Acceptable Use Policy

1. Purpose

This policy sets out what is and is not acceptable when using Lever AI's devices, accounts, and services, and when handling the information — above all customer data — that the company is trusted with. It exists so that every person working for or with Lever AI knows the rules before they touch a company system, and so that the company can state those rules plainly to its customers.

2. Scope

This policy applies to all Lever AI personnel and to any contractor or third party acting on the company's behalf. It covers every device used for company work, every company account and credential, every company or company-approved service, and all company and customer information handled through them, wherever the work is done. Acceptance of this policy is a condition of being granted access to company systems.

3. Policy

3.1 Accounts and credentials

Accounts are individual. Each person uses their own identity on every system; sharing an account or a credential with anyone, inside or outside the company, is prohibited. The only exception is sealed break-glass credentials, which are governed by the Password Policy. Passwords, passphrases, multi-factor authentication, and the required use of a password manager are governed by the Password Policy; who may hold what access is governed by the Access Control Policy. Credentials — including customer tenant credentials, API tokens, and keys — are never written into source control, chat messages, tickets, documents, or logs.

3.2 Devices

Company work is done on devices meeting the device requirements of the Physical Security Policy. Corporate laptops and desktops, and permitted personal (BYOD) laptops, are enrolled in the company's mobile device management (MDM) system, which enforces automatic screen locking, operating-system patch compliance, and the presence of an antimalware/EDR agent. A device must be enrolled in the MDM before it is granted access to production systems, cloud environments, or service credentials. A personal (BYOD) laptop may be used for company work only if it is enrolled in the MDM and meets the same security baseline as a corporate device. Every device used for work must be full-disk encrypted; central attestation of encryption through the MDM is a roadmap control, and until it is in place compliance is affirmed at the quarterly access review.

Devices used for work are kept up to date with operating-system and browser security updates, and their built-in security features are not disabled, bypassed, or weakened. Devices with removed or circumvented platform protections (for example, jailbroken or rooted devices) are not used for company work. Mobile phones must not be used to access production systems or service credentials; any mobile device used for work communications must have a passcode set and automatic locking enabled. Loss or theft of a device used for work is reported under the Physical Security Policy so that credentials can be rotated.

3.3 Approved services and customer data handling

Customer data is Restricted by default under the Data Classification Policy and is handled only in the systems the company has approved for it: the production service and its Azure data stores, and the company's private source-control repositories for code (which must contain no customer data). In particular:

• Customer data is processed only for the purpose of delivering the engagement, never for anything else.
• Customer data is not placed on personal accounts, personal email, personal cloud storage, or any service the company has not approved for it; it is not stored on removable media, per the Physical Security Policy.
• Customer requirement documents, transcripts, and platform data are not copied out of the approved systems except as the engagement requires, and local working copies are deleted when no longer needed, in line with the Data Retention and Disposal Policy.
• A customer's or platform vendor's proprietary systems and source code are accessed only as authorised for the engagement and are never committed to Lever AI repositories.
• Before any new service or tool is given access to customer data, it must be assessed and approved under the Vendor and Third-Party Risk Management Policy.

3.4 Use of AI tools

The company's own service sends customer data to its contracted AI provider as part of delivering the engagement; that pathway, and the safeguards around it, are governed by the AI Governance Policy. Outside that pathway, customer data and company secrets are not entered into any AI tool or assistant — including personal accounts on AI services — unless the tool has been approved for that data under the Vendor and Third-Party Risk Management Policy. Use of AI tools to write code is permitted; the output is held to the same review and testing bar as human-written code, as set out in the Secure Development (SDLC) Policy.

3.5 Prohibited use

The following are prohibited on company devices, accounts, and services:

• Any unlawful activity, or the creation, storage, or transmission of material that is fraudulent, defamatory, harassing, or discriminatory.
• Attempting to access systems, data, accounts, or customer tenants beyond one's authorisation, or probing or testing another party's systems without written permission.
• Disabling, bypassing, or interfering with security controls, logging, or monitoring — including the deploy gate and write-safety guards of the production service — outside the documented and recorded override procedures.
• Installing or using unlicensed or pirated software, or software from untrusted sources.
• Using company systems for personal commercial gain, cryptocurrency mining, or resource abuse.
• Sharing, selling, or disclosing company or customer information to anyone not authorised to receive it.

3.6 Personal use

Reasonable incidental personal use of a work device is permitted, provided it does not interfere with work, introduce risk, or breach any rule in this policy. Personal accounts and personal data are kept separate from company data: company and customer information is never moved into personal accounts, and personal use of company services is kept to a minimum. Personal use of a system that the company logs does not narrow the monitoring described in section 3.7.

3.7 Monitoring notice

Company systems and services are logged and monitored for security and operational purposes, as described in the Logging and Monitoring Policy: this includes application logs, per-interaction usage telemetry, agent session transcripts, deployment records, and cloud-provider platform logs. By using company systems, personnel acknowledge that activity on them may be recorded and reviewed. Monitoring is proportionate, is limited to company systems and services, and is carried out in accordance with applicable law; the company does not monitor personal devices or personal accounts.

3.8 Reporting

Anyone who becomes aware of a breach of this policy, a lost credential, or anything that looks like a security problem reports it without delay under the Incident Response and Business Continuity Policy. Reporting is expected and blame-free; concealing a mistake is treated more seriously than the mistake itself.

4. Responsibilities

The Security Owner maintains this policy, answers questions about what is acceptable, and decides borderline cases. Every member of staff, and every contractor acting for the company, is responsible for reading, accepting, and following this policy. Acceptance is recorded at joining as part of the joiner process in the Personnel Security Policy, and the policy is covered in the training required by the Security Awareness and Training Policy. Breaches are handled under the disciplinary process in the Personnel Security Policy.

5. Exceptions

Any exception to this policy must be requested in writing, assessed for risk, approved by the Founder, recorded, and limited in time. Expired exceptions lapse unless explicitly renewed.

6. Review

This policy is reviewed at least annually and whenever there is a significant change to the business, the systems in use, or the threat environment. The document owner maintains its version history.