Personnel and Acceptable Use Policy

1. Who this applies to

Everyone who has access to the production or non-production platform, the cloud subscription, the source-control organization, the databases, document storage, company email, the domain registrar or any provider console. Contractors are included from the day they are given access. Before access is granted, a person signs a confidentiality agreement that survives the end of their engagement and acknowledges this policy in writing. A record of who has access to what is kept.

2. Accounts

• Every account is personal to one person. There are no shared accounts.
• Each account has a unique password held in a password manager, and multi-factor sign-in wherever the service offers it.
• Passwords are never reused between services, written down in the open, or sent by chat or email.
• Access is granted for a stated purpose and removed the day it is no longer needed, and on the day a person leaves.
• Platform operator accounts are read-only on customer matters, always require the second sign-in factor, and every access is logged. They are used only to support and operate the platform.

3. Devices

Any device used to reach the systems above has full-disk encryption, locks automatically and needs a password or biometric to unlock, runs a current operating system with updates applied promptly, and is not shared with others for those purposes. A lost or stolen device, or any sign that an account has been used by someone else, is reported to the Security Lead at once.

4. Secrets

• API keys, connection strings, signing secrets, encryption keys, storage keys and provider credentials live only in the hosting platform’s protected application settings, the deployment system’s secret store and the password manager. Never in source code, a commit message, chat, email, a ticket, a screenshot or an AI prompt.
• Secret scanning runs on the source repository. An alert is treated as a leak: the secret is rotated first and investigated second.
• A development machine holds development values only, never production secrets.

5. Production access

• Production is reached only for a reason that can be written in one sentence: a release, a support request from a firm, an incident, or a scheduled operation. The reason is recorded in the release record, the support ticket or the incident log.
• Customer matters are read, never changed, from the operator side. The product enforces this for operator accounts, and every read is logged and can be given to the firm.
• Nobody uses a customer’s credentials, and there is no impersonation feature.
• Direct database access from a developer machine requires that machine’s address to be added to the database firewall for the task and removed afterwards.
• Local development uses seeded test firms and demonstration data.
• Evidence exports taken during an incident are kept off personal cloud storage and personal email, and disposed of when the incident closes.

6. AI tools

The platform itself sends documents to the AI providers listed in the Privacy Policy; that use is disclosed and governed by the Sub-processors and Vendor Policy. For the tools personnel use in their own work, the rules are:

• Only approved tools are used with company information.
• No customer data in personal AI tools. Nothing from a firm’s matter, including screenshots, is pasted, uploaded or dictated into a tool that is not a listed provider acting inside the product.
• No secrets in prompts.
• A support request that requires reading a firm’s matter is answered by a person, through the operator portal.
• Output from an AI tool is the person’s responsibility once used: code is tested like any other code, and text is checked before it goes to a customer.

7. Client data

• Customer information is handled according to its class in the Data Handling and Retention Policy. Privileged material and identity data stay inside the platform; nothing customer-related goes to personal devices, personal cloud storage or personal email.
• A request from an individual or a firm about personal information follows the Privacy Requests Procedure. A request from a court, regulator or police goes to the Security Lead and counsel before anything is disclosed.
• Nobody looks at a customer’s matter out of curiosity. Every operator read is logged.
• Communication with a firm’s clients is the firm’s job. RealEstAi does not contact a firm’s clients unless the firm asks in writing.

8. General conduct

• Company systems are used for RealEstAi’s business. Company files do not go into personal systems.
• No one disables, bypasses or weakens a security control to save time. If a control is in the way, it is raised with the Security Lead and an exception is recorded.
• Anything that looks wrong is reported at once. Reporting a mistake promptly is never held against the person who made it.
• New personnel read the Information Security Policy, the Incident Response Policy and this policy before access is granted.

9. Breach of this policy

A breach may lead to removal of access and the end of the engagement, and, where customer data is involved, is handled under the Incident Response Policy.