Acceptable Use Policy for Personnel

1. Accounts and passwords

• Use only your own accounts. Never share passwords or MFA codes, and never let anyone else work under your login.
• Use the approved password manager and enable MFA wherever available.

2. Devices

• Use only firm-approved devices for client work, kept updated and protected, with automatic screen lock.
• Do not install unapproved software, browser extensions or file-sharing tools.
• Report lost or stolen devices immediately.

3. Client information

• Access only the clients you are assigned to.
• Store client data only in approved locations; never on personal devices, personal email, personal messaging apps, USB drives or public links.
• Do not take photographs or screenshots of client information except as part of approved work.
• Do not enter client information into public AI tools, online converters or any external service that is not approved for the engagement.

4. Email and communication

• Use firm email for firm business only; check recipients carefully before sending.
• Be alert to phishing; never open unexpected attachments or links, and report suspicious messages.

5. Internet and social media

• Never mention clients, their matters or their data on social media or public forums.

6. Monitoring

Use of firm systems may be logged and reviewed to protect client information, in line with applicable law.

7. Breach

Breach of this policy may result in disciplinary action, including termination, and may be reported to authorities where the law requires.