All team members, referred to as the supplier in this document, agree to adhere to these guidelines as part of their employment or service contract. This policy sets the standards for maintaining the security and confidentiality of our data. By following these best practices and any additional guidelines provided, every team member ensures the protection of our data.

Team Member Locations

• Though we are a fully remote company with team members located all over the world, due to the nature of our work, we may not bring on team members in regions without internet freedom or with a global freedom status of partially free or not free. We base this criteria on Freedom House data as well as an internal evaluation of the risk level for that role; generally speaking, a region with a score of 50+ is acceptable. We deeply value transparency and your time, so this may be something for you to consider when applying depending on your region.

Use of secure networks

• Utilize secure, encrypted networks for accessing and transmitting any data.

⚠️ Example: Always connect to a secure network or use a VPN when working remotely to ensure all data transmissions are encrypted.

Device security

Ensure all devices used for work are protected by:

• Strong passwords stored securely in 1Password vaults
• Up-to-date antivirus software
• Firewalls

⚠️ Example: Store a complex password (e.g., a combination of upper- and lowercase letters, numbers, and symbols) in your laptop's 1Password vault and enable automatic software updates for your antivirus program.

Data encryption

• Employ encryption methods for storing and transmitting sensitive data.

<aside> 📩 Since 2010, HTTPS has been the default when you sign into Gmail. This means that your email travels between Google's data centers and the computer you use to read it, and it's encrypted and secure.

</aside>

Access control

• Limit access to data to authorized personnel only.
• Use multi-factor authentication where applicable.

⚠️ Example: Set up user accounts with specific permissions so that only authorized personnel can access sensitive project files.