IT Policy

This document serves as Gradient's comprehensive IT Policy, to be read and understood by all parties working with the Gradient team, either internally or externally.

This document covers all networks, servers, workstations and software used in the provision of service to Gradient and their clients.

As a fully-distributed ("remote") company, this document is created with the understanding that all Gradient workers will abide by this IT Policy at all times.

1. Set Standards: This document will outline the standards and controls relevant to multiple aspects of technology stacks used in the provision of services by Gradient.

2. Set Policy: This document will also detail the policies in place to handle logistical concepts, such as the classification, storage and flow of company data between departments and/or other organizations. Where a procedure or a standard does not apply, the overarching policy will be used to guide company actions.

Workers: Any individual working for Gradient that is either a 1) full-time W-4 employee or 2) a contractor who is contracted to work with Gradient in a "full-time" capacity.

Endpoint: A desktop computer or laptop used in connection with delivering a service to, or furthering the business interests of, Gradient.

Asset: All Gradient-purchased office or computer accessories (e.g. keyboards, headphones, desks, etc.).

Mobile Device: A mobile device that cannot be considered a laptop (e.g. mobile/cell phone, tablet).

AI: Artificial Intelligence. This could include Generative AI, a field of artificial intelligence that makes it possible to create new content from existing materials, or other forms of AI systems or tools.

Gradient is a global business with workers living and working all over the world. Therefore, endpoints are in constant use for company activities.

Gradient will provide an endpoint for use or provide a budget of up to $1,500 USD (not include the cost of assets) for purchase of an endpoint with a company credit card. All endpoint purchases must be approved by the Operations Team. Any endpoint provided by the company or purchased using Gradient funds is considered company-owned and is subject to this IT Policy and all other Gradient Policies.

Upon leaving or termination of position with Gradient, company-owned endpoints must be returned per the instructions provided by the Operations Team during the offboarding process. Endpoint return costs will be covered by Gradient. If the departing employee wishes to purchase the Gradient-owned endpoint, and it is agreed to by the Compliance Officer, the departing employee or contractor will be offered a fair market rate.

Gradient reserves the right to request return of company-owned assets. Asset return costs will be covered by Gradient.

No Gradient worker is permitted to use a personal endpoint.

This policy is also in conjunction with the Data Protection section contained within this document.

The purpose of this Policy is to outline the acceptable use of Gradient information and endpoints in order to protect both workers and Gradient. Inappropriate use of assets could expose Gradient to risks including virus attacks, compromise of network systems and services, and wider legal or regulatory issues.

All information system users must lock access to their endpoint by logging off when it is not being used, or using a password protected screensaver or other suitable strong biometric authorization mechanism.

All workers must keep all Gradient-owned equipment and data secure when it is not in use. The physical security of your endpoint is your personal responsibility.

All users of the information systems must save their work regularly to prevent corruption or loss through system or power malfunction.

Family and friends are not permitted to use Gradient endpoints.

Personal mobile devices that access any Gradient systems must be secure with a passcode or other phone access security measures (face ID, fingerprint).

Workers' access on their personal mobile devices (including mobile phones and tablets) is limited to the following:

• Company email inbox

• Company calendar(s)

• Company communications tools, e.g., Slack

• Company project management platform, only for time sensitive work

• Authenticator apps

Workers are NOT permitted to:

• Download any documentation from email inboxes or other company communication tools, unless expressly permitted in writing by the Compliance Officer

• Access AWS

• Access any other platforms/systems not listed above

When possible, it is best to avoid access to Google Drive or other platforms containing proprietary information, unless there is a business requirement.

Workers are not permitted to access mailboxes other than their own or company emails (e.g. billing, marketing, or operations emails which are accessible by multiple workers to perform their work duties), without specific approval from the owner of the mailbox, or the Compliance Officer.

When a worker leaves Gradient (see Joiner and Leaver Policy), the Operations Team must ensure that an appropriate Out of Office message is set on the leaver's email mailbox. The Out of Office message must give an alternative name and email address, and must be tested by the Operations Team.

When a worker leaves Gradient, their mailbox is automatically archived, and the mailbox hidden for a period of 90 days, at which point it is deleted. Access to this hidden mailbox may be granted at the discretion of the Compliance Officer.

