Techly Acceptable Use Policy

Purpose

Most of what protects customers' data is built into Pyron. The rest depends on how the people at Techly Operations Pty Ltd (Techly) work. This policy sets the rules they follow.

Scope

Everyone who works for Techly and has access to its systems or to customer data, including directors and contractors (staff), on any device they use for Techly work.

Accounts and passwords

• Use your own named account on every system. Never share an account or a sign-in.
• Turn on two-step sign-in wherever a system offers it. Techly's Google Workspace and GitHub organisation require it.
• Use a password manager, and a different password for every account.
• Never write a credential into source code, a document, a ticket or a chat. Secrets belong in the secret stores Techly's systems use.

Devices

A device used for Techly work must:

• have its disk encrypted and a screen lock that engages within a few minutes;
• run a supported operating system with security updates installed promptly;
• not be shared with anyone outside Techly while it is signed in to a Techly system.

Techly does not yet manage devices centrally. Instead, each person confirms that their devices meet these rules when they join and at each annual review. A lost or stolen device is reported to the Technical Director at once, and handled as an incident.

Customer data

• Customer data is Restricted, and is handled as the Techly Data Classification Policy says: in Pyron and the production systems that serve it, and nowhere else.
• Look at a customer's data only to give the support the customer asked for, to investigate a fault or an incident, or to operate the service.
• Never use customer data in a demonstration or for personal use. Demonstrations run on made-up data.

Software and AI tools

• Install software for Techly work only from its official source.
• Use AI tools for Techly work only where Techly has approved them for that work, and follow the Data Classification Policy for what they may read.

Using Techly's systems

• Use Techly's systems for Techly's work.
• Never try to get around a security control, such as a required check, an alert or a permission, even to save time. If a control is in the way, raise it.
• Never test the security of a system Techly does not own without its owner's written permission.

Reporting

Report anything that might be a security incident to the Technical Director straight away: a suspicious message, a lost device, a mistake with customer data, or something that looks wrong. Reporting a mistake promptly is always the right thing to do (Techly Incident Management Policy).

Who is responsible

• Every member of staff follows this policy, and confirms each year that they do.
• The Technical Director owns it and answers questions about it.

Breaching this policy can lead to access being removed.

Review

The directors review this policy every year.