Legal Acceptable Use

Security and Acceptable Use Policy

Version: 1.2
Effective: 6 October 2026
Governing law: England and Wales
Applies to: All Clients, Contractors and users of the VERTX platform

On this page · 12 sections+

This Policy is incorporated by reference into the VERTX Master Services Agreement (MSA), the VERTX Terms of Service and the VERTX Engineer Terms. "Contractor" means an engineer engaged by VERTX under the Engineer Terms (or under the earlier VERTX Independent Contractor Agreement, for an engineer who signed it). "Placement" means an engagement of a Contractor with a Client through VERTX. Breach may result in suspension, removal or legal action.

1Platform communications

1.1Mandatory channels

Until a Placement is active and paid, all project-related communication must take place through VERTX-managed channels, meaning the Platform's messaging and dashboard. This includes:

scope discussions and task assignments;
code reviews and technical feedback;
handoff and deployment coordination.

Once a Placement is active and the first payment has been taken, the Client and the Contractor may work and communicate through the Client's own tools, for example Google Meet, Slack or the Client's repositories, as permitted by MSA Clause 5. That freedom applies to day-to-day delivery only. It never permits off-platform engagement, payment or circumvention.

1.2Prohibited off-platform activity

You must not:

(a) move commercial or pre-Placement project communications to personal direct messages, WhatsApp, personal email, or any channel not managed by VERTX;

(b) discuss, negotiate or agree rates, fees, compensation or any other commercial term outside VERTX-managed channels. Commercial terms are agreed with VERTX only, and never between a Contractor and a Client (Engineer Terms Clause 9, MSA Clause 5.4);

1.3VERTX fallback channels

If a VERTX-managed channel is temporarily unavailable, VERTX will communicate a fallback channel. Do not assume a personal channel is authorised because a managed channel is briefly down.

1.4Reporting

Any attempt by another party to move commercial communications or payments outside VERTX channels must be reported to VERTX immediately, at hello@vertxtalent.io or, for Contractors, talent@vertxtalent.io.

2Access controls

2.1Principle of least privilege

Request and hold only the access needed for your current work. Do not accumulate or retain access beyond what the task requires.

2.2Multi-factor authentication

Multi-factor authentication must be enabled on every account used for engagement work where it is supported, including source control, cloud consoles, CI/CD systems and password managers. Contractors must turn on two-step verification for their VERTX account: it becomes required seven days after joining, or at once when an engagement starts, whichever is sooner. Clients should turn it on for every user; once a user has turned it on, it is required at every sign-in.

2.3Access revocation

Access to Client systems, repositories and credentials must be revoked promptly when a Placement ends: by the Contractor within 48 hours of the Placement concluding, and by the Client at its end.

3Credential and secret handling

3.1No plain text

Credentials, API keys, tokens, passwords and secrets must never be shared in plain text by message, chat or email.

3.2Secure management

Use encrypted secret management for all credentials, for example environment variables, a secret vault or a password manager. Suitable tools include AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, 1Password Teams and Bitwarden.

3.3No secrets in code

Secrets must never be committed to any repository, including a private one. If a secret is committed by accident, rotate it immediately and notify VERTX.

3.4Sharing between parties

Where a credential must pass between a Contractor and a Client for a legitimate engagement purpose, it must be shared by a secure method approved by VERTX.

4Device and endpoint security

4.1Patching

Devices used for engagement work must have current operating system and software security patches applied within a reasonable time of release.

4.2Endpoint protection

Reasonable anti-malware and endpoint protection must be enabled on every device used for engagement work.

4.3Encryption and screen lock

Disk encryption (FileVault, BitLocker or equivalent) and an automatic screen lock must be enabled on every device used for engagement work.

4.4Personal devices

Where a personal device is used, the same standards apply. VERTX or a Client may ask for confirmation of device compliance on a higher-security engagement.

5Code and change management

5.1Pull requests

Changes to a Client codebase should be submitted by pull request with a clear description, context and testing notes. Direct pushes to main or production branches should be avoided without the Client's explicit authorisation.

5.2Production deployments

A Contractor must not deploy to a production environment without the Client's approval, unless the engagement record expressly grants that authority.

5.3Documentation

Significant work, decisions and changes should be recorded in the relevant issue tracker, pull request or release notes, so there is a clear audit trail.

6AI-assisted development tools

6.1The Contractor's own practice

Contractors are proficient users of AI-assisted development tools, including large language models, and maintain that proficiency as part of their own professional practice. VERTX does not train, teach or certify Contractors, and does not direct which tools a Contractor uses or how the work is performed. A Contractor reviews, validates and takes full professional responsibility for all output, including AI-assisted output, before delivery, and does not pass through unreviewed AI output (Engineer Terms Clauses 11 and 13, MSA Clause 4.6).