Workers are discouraged from accessing, sending, or receiving personal email on company-owned endpoints. Personal email accessed on company-owned endpoints are subject to the following policy:

Users must:

• Change their password if it is disclosed to another party, or if it is suspected someone else knows it;

• Report the receipt of emails containing racial, sexual, religious or otherwise offensive remarks or media immediately to the Operations Team and Compliance Officer who will treat this as an incident;

• Remember that emails which refer to any client must be written in terms which would be acceptable for the client to see;

• Take care to only send emails to people who need to see it;

• Be careful when sending mass mailings and / or large messages / attachments to avoid potential network utilization problems;

• Confirm in writing to the Compliance Officer who, if anyone, can access their email accounts in their absence.

Users must not:

• Send unencrypted sensitive and / or confidential email, which includes, but is not limited to, payment card data, financial information and personal or sensitive information;

• Send work related email to personal email addresses, unless this is part of a business requirement;

• Auto-forward email to external addresses;

• Share their password with anyone;

• Open email or attachments if the source is unknown;

• Send emails containing racial, sexual, religious, or otherwise offensive remarks or media;

• Create or forward chain or joke letters;

• Use their Gradient email account to post messages on non-business related discussion forums or subscribe to non-business related mailing lists;

• Send emails which contain material which is incriminating, including in relation to admissions of fault or liability, unless expressly authorized by a Compliance Officer and/or Operations Team for the purposes of formal communication to a concerned party;

• Reply to SPAM email or click on web links contained in unsolicited email;

• Use the email account to run or engage in any form of personal or private business for hire or reward;

• Use email excessively for personal use. Reasonable but limited personal use of email may be possible with the prior agreement of the Compliance Officer.

Where workers use a Gradient-provided endpoint or virtual desktop for work use, preferred access to the Internet should be made through private networks. If traveling or on a public network, workers must use Gradient-approved and provided data security tools, referenced in below section.

Internet messages must be treated as 'public' by all Gradient workers. Anything sent through the Internet passes through a number of different computer systems, all with different levels of security. Unless they are encrypted, messages may be compromised at any point.

All workers must treat any information obtained via the Internet with caution, as it may be factually incorrect.

All workers must be aware downloading items from the Internet could result in unwanted items 'piggy-backing' onto the request, potentially causing corruption of your data or the installation of "back-door" ways into endpoints and, subsequently, Gradient managed platforms such as AWS, etc. into the Gradient network. To minimize these dangers workers must consider carefully the nature and reputation of the website from which information is to be downloaded and report any suspicious activity (such as spurious messages or over-long downloads) immediately to their IT support team.

Use of the Internet includes access to social media sites. Use of these must comply with this policy.

Users must:

• Only use the Internet for business purposes, though occasional personal use is acceptable provided it is reasonable. Any personal use must not interfere with normal business activities, must not involve solicitation, must not be associated with any 'for-profit' outside business activity and must not potentially embarrass the company or bring it into disrepute;

• Disconnect immediately from any site accidentally accessed that contains sexually explicit or offensive material, regardless of whether the site had previously been deemed acceptable and notify the Compliance Officer if you inadvertently visit an unacceptable site;

• Notify the Compliance Officer immediately if you receive any inappropriate material;

• Comply with copyright law and all applicable licenses may apply to software, files, graphics, documents, messages and other material you wish to download or copy;

• Use Internet systems with the same integrity as in face-to-face, video-conference or audio-conference business operations.

Users must not:

• Access, display, store or send material which is discriminatory, harassing, obscene, pornographic, libelous, defamatory, breaches any obligations of confidentiality or is otherwise deemed by the company to be inappropriate in the workplace;

• Illegally copy material protected under copyright law or make material available to others for copying;

• Use Gradient computing resources to overload any computer system or network or to circumvent any system intended to protect the privacy or security of another user;

• Use Internet services to obtain unauthorized information or information which is personal or private to another individual or organization. If such material is accidentally received or obtained its content must not be discussed or disseminated to any other person or organization, other than the sender;

• Make excessive use of the Internet (as deemed by the company) for personal or non-business purposes;

• Download music or games or play games against opponents over the Internet without prior authorization from Compliance Officer;

• Download any software, including freeware, shareware or public domain software, without prior authorization from the Compliance Officer. Software with direct business use must be properly licensed and registered in advance;

• Download images or videos unless there is an express business-related use for the material;

