The Acceptable Use Policy defines how personnel may use company information, devices, accounts, and AI and SaaS tooling. It protects botBrains, our customers, and our personnel against misuse, malware, and unauthorized disclosure of information, and it sets the everyday behaviour expected of everyone who handles company assets.
botBrains is not yet ISO 27001 certified. We are preparing our ISMS and writing these policies as part of pursuing certification, and we fully intend to get our controls attested.
Scope
This policy applies to both botBrains team members and to any future employee, contractor, or third party who uses botBrains information, accounts, or devices. botBrains operates fully remote with no company office, so the rules below assume work from home, while travelling, and across cloud services rather than a managed office network.
Acceptable use
Unacceptable use
Personnel must not:
- Put customer conversation data or other customer personal data into any tool that isn’t a listed subprocessor, or put Confidential company information into a personal or unapproved account.
- Reuse company passwords elsewhere, share individual credentials, or store credentials outside the shared password manager.
- Install unlicensed or unvetted software, or disable security controls such as full-disk encryption, the firewall, or automatic updates.
- Store company confidential or customer data on personal cloud accounts, removable media, or unmanaged personal devices.
- Connect to untrusted public networks for sensitive work without the company WireGuard VPN.
- Use company assets for unlawful, harassing, or infringing activity.
botBrains builds AI agents, so personnel use AI tools every day. botBrains binds the product’s own model subprocessors to three enforced rules, namely EU data residency, EU inference residency, and no training on botBrains data, as the Technical and Organizational Measures describe. For general-purpose AI tools, the rule depends on the data and the account. In approved company-owned accounts (ChatGPT and Claude under @botbrains.io, with business no-training terms), personnel may use Internal and Confidential information, but never customer conversation data. In any unapproved or personal tool, treat anything you submit as if it were public, and never submit customer data, secrets, or Confidential information.
Device management
Laptops are full-disk-encrypted and kept current, but botBrains doesn’t yet run mobile device management (MDM), so remote wipe and centrally enforced device policies aren’t in place. Until botBrains adopts MDM, personnel are individually responsible for the device controls above. The Future Improvements roadmap tracks evaluating an MDM solution.
Because botBrains can’t yet centrally manage or remotely wipe mobile devices, personnel must not download or store customer data on any phone or tablet. Mobile access stays limited to email, Slack, and GitHub, each protected by MFA. Do all work that touches customer data on a managed, full-disk-encrypted laptop.
Monitoring
To protect company and customer information, botBrains may monitor security-relevant system and administrative activity, such as access logs and security telemetry, as the Logging and Monitoring Policy describes. That policy defines what botBrains actually logs and how long it keeps the records. This monitoring stays limited to security and operational purposes and doesn’t extend to the content of personal communications. By accepting this Acceptable Use Policy, personnel accept this monitoring.
Enforcement
Violations may lead to revoked access and disciplinary action under the Human Resource Security Policy. Exceptions require written approval from the CISO, who records them with an expiry date.
ISO 27001 mapping
This policy supports Annex A 5.10 (acceptable use of information and associated assets), 6.7 (remote working), and 8.1 (user endpoint devices).
Review
The CISO owns this policy and reviews it at least annually and after any material change. 
