Your workday.
In one place.

This Technology Use and Information Security Policy establishes standards for access to and use of Frameworks Company accounts, devices, networks, applications, and business information (Company Systems). It is intended to cover employees, contractors, and other individuals expressly authorized to access Company Systems (Authorized Users).

This policy is adopted effective September 17, 2026, and is owned and administered by Frameworks LLC. They do not supersede applicable law, an executed agreement, or an approved company policy. Access to a resource listed in FITS does not itself confer authorization, a software license, or administrative authority.

Authorized Users must use Company Systems within the scope of their assigned responsibilities and approved permissions. Users must not engage in unlawful activity, unlawful discrimination or harassment, unauthorized access, or intentional interference with system availability or integrity.

Users must not circumvent security controls, introduce malicious software, share individual accounts, or permit unauthorized third-party access. Uses outside an approved business purpose require authorization. These restrictions are subject to the protected-rights provisions of this policy.

Employees, leaders, contractors, and other Authorized Users must use company technology, software, email, social-media accounts, platforms, products, and services responsibly and consistently with Frameworks’ diversity, equity, and inclusion policy and guiding values of respect, fairness, thoughtful work, and accountability.

Company resources must not be used to threaten, intimidate, unlawfully discriminate against, harass, or deliberately harm another person; disclose private information without authorization; impersonate others; or knowingly publish false statements intended to damage a person or organization. These requirements apply to messages, posts, shared content, and other activity carried out through company-provided resources.

Disagreement, good-faith criticism, reporting a concern, discussing working conditions, and other legally protected activity are not prohibited merely because they are negative or uncomfortable. Nothing in this provision restricts lawful reporting to a government agency or requires advance company approval for protected activity. Raise conduct concerns with your supervisor or through the reporting options in the company’s DEI policy.

Read our DEI policy ↗ · Read our guiding values ↗

Employees and leaders may not speak on behalf of Frameworks, issue official statements, make commitments, or represent themselves as company spokespersons unless expressly authorized for that purpose. A job title, leadership role, company email address, platform account, or access to company technology does not by itself grant spokesperson authority.

Use of company branding, official social-media accounts, and public-facing communications must remain within the user’s assigned authorization. This provision does not prevent routine authorized work communications within a person’s role. Media inquiries, requests for official comment, and questions outside that authority must be directed to your supervisor.

Personal views must not be presented as official company positions. A personal-opinion disclaimer does not authorize disclosure of confidential information or otherwise prohibited conduct. Nothing here prevents truthful identification of an employment relationship or communications protected by applicable law.

As a condition of authorized use, employees, leaders, contractors, and other Authorized Users are required to comply with this policy and the applicable DEI policy when accessing or using company-provided platforms, products, services, software, email, social media, devices, and other technology. Following notice and access to the applicable terms, continued authorized use is subject to these requirements to the extent permitted by law and existing agreements.

Users are responsible for reviewing the current policy and communicated updates, checking for changes, and seeking clarification from their supervisor where necessary. Frameworks LLC is responsible for communicating material revisions and their effective dates; users’ responsibility to review does not replace any legally required notice or consent process.

This page does not collect or record an acknowledgment. Use of company technology does not, by itself, establish a signed agreement, assign intellectual-property rights, or waive rights that cannot lawfully be waived. Where a separate acknowledgment or affirmative consent is required, it must be obtained through an appropriate process. This internal policy does not replace customer terms of service.

Users must use the identity and authentication methods assigned or approved for each service, safeguard credentials, and comply with required multifactor authentication and approved password-management procedures. Passwords, access tokens, recovery codes, and authentication codes must not be disclosed to other individuals.

Users must approve authentication prompts only for sign-ins they initiated and must promptly report suspected credential compromise. Access requests and permission changes must be handled by an authorized company representative; users may not grant themselves or others additional permissions without approval.

Assigned Apple devices must be enrolled and configured in accordance with the instructions provided by Frameworks. Required management profiles, security settings, software updates, and approved applications must remain in place. Users must take reasonable care of equipment and must not transfer, reset, unenroll, or dispose of assigned equipment without authorization.

Personal-device enrollment requires prior approval and an applicable notice describing management capabilities, access, and work-data removal. Administrative capabilities depend on ownership, enrollment method, and configuration. This policy does not independently authorize inspection or erasure of personal information.

Company and client information must be stored, shared, and processed through approved systems using permissions appropriate to the task. Users must verify recipients and sharing settings and comply with applicable contractual confidentiality, retention, and security requirements.

Credentials, confidential business records, and client data must not be placed in personal storage, public repositories, unapproved AI services, or other unapproved systems. Integrations and third-party access require approval. Records subject to a preservation instruction or legal hold must not be altered or destroyed contrary to that instruction. These requirements do not restrict disclosures protected by law.

Frameworks uses four company information classifications: Public (Level 1), Internal (Level 2), Restricted (Level 3), and Critical (Level 4). These labels describe the sensitivity of information and who may receive it. They are company handling designations, not government security classifications.