• Attempt to circumvent the firewall, or other inherent controls, (for example by amending the browser configuration), without explicit authorization from the Compliance Officer;

• Reveal confidential company information, customer data, trade secrets and other material covered by existing company security policies on public forums such as chat rooms and newsgroups, or through AI platforms

• Speak or write in the name of the company on any newsgroup or chat room unless explicitly authorized to do so;

• Deliberately post false information to any newsgroup or chat room;

• Commit Gradient to any form of contract through the Internet without prior authorization;

• Provide links to inappropriate non-business related websites or other resources which access, display, store or send material that is discriminatory, harassing, obscene, pornographic, libelous, defamatory, breaches any obligations of confidentiality or is otherwise deemed by the company to be inappropriate in the workplace.

Gradient staff and contractors are responsible for any activity performed under their user credentials (i.e. login name and password). Inappropriate use of endpoint devices, systems, applications, email, the Internet and other services provided by Gradient may lead to disciplinary action.

Gradient reserves the right to utilize software and systems to monitor and record all email and Internet usage. These security systems are capable of recording (for each and every user) each Internet site visit, each chat, or email message, and each file transferred into and out of our internal networks.

Gradient reserves the right to utilize independently supplied software and data to identify inappropriate or sexually explicit Internet sites based on category, and will block access to such sites as necessary.

Gradient reserves the right to block access to other sites as necessary, where these sites constitute a threat to the normal running of Gradient business, or where there is no valid business reason for access. These include, but are not limited to:

• Criminal activity;
• Hacking;
• Illegal drugs;
• Phishing;
• Fraud;
• Spyware.

In addition, Gradient reserves the right to monitor communications to determine the existence of facts, detect unauthorized use of its systems and to ascertain the standards which ought to be achieved by workers using its systems.

Use of any Gradient owned or managed connection to the Internet is inappropriate when use:

• Compromises the privacy of users and their personal data;
• Damages the integrity of a computer system or the data or programs stored on a computer system;
• Disrupts the intended use of a system or network resource;
• Wastes resources which are needed for business use (including the resources required to resolve issues).

Content generated by any AI tool should be treated as a first draft, not the final one. AI tools cannot replace your unique creativity and critical thinking skills. All Writer-generated content should be checked for accuracy, consistency, style, bias, compliance with law, and proofread before being published or shared. You remain responsible for your work product.

When copyright matters, don't use AI tools to create the content that needs to be protected or, if you do, make sure to substantially revise it (again, treat outputs as first drafts, not final drafts).

If AI-generated content includes sources, citations, statistics, dates, etc., you must independently verify their veracity (even when using Writer fact-checking tools).

Be aware that AI-generated content can be biased if the training data used to develop the algorithm is biased. This can lead to content that perpetuates stereotypes or excludes certain groups of people.

It is prohibited to enter client information or proprietary information into any AI system including but not limited to ChatGPT, regardless if AI company or AI company's partners privacy policies state they will not use inputted prompt data to train AI models.

Use of removable storage is controlled and not permitted on Gradient-owned devices without approval from the Compliance Manager.

Gradient operates a paperless office approach, and so printing sensitive customer data is not allowed unless explicitly authorized by the Compliance Officer.

If any printed material is sent to any person working with Gradient, it should be scanned using appropriate software, and stored using a company approved storage system, currently Google Drive (using a company supplied G-Suite login). The original document must be securely and completely destroyed.

The purpose of this policy is to establish a standard for the creation of strong passwords, the protection of those passwords, and the frequency of change.

The scope of this policy includes all staff and contractors who have or are responsible for an account (or any form of access that supports or requires a password) on any system belonging to, or managed by, Gradient.

Access keys are also included within the scope of this policy, but does not extend to public/private key pairs or API keys for interactions between autonomous systems.

Company-selected password management platform must be used for all Gradient-related work, especially software or platforms that contain client data, PII, or proprietary information.

