Human Resource Security Policy

Last updated: October 22, 2026

Everyone with access to company systems is bound by confidentiality, trained in security, and has access removed promptly when they leave; people with access to production systems or Customer Data are also screened.

Scope

All employees, contractors and interns.

Before hiring

1. Roles have written job descriptions including security duties.
2. People who will have access to production systems or Customer Data have a background check before they get that access: reference checks and identity verification, and a criminal record certificate (straffeattest) only where justified by the role and with the candidate’s consent. Checks are proportionate and lawful under GDPR and Danish law.
3. Employment contracts and contractor agreements include confidentiality obligations that continue after the relationship ends.

During employment

4. New personnel complete security awareness training and acknowledge the Information Security Policy, Acceptable Use Policy, Code of Conduct and this policy within 30 days of starting, and again every year.
5. Breaches of policy are handled through a fair disciplinary process in line with Danish employment law.

Onboarding and offboarding

6. Onboarding and offboarding follow a written checklist covering accounts, devices, laptop security settings and training.
7. On departure, access to all systems is removed in a timely manner, devices are returned, and shared secrets the person knew are rotated.

Evidence

Signed contracts, training completion records, policy acknowledgments, background check confirmations and completed onboarding/offboarding checklists are kept for the period of employment and afterwards only as long as needed, subject to GDPR minimization.