Acceptable use
Last reviewed 2026-05-06
<p>All employees, contractors, interns, and volunteers with approved HiringCoachAI access acknowledge this policy or an access-scoped confidentiality equivalent before access is granted. For limited internal-document volunteers, the Security Officer may use a short confidentiality / acceptable-use acknowledgment instead of the full personnel onboarding packet.</p>
<h2>You will</h2>
<ul><li>Use HiringCoachAI systems only for legitimate business purposes.</li><li>Protect customer data like it's your own: treat every user's resume, job application, and contact list as confidential.</li><li>Use MFA on every work account (Vercel, Firebase, GCP, Stripe, SendGrid, Sentry, GitHub, email, domain).</li><li>Keep your work device's full-disk encryption on (FileVault / BitLocker) and its screen locked when away (≤10 min timeout).</li><li>Keep your OS and browser patched (current LTS).</li><li>Report suspected security incidents immediately to the Security Officer: even if you're not sure.</li><li>Use a reputable password manager (1Password, Bitwarden, etc.).</li><li>Mark PRs touching security-sensitive code for Security Officer review.</li></ul>
<h2>You will not</h2>
<ul><li>Share credentials, including via Slack, email, or screenshot.</li><li>Copy production data to personal devices, personal cloud accounts, or non-approved tools.</li><li>Disable required security tooling (endpoint protection, MFA) without approval by the Security Officer.</li><li>Install unapproved software on work devices. Preferred tools are listed internally; request additions.</li><li>Connect work accounts to personal browser profiles.</li><li>Use AI tools with production customer data unless the tool is an approved processor (see the <a href="/trust/docs/sub-processors">sub-processors</a>).</li><li>Commit secrets, API keys, service-account files, environment files, or customer data to git.</li><li>Bypass rate limiting or Firestore Security Rules "just to get something working."</li><li>Post production screenshots containing PII to public channels.</li></ul>
<h2>Communications</h2>
<ul><li>Use work email for HiringCoachAI business.</li><li>Customer support communications go through approved channels (SendGrid-sent emails, in-app).</li><li>Public disclosures about the product require executive approval.</li></ul>
<h2>Device hygiene</h2>
<ul><li>Work device is encrypted, password-protected, auto-locks after 10 min.</li><li>OS and browser up to date.</li><li>No unknown USB drives.</li><li>Screen privacy filter recommended when working in public spaces.</li></ul>
<h2>Personal use</h2>
<p>Limited personal use of work accounts is permitted if it does not (a) violate this policy, (b) interfere with work, (c) involve illegal activity, or (d) expose production data.</p>
<h2>Offboarding</h2>
<p>On leaving HiringCoachAI you will:</p>
<ul><li>Return or destroy any work-device data under the Security Officer's direction</li><li>Sign off work accounts and surrender access tokens</li><li>Not retain any customer data, source code, or credentials</li></ul>
<h2>Enforcement</h2>
<p>Violations are investigated by the Security Officer. Consequences may include access revocation, employment action, or legal referral depending on severity.</p>
<h2>Acknowledgment</h2>
<p>> I have read and agree to abide by this Acceptable Use Policy. > > Acknowledged by authenticated checkbox in the admin onboarding portal.</p>
<p>Signed acknowledgments are recorded through <code>/admin/onboarding</code> in Firestore <code>complianceTrainingLog</code>, with latest rollups under <code>users/{uid}/complianceAcknowledgments/{documentId}</code>.</p>