• Default system usernames and passwords are not to be used, e.g. root or administrator
• Ideally, named user accounts should be issued for each human user of a system
• All shared or group passwords, e.g. for Marketing platforms, must be stored in the Group folder of the Gradient selected password management platform
• Passwords must be shared via encrypted channels only, such as the company Slack channel
• Passwords should be set to expire and require change no later than 90 days after being set
• All passwords must be unique
• Passwords must never be recorded in an unencrypted form. This includes;
  • In clear-text computer documents
  • Hand-written notes
  • Unencrypted password management software
  • Within emails
• The use of one-time-secret services is encouraged
  • When using this method, only share one part of the access credentials (the username OR password) such that a compromise of this third party application would not compromise the account being shared
• Change a password if you have reason to believe that someone else knows it. If you believe that your password has become compromised or become aware of the breach of the requirements of this Policy, immediately contact the Compliance Officer or Operations Team for further instructions. Do not try to cover up the incident or ignore it. Information security is a vital factor in the continued success and survival of the Company and by ignoring a breach of these requirements could put jobs at risk.

• Use the company-selected password management platform to generate secure passwords for your accounts, set to;
  • Minimum of 15 characters, or the max number possible if less than 8
• Passwords must not be a dictionary word
• Passwords must not match previous passwords
• Passwords must not contain all or part of the user's name or job function, or any term (like a birthday, a partner's name or a street address) that could be easily guessed or researched
• Simple substitutions (such as 1 for i, 0 for O, 5 for s etc.) in recognizable words – i.e. words found in a dictionary – afford no real protection and must not be relied on
• Similarly, commonly used or easy to guess combinations or series such as 1234abcd or 1passw*d etc. must not be used

A joiner in this context is anybody who starts working with Gradient, whether as an employee, contractor or anybody else with access to the company's IT systems, such as a key supplier.

The following are IT-related tasks which need to be completed by the Operations Team within Gradient and/or the joiner after the Employee Agreement and NDA have been signed by both parties:

• Company-owned endpoint/asset(s) is/are provided per Endpoint Policy
• IT systems account created
  • New user accounts should follow the practice of issuing the least-privileged access - only systems and permissions therein will be issued to new users.
  • See Password Policy for guidance on password standards, and methods of transmission for user accounts
• Joiner tests their level of access and confirms they have what they need to commence working on behalf of the company.

A leaver is somebody who will no longer be working with Gradient, and therefore does not require their access to Gradient systems and platforms any longer.

It is the policy of Gradient that following the departure of a member of staff, all user accounts that the ex-employee/contractor/etc. was privy to on the network will be disabled either by deletion or by a change of password. Any received email will be redirected to the relevant Departmental Head or deleted, whichever is applicable.

It will be the responsibility of Managing Partners to recover any physical keys or access tokens belonging to the company, to restrict further access to Gradient. Where keys and access tokens were not the property of the company, it is the responsibility of the Managing Partners to ensure those tokens have been disabled.

Upon leaving the company, the ex-employee/contractor/collaborator will be reminded of this IT policy document, and reminded of their obligations concerning privacy and protecting the company's data assets.

• If requested by one of the Managing Partners or Compliance Officer, all leaver's passwords must be revealed
• The leaver will set an appropriate out-of-office auto response if they have a company email address
• The leaver will surrender all access keys and tokens to the Compliance Officer
• The leaver will return/surrender company-owned endpoint/asset(s) per Endpoint Policy
• It is the responsibility of the Compliance Officer and/or Operations Team to ensure all accounts relating to the leaver have been disabled. For example;
  • VPN
  • Antivirus Software
  • AWS or other hosting provider access
  • Google G-Suite account
  • Jira
  • Zapier
  • Nordpass
  • Microsoft Office 365
  • Zoom
  • AirTable
  • Quickbooks
  • Crunch.io
  • Slack
• The leaver's manager, Compliance Manager, and Operations Team should also carefully think about any other information that may need to be reviewed or any secret material which may need to be rotated as a result of the leaver's departure. Examples could be;
  • Contact lists the leaver had access to
  • Other communication methods the leaver had access to SSH key pairs which may need to be rotated on servers

Business-critical operational data is always kept in Amazon Web Services (AWS) Simple Storage Service (S3) buckets. These buckets are backed by AWS' 11 9's durability guarantee, and so no further safeguards are necessary in terms of the risk of losing company data when it is stored appropriately.

Business documentation and "paperwork" are kept in Google Drive. Further information on Google's data security and compliance methodologies can be found in their whitepaper.

However, all staff and contractors working with Gradient have an obligation to ensure they act with integrity when it comes to protecting the company's data assets, and always acting in the best interests of the company.

