Acceptable use policy

Data that must not be entered

• • Health, disability or medical information, including sickness reasons
• • Union membership, religious or political opinions, sexual orientation
• • Racial or ethnic origin, biometric or genetic identifiers
• • Government identity numbers, bank details, or payment card data
• • Third-party personal data unrelated to the documented process

How records must be written

• • Record observable, dated facts, not opinions about a person's character
• • Attribute second-hand information to its source and mark it as reported
• • Never backdate an entry; corrections are made as amendments with a reason
• • Keep internal-only notes out of employee-visible fields, and vice versa

Prohibited conduct

• • Accessing records outside your role or legitimate business need
• • Sharing credentials, or exporting data for a purpose you cannot justify
• • Circumventing rate limits, approvals, watermarks, or audit logging
• • Probing, scanning or load-testing the service without written authorization
• • Uploading malware, or content that is unlawful, harassing or discriminatory

AI assistance boundaries

The writing guardrail and help agent may only be used to make wording clearer, more specific and more measurable. They must not be used to author an allegation, invent evidence, or generate a conclusion about a person. Assistance interactions are logged.

Enforcement

Suspected breaches are investigated with the customer's administrator. Provider may suspend an account or a tenant where continued use presents legal or security risk, and will notify the customer unless prohibited by law.

Reporting a concern

Misuse should be reported to your organization's People & Culture or privacy contact. Security weaknesses should be reported through the vulnerability disclosure policy.