# Acceptable Use Policy

Last updated: October 22, 2026

Company devices, accounts and data are for company business, and every user must protect them as described below.

## Scope

All employees and contractors using company devices, accounts, SaaS tools or data, including personal devices used for work.

## Policy

1. **Devices.** Work is done on laptops configured with full-disk encryption, automatic OS updates, a screen lock after 5 minutes or less, a firewall and endpoint protection enabled. Users may not disable these controls. Twice a year, and when someone joins or gets a new laptop, every user provides evidence of these settings (for example, screenshots of the system settings), and the Security Officer reviews and records it. When Summerbase adopts a device management (MDM) tool, it will enforce and report these settings instead.
2. **Personal devices.** Phones may be used for email, chat and MFA only with a screen lock and current OS. Customer data must not be downloaded to personal devices.
3. **Accounts and passwords.** All work passwords must be stored in a password manager. Passwords are generated by the password manager, unique and never shared. MFA is required on every work account that supports it.
4. **Customer data.** Access customer data only when needed for a task, and never copy it to personal storage, personal email, unapproved AI tools or local disks unless approved.
5. **Software.** Install only software from trusted sources needed for work. Unapproved SaaS tools that would hold company or customer data need Security Officer approval (Third-Party Management Policy).
6. **AI tools.** Customer Data (excluding Aggregated Data, both as defined in the Terms) may only be entered into AI tools listed as sub-processors (Data Management Policy). Aggregated Data, created within Summerbase's own systems, Summerbase's source code and other company data may be used with AI tools approved by the Security Officer that do not train on our data.
7. **Network.** Avoid untrusted public Wi-Fi for production access unless using a VPN.
8. **Clear desk and screen.** Lock the screen when away; keep confidential material out of view in public places.
9. **Prohibited use.** No illegal activity, harassment, bypassing security controls, unlicensed software, or personal commercial activity on company systems.
10. **Monitoring.** The company may monitor company systems for security purposes, in line with GDPR and Danish employment law; employees are informed of what is monitored.
11. **Reporting.** Lost or stolen devices, phishing and suspected incidents are reported to security@summerbase.com at once.