Gradient does not operate a firm whitelist of software and applications which are allowed to be used on remote users' devices. However, when company data is being stored on, or transmitted through, any service not in the following list, the express permission of the Compliance Officer or Operations Team must be sought:

• Company issued VPN
• AWS S3 or other expressly authorized AWS service
• Google Drive / Microsoft Office as part of the company G-Suite / Office 365 subscriptions
• Slack
• AirTable
• Quickbooks
• Crunch.io
• Zoom
• Dropbox
• Box
• Forsta
• Loom

Wherever possible, Encryption should be enabled for data both at-rest (in storage, not being accessed), and in-transit (as the data flows from one place to another). Encryption is cheap and easy, and not utilizing it will not be tolerated by the company.

In order to more easily match the policies and procedures laid out in this document, Gradient will provide company-owned assets/endpoints to all Gradient staff. Workers must use this endpoint exclusively when they are working with company data assets.

Gradient does not currently operate a data classification model, and so all data should be thought of as "commercial in confidence" unless explicitly agreed in writing with managers Managing Partners or the Compliance Officer.

• Only company approved VPN platforms/software can be used on company-owned endpoints/assets
• Only approved VPN users can access the VPN and must comply with the company’s policies
• Company-owned endpoints/assets are required to connect to the VPN during the following situations:
  • When accessing any company data, systems, platforms, or software on an unsecure and or public network
  • When accessing any client data, at any time, on any network
• The user is responsible for preventing unauthorized use of the VPN.

• Only company approved malware and antivirus software can be installed and used on company-owned endpoints/assets
• All company-owned endpoints/assets computer devices must have anti-virus software installed and configured so that the virus definition files are current and are routinely and automatically updated
• The antivirus software must be actively running on these devices
• If antivirus software utilizes remote computer access, this feature will be used to
  • Resolve any alerts or incidents
  • Remotely update endpoints/assets

Gradient collects personally identifiable information from users in order to deliver outstanding results for our customers. This comes with a great deal of responsibility to keep these data safe, and this part of our IT security and Data Handling policy sets out our roles and responsibilities when dealing with sensitive data.

Please refer to Gradient's Personal Identifiable Information Policy for policy information.

In order to ensure business continuity in the event of information on Gradient's systems being destroyed or corrupted, it is vital that the server is backed up regularly and reliably.

Gradient has benefited from beginning operations in a time where cloud computing is mature, and offers benefits which weren't possible with more traditional computing environments. Therefore, cloud services are carefully selected and utilized wherever possible.

Cloud services always come with a Service Level Agreement (SLA) which must be read and the impact of it must be understood by the Compliance Officer. Company controlled backups are not necessary where the service being utilized by the business comes with an acceptable SLA, meaning that data loss is only an outside possibility.

Where services cannot be consumed which already include backups, the company's backup policy for online cloud services is as follows;

• Data assets must be backed up every day
• Backups must occur within a predictable backup-window
• Backups must be kept for a minimum of 1 week from the date of completion
• Backups must be encrypted in transit and at rest
• Backups must be tested every year to ensure their consistency and reliability

It is never permissible to keep the only copy of critical company data on a Gradient-owned endpoint, therefore backups are not mandated for workstations.

However, the use of company-provided cloud services such as Google Drive should be encouraged, since these are cloud-managed services and so include backups.

The widespread availability and use of social networking applications brings opportunities to engage and communicate in new ways. However, it is important to ensure that their use is appropriate and does not cause any harm to the company’s reputation.

Social networking applications include, but are not limited to:

• Blogs, for example Medium
• Online discussion forums, for example Reddit
• Media sharing services, for example YouTube
• Networking sites, for example Meta (formerly Facebook), X (formerly Twitter), and LinkedIn

All employees should bear in mind that information they publish via social networking applications is still subject to copyright and data protection legislation regardless of privacy settings.

Employees, both during and outside of working hours, must not use social networking applications to:

• Publish any information, which is confidential to Gradient, its customers/clients, employees or any third party
• Make or publish any critical, derogatory or defamatory statements about Gradient, its customers/clients, employees or any third party
• Publish any content which may result in complaints or claims being pursued against Gradient, including but not limited to claims relating to defamatory or discriminatory statements or breaches of copyright, Data Protection and confidentiality obligations
• Publish material of an illegal, sexual or offensive nature that may bring the organization into disrepute
• Breach Gradient's Equal Opportunities Policy
• Bully and harass a colleague