how the system improves, and it's never a problem to flag one.

When something goes wrong

  1. Tell someone now — Slack (@-mention #Security or #General) and security@soon.works. Don't sit on it.
  2. Olaf coordinates, Thomas handles the technical side.
  3. If customer data may be involved, we notify affected customers without delay — that's why your speed matters.

Who does what
Olaf Security lead (ISM), privacy, audits — first stop for questions
Thomas Tech & infrastructure security, access requests
Andrea (CyberSquad) External consultant, runs our internal audit

Last distilled from the full policy set: 2026-07-02. If this page and a policy ever disagree, the policy wins — and please flag it (rule 12).