1. Acceptable use
People working for SemantiqWall must:
- use company systems and customer data only for their job, and access customer data only when needed to operate, support or secure the service;
- never copy customer data to personal accounts, personal cloud storage, AI tools or removable media;
- never share credentials, disable MFA or security controls, or install unapproved remote-access software;
- keep secrets out of chat, e-mail, tickets and code;
- report lost devices, suspicious messages and possible incidents immediately (policy 05);
- when using AI coding or writing assistants, never paste secrets or production customer data into them; treat their output as untrusted and review it before use.
Unattended screens are locked; customer data is not left visible or printed. Work in public places uses a privacy screen or position that prevents shoulder surfing, and only trusted networks or a VPN for administration.
2. Approved services
Work is done only with: the private GitHub repository, the Hostinger panel and SSH to the production server, Resend, the GoDaddy Titan mailbox, the domain registrar, the approved AI provider (policy 09), a password manager and standard office tools. Applications are installed only from the operating system's official store (Microsoft Store, Google Play) or the vendor's official website. Adding a service that will hold company or customer data follows policy 09.
3. Endpoint inventory
The security register keeps the list of devices that can reach production or customer data: today the Founder's computer and mobile phone. Each entry records owner, model, operating system and the date the settings below were last checked.
4. Required endpoint settings
| Requirement | Status (checked 2026-09-28) |
|---|---|
| Full-disk encryption (BitLocker, FileVault or equivalent) | Phone: in place (Android encryption, active with the screen lock). Computer: in place since 2026-09-28 (BitLocker XTS-AES 128, 100% encrypted, protection on; TPM plus a recovery key kept offline by the Founder) |
| Automatic screen lock after 5 minutes or less, with password, PIN or biometrics | Phone: in place. Computer: Windows password created 2026-09-28 (there was none before) and lock after 5 minutes with password configured; first test after the next restart |
| Operating system and browser on automatic updates; supported OS version only | Computer: in place (Windows 11, updates installed through 2026-09-16). Phone: in place (Android 16 / HyperOS, security patch 2026-08-01, no update pending when checked on 2026-09-28) |
| Built-in anti-malware on (e.g. Microsoft Defender) | Computer: in place (Microsoft Defender, real-time protection on, signatures updated 2026-09-27) |
| OS firewall on | Computer: in place (Windows firewall on for all three profiles) |
| Password manager for all company accounts | In place: Google Password Manager (Chrome); MFA on the Google account is checked with the other accounts (policy 01) |
| SSH private keys protected by a passphrase or hardware key | In place for the only key authorized on the production server (passphrase set 2026-09-28, loaded through the Windows SSH agent). Other keys on the computer belong to other projects and are not authorized on the server (checked against authorized_keys) |
| Remote locate and remote wipe enabled (computer and phone) | Phone: in place (Google Find My Device). Computer: not available with a local Windows account; compensated by disk encryption and the Windows password |
| No local copies of production database dumps or customer data, except temporarily during an incident, then deleted | Required |
The evidence (command output) is recorded in the register. Both devices were checked against this list on 2026-09-28 (disk encryption protection on the computer and the phone's update status included). Re-check every quarter and whenever a device is replaced.
Operating-system changes on endpoints happen through the vendor's automatic updates; a new device is set up to this checklist before it gets any company access. Data loss prevention (DLP) software is not used; the risk is managed by keeping customer data on the server and out of endpoints.
5. Lost or stolen devices
Report immediately; remotely lock and wipe; revoke the device's SSH keys and sessions; change passwords stored on it if the password manager was unlocked; record as an incident (policy 05).
6. Device disposal
Before a device is sold, recycled or returned, it is wiped with the operating system's secure reset (with disk encryption on, this destroys the key). Recorded in the register.
7. Personnel (mandatory from the first hire or contractor)
Today SemantiqWall has no employees or contractors with access to systems or data. Before the first person gets access:
- Screening: identity and reference checks, and a background check where lawful in the person's country, proportionate to the access.
- Agreements: a signed confidentiality agreement (NDA) and acceptance of this policy pack, as part of the contract.
- Onboarding: security and privacy training in the first week (this pack, phishing, incident reporting, LGPD basics); access granted per policy 01, at the lowest role.
- Ongoing: annual refresher training and re-acknowledgement of the policies; role-based training for anyone with production access.
- Roles: each person's security responsibilities are written in their role description.
- Changes and exit: access adjusted on role change; removed no later than the last working day; company devices and data returned; confidentiality duties continue after exit.
- Disciplinary process: breaches of these policies are handled under the employment or service contract, proportionate to the harm.
- Company-owned devices for staff are the default; personal devices need an exception (policy 00) and must meet section 4.
8. Third-party access
No supplier or third party has access to company endpoints. If that changes, the access is time-limited, supervised and recorded in the register.