Skip to content

Human Resources Security Policy

Organization: Cloudnaut Technologies LLP
Classification: Internal
Document status: Effective
Version: 1.0
Owner: Management / HR
Effective date: 2026-10-15
Review cycle: Annual; interim revision upon material change to employment law, screening providers, or customer contractual requirements

Document control

Role Name
Prepared by Management / Security Owner (Cloudnaut)
Reviewed by Sandeep AC
Approved by Sandeep AC

Revision history

Version Date Summary Reviewed by Approved by
0.1 2026-10-15 Initial draft: personnel security lifecycle from screening to offboarding. Sandeep AC —
1.0 2026-10-15 Initial effective release. Sandeep AC Sandeep AC

Purpose

This policy defines the security controls that apply to personnel before, during, and after their engagement with Cloudnaut, so that people who access company or customer information are suitable, understand their obligations, and lose access promptly when their role changes or ends.

Scope

This policy applies to employees, contractors, consultants, and subcontractor personnel who access Cloudnaut or customer systems, repositories, data, or confidential information. Where a subcontractor firm employs the individual, the firm’s obligations are also set by contract under the Third-Party and Supplier Security Policy.

Roles and responsibilities

Role Responsibilities
HR / People Operations (designated by management) Screening initiation, agreements, onboarding and offboarding checklists, personnel records.
Security Owner Defines security onboarding content; verifies access revocation; maintains access and asset records.
Engagement Lead / line manager Requests role-appropriate access; notifies HR and Security Owner of transfers and exits; confirms asset return.
Personnel Complete screening, sign agreements, complete training, follow policies, return assets, report incidents.

Policy

1. Before engagement — screening

  1. Background verification is completed before onboarding or before access to customer systems, per the Background Verification Policy.
  2. Screening is proportionate to role risk and customer requirements and is performed only with the individual’s informed consent and within what Indian law and the law of any other relevant jurisdiction permit.
  3. Customer-specific screening requirements (for example additional checks or re-screening intervals) are identified at engagement start and completed before assignment.

2. Terms and conditions — confidentiality and acceptable use

  1. Every individual signs a confidentiality / non-disclosure agreement, or an employment or service contract containing equivalent confidentiality clauses, before receiving access. Obligations continue after the engagement ends for the period stated in the agreement.
  2. Every individual acknowledges the Code of Business Conduct and Ethics, including acceptable use of company systems, and the Information Security Policy.
  3. Where a customer requires its own NDA, acceptable use, or security acknowledgement, it is signed before access to that customer’s systems.
  4. Intellectual property and confidentiality terms for contractors and subcontractors are set in their contracts.

3. Onboarding

Onboarding follows a checklist recorded per individual and held in Cloudnaut’s internal, access-restricted HR records, covering at minimum:

4. During engagement

  1. Personnel complete annual security awareness training and any customer-required training.
  2. Personnel follow the policy library and report security incidents and weaknesses per the Incident Response and Management Policy.
  3. Personal data held about personnel (screening outcomes, contracts, training records) is collected for stated purposes, limited to what is necessary, stored with restricted access, and retained only as long as needed, consistent with the Digital Personal Data Protection Act, 2023 and its rules as they come into force. Retention periods are set by management with legal advice and recorded internally.

5. Transfers and role changes

When an individual moves between engagements, customers, or roles:

  1. The Engagement Lead notifies the Security Owner before the move takes effect.
  2. Access for the previous engagement is removed per the Engagement Access Isolation Policy and the access control policy; the new engagement’s access is requested separately.
  3. Any additional screening or training required by the new customer is completed before access.

6. Offboarding and access revocation

On resignation, termination, or contract end:

  1. The line manager or HR notifies the Security Owner and Engagement Lead no later than the notice date (immediately for involuntary termination).
  2. Cloudnaut accounts, source-control organization memberships, VPN, cloud, and SaaS access are disabled on or before the last working day (immediately for involuntary termination).
  3. The Engagement Lead requests removal of customer-issued accounts and access from the customer, and records the customer’s confirmation where available.
  4. Shared credentials or secrets the individual knew are rotated where they cannot be individually revoked.
  5. Company-issued assets (laptops, tokens, storage media) are returned and recorded. Company and customer data on personally owned devices is deleted, and the individual confirms deletion in writing.
  6. The individual is reminded of continuing confidentiality obligations.
  7. The completed offboarding checklist, with revocation evidence (for example platform audit-log entries or screenshots of removed membership), is retained.

Disciplinary process

Breaches of this policy library are handled through a fair and documented disciplinary process consistent with the individual’s employment or service contract and applicable Indian employment law. Depending on severity, outcomes may include retraining, written warning, removal from customer engagements, suspension of access, termination of employment or contract, and referral to authorities where required by law. Access may be suspended immediately while a suspected serious breach is investigated.

Exceptions

Exceptions (for example starting non-customer work before screening completes) require written management approval with a stated expiry, and never permit access to customer systems or data before customer requirements are met.

Records

Records held internally (not on this site), with access limited to HR and the Security Owner:

  • Screening completion and outcome category (not full reports, unless legally and contractually required).
  • Signed NDAs, contracts, and policy acknowledgements.
  • Training completion records.
  • Onboarding and offboarding checklists, including access revocation and asset return evidence.
  • Disciplinary records, where applicable.