Code of IT Security

1Who this code applies to

This code applies to everyone who works for or with Arcsen and uses Arcsen or client systems, including employees, contractors and subcontractors. It turns our Information Security Policy into everyday rules. Where a client’s rules are stricter, follow the client’s rules on that client’s work.

2Accounts and passwords

• Use only your own accounts. Never share passwords, codes or access tokens, and never use someone else’s account.
• Turn on multi-factor authentication wherever it is available, using the method that Arcsen or the client provides.
• Use a long, unique passphrase for every account, and keep it in an approved password manager.
• If you think an account has been compromised, change the password and report it immediately.

3Devices

• Do Arcsen and client work only on a company-managed device, or on a device that the client provides.
• Keep your device updated, encrypted and protected by a screen lock, and do not disable its security software.
• Lock your screen whenever you step away, and never leave devices unattended in public places or in vehicles.
• Install software only from approved sources, and only what your work needs.
• Report a lost or stolen device immediately.

4Client systems and data

• Access only the client systems and data your assignment requires, using the accounts the client has approved.
• Follow each client’s security, privacy and acceptable use policies.
• Never export client data to personal devices, personal storage, personal email or unapproved tools.
• Build and test in sandboxes. Use masked or test data unless the client has approved real data for a specific task.
• Delete any local copies and hand back your access when you leave an engagement.

5AI tools

• Use only the AI tools that Arcsen has approved for work.
• Never enter client data, personal data or confidential Arcsen information into public AI tools.
• Use AI on client data only within platforms and settings the client has approved, such as Agentforce in the client’s Salesforce org.
• Check AI output for accuracy, security and bias before you use or share it. You remain responsible for the work.

6Email, messages and calls

• Treat unexpected links, attachments and requests with caution, even when they appear to come from a colleague or a client.
• Confirm any unusual request for payment, credentials or data through a second, trusted channel.
• Do not forward work email to personal accounts, or use personal messaging apps for client information.
• Report suspected phishing to compliance@arcsen.com.

7Code and configuration

• Keep code and configuration in approved repositories, with peer review before release.
• Never put unencrypted passwords, keys or tokens in code, configuration files or tickets. Use the platform’s secure credential stores.
• Follow the client’s change and release process, and never make unapproved changes in production.
• Give integration users and connected apps only the permissions they need.

8Working remotely and travelling

• Work from trusted networks. Away from them, use a mobile hotspot or connect through an approved VPN.
• Make sure that others cannot see your screen or overhear confidential calls.
• When you travel, take only the devices and information you need, and keep them with you.

9Information and paper

• Share files using approved tools, with access limited to the people who need it.
• Handle information according to its classification in the Information Security Policy.
• Keep your desk clear of confidential papers, and shred them when they are no longer needed.

10Reporting incidents

Report any actual or suspected security incident immediately to compliance@arcsen.com and to your manager. Examples include a lost device, a suspicious link you clicked, data sent to the wrong person, or unusual activity in a client system. Fast reporting limits the harm. No one is penalized for a report made in good faith.

11Breaches of this code

Breaking this code may lead to disciplinary action, up to and including termination of employment or contract, and access may be suspended while we investigate. Send any questions about this code to compliance@arcsen.com.