6.2Data restrictions

Do not input any of the following into an AI tool that is not approved for the purpose:

Client secrets, credentials or API keys;
Client personal data or customer data;
Client Confidential Information, including unpublished code, architecture detail and business data.

Where there is doubt, treat the data as confidential and obtain the Client's approval before using an AI tool with it.

6.3Client policies

Where a Client communicates its own AI usage policy for its environment, that policy is followed. Where a Client has none, this Policy is the minimum standard.

6.4Transparency

Where a Client asks, be open about the use of AI-assisted tools in the work, particularly for code generation.

7Data handling

7.1Personal data

Personal data encountered during a Placement, including a Client's customer data or employee records, must be handled in accordance with applicable data protection law and the obligations in the Engineer Terms and the MSA.

7.2Data minimisation

Access only the data needed for the task. Do not copy, download or retain Client data beyond what is necessary.

7.3Storage

Client data must not be held on personal cloud storage, personal email or any unsecured location. Engagement data must remain accessible to VERTX and the Client through agreed channels.

7.4Deletion after a Placement

All Client data must be deleted from personal devices and storage within 5 business days of a Placement ending, unless the Client instructs otherwise in writing. VERTX may require evidence of deletion (Engineer Terms Clause 12).

8Incident reporting

8.1What counts as an incident

Report any of the following immediately:

suspected or confirmed unauthorised access to systems or data;
accidental exposure of credentials or secrets;
loss or theft of a device holding engagement data;
discovery of malware or a suspected attack;
any data breach or near miss affecting personal data.

8.2How to report

Report through the VERTX-managed channel and by email to security@vertxtalent.io. Where personal data is affected, also notify the Client directly.

8.3Timelines

Initial report: immediately on discovery, and in any case within 24 hours.
Where personal data is involved, VERTX must be notified within 24 hours, so that VERTX can assess whether notification to the Information Commissioner's Office is required within 72 hours of VERTX becoming aware.

8.4Containment

On discovering an incident: rotate compromised credentials immediately, revoke the relevant access, and preserve evidence that may be needed for the investigation.

9Platform logging, monitoring and transparency

9.1Administrative logs

VERTX keeps administrative logs of platform activity, including communications in VERTX-managed channels and access events, for platform security, quality assurance, dispute resolution and contractual compliance. Logging is carried out in accordance with the VERTX Privacy Policy.

9.2Communication monitoring

VERTX monitors platform communications for quality assurance, dispute resolution, detection of off-platform circumvention, and relationship health. Pattern matching is automated and flagged messages are reviewed by VERTX administrators. This monitoring is a platform service feature. It is not supervision or control of a Contractor's working methods. Contractors retain complete control over their technical approach, working hours, location, tooling and the manner in which the services are performed.

9.3What this monitoring is not

The monitoring described in this Section is not, and must not be construed as, employment-style supervision, direction or control of a Contractor's work for the purposes of UK employment law, the off-payroll working rules, United States worker-classification law, or any equivalent regime.

9.4Continuity

VERTX maintains automated backups of its production database through its managed hosting providers, retains the ability to redeploy the application, and follows the incident-response steps set out in Section 8.

10Identity, accounts and platform access

10.1Real name and clear photograph

Every user must register and use the Platform under their real legal name and use a clear, recent photograph of themselves as their profile image. Avatars, cartoons, logos, stock images, group photographs and pseudonyms are not permitted. Misrepresenting identity, or operating under a false or borrowed identity, is a material breach of this Policy and of the MSA or the Engineer Terms, as applicable, and is also addressed in the vetting-integrity provisions of the applicable VERTX Terms of Service.

10.2Anti-scraping and automated access

The anti-scraping and automated-access restrictions in the applicable VERTX Terms of Service apply to all use of the Platform and are incorporated into this Policy by reference. In summary, and without limiting those provisions, you must not scrape, crawl, extract data from, frame, mirror or apply automated access to the Platform, and you may access it only through the interfaces VERTX provides. Breach permits immediate suspension and may result in legal action.

11Enforcement

A breach of this Policy may result in:

(a) a written warning;

(b) temporary suspension of platform access;

(d) legal action under the MSA or the Engineer Terms, as applicable.

Repeated attempts to bypass VERTX-managed communication channels are a material breach of the MSA and of the Engineer Terms.

12Policy questions

Contact security@vertxtalent.io with any question about this Policy.

VERTX TALENT LTD, vertxtalent.io Security and Acceptable Use Policy, version 1.2, 6 October 2026.

Questions about this document? Write to privacy@vertxtalent.io.