Internal is the standard classification for company material unless a different level has been assigned. A missing label is not permission to publish or share information. Where information appears more sensitive than its label, pause distribution and obtain guidance from your supervisor. Apply the highest applicable level when combining information with different classifications.

Include the assigned classification on documents and shared materials where practical, and preserve labels when copying or forwarding them. Confirm the recipient’s authorization and the approved storage or transfer method before sharing. Access to a file does not by itself authorize redistribution.

Requests to change a Public, Internal, or Restricted classification must be directed to your supervisor. Do not change a label or broaden access while review is pending. Critical information is not eligible for reclassification under the supplied company classification rules.

Report suspected misclassification, accidental disclosure, or unauthorized access through the incident-reporting process. The protected-rights provisions of this policy continue to apply to all four levels.

Users must obtain appropriate authorization and licenses for software, source code, fonts, images, plugins, and other materials used in company work. Subscriptions, purchases, and acceptance of terms on behalf of Frameworks require authorization from a person permitted to approve them.

Applicable third-party terms, open-source license conditions, and client agreements must be observed. Intellectual-property ownership and any assignment of rights are governed by applicable law and executed agreements; this document does not independently assign ownership or grant additional license rights.

TFC devices, networks, accounts, company workspaces, and TFC email are provided for authorized company business. Work product created in performing assigned company duties or an agreed company engagement—including software, designs, documentation, business records, and other deliverables—must be maintained in approved company systems and made available to authorized company representatives.

The company owns work product to the extent ownership vests in it under applicable law or a valid executed assignment. Employee work may qualify as work made for hire when created within the scope of employment. Contractor deliverables and other intellectual property must be addressed by an appropriate signed agreement; use of a company device, network, workspace, or email account alone does not transfer all intellectual-property rights.

For work product the company owns, the company may use, reproduce, modify, adapt, distribute, publish, license, commercialize, and incorporate that work into its products and services, subject to applicable law, client agreements, confidentiality obligations, and third-party rights. For licensed material, company use is limited to the rights actually granted.

Personal work, pre-existing materials, third-party content, and open-source components are not automatically company property merely because they are accessed, transmitted, or stored using TFC resources. Users must disclose relevant ownership or licensing restrictions to their supervisor before incorporating such material into company deliverables and obtain any required approval.

Questions about ownership, permitted use, or assignment requirements must be directed to your supervisor before work is shared, licensed, or used outside its authorized purpose. This policy does not replace a required signed intellectual-property agreement or authorize unrestricted use of personal information or protected communications.

The following company-provided notice is intended for Frameworks email signatures and footers. Use it with the approved email signature; requests to alter company names, ownership language, or branding should be directed to your supervisor.

© Frameworks Holding LLC © Orderly Technologies LLC. All Rights Reserved. Crafted with care to bring Your Ideas, to Life.

The Frameworks Company name, logo, and related branding are copyrighted property of Frameworks Holding LLC, and Orderly Technologies LLC and related products are proprietary property of The Frameworks Company; other products, names, logos, and branding mentioned may also be property of Frameworks Holding or their respective owners and may not be used without written consent. The Frameworks Company operates under a DBA of Frameworks Holding LLC.

Authorized administration of Company Systems may be necessary for support, security, access management, business continuity, or legal obligations. Any logging, investigation, inspection, or device-management action must be limited to an authorized purpose and comply with applicable law, approved policies, and required notices.

This document does not provide blanket consent to monitoring or establish unrestricted administrative access. Users should obtain the applicable privacy and enrollment information before placing personal information on a work account or managed device.

Users must promptly report suspected security incidents, including lost equipment, unauthorized account activity, exposed credentials, malicious messages, or accidental information disclosure. Reports should be made to the designated company contact or, if unavailable, to the user’s manager through a known and trusted channel.

Reports should identify the affected system, relevant times, and known circumstances without including passwords or recovery codes. Users must preserve relevant evidence, avoid unauthorized investigation or destructive remediation, and follow instructions from the authorized response contact. Nothing requires internal reporting before contacting a government agency where legally permitted.

When responsibilities change or an engagement ends, users must cooperate with the authorized transfer of business records, repositories, design files, and account responsibilities, and return company property in accordance with applicable agreements and instructions.

Access permissions must be changed or revoked by an authorized administrator. Users must not use credentials after authorization ends or retain company information contrary to applicable agreements, law, or retention instructions. Device erasure and record deletion require authorization.

Concerns and alleged violations should be reviewed fairly. Access restrictions and any corrective action must be consistent with applicable law, approved procedures, and relevant agreements. This policy does not establish an employment relationship, change a contractor’s status, guarantee continued engagement, or create an automatic disciplinary outcome.

Nothing in this policy restricts legally protected discussion of wages, hours, or working conditions; protected concerted activity; lawful reporting to government agencies; participation in investigations; or other nonwaivable rights. No prior company approval is required for activity protected by law. Applicable coverage and individual protections depend on the circumstances.

Frameworks LLC is responsible for administering this policy and approving revisions. The adopted terms and any acknowledgment requirements must be communicated to affected users. Material revisions should be communicated before they take effect. Viewing FITS does not constitute recorded acknowledgment or acceptance of this policy.