Internal policies

Business decisions must be based on competence, quality and fair competition. We do not tolerate bribery, extortion or other benefits intended to secure an improper advantage.

• Offering, promising, giving or accepting a benefit intended to unlawfully or improperly influence a decision is prohibited, including through third parties.
• Business gifts and hospitality must comply with the law and both parties’ rules. They must not create an obligation, an appearance of dependence or a risk to impartiality.
• Actual or potential conflicts of interest must be disclosed to the person responsible for the engagement before a decision is made. A person affected by a conflict should not decide the matter alone.
• Agreements, financial records and information provided to clients must be accurate. Falsifying documentation, work results or qualifications is prohibited.

In practice: if you are unsure, pause the decision or acceptance of a benefit and seek clarification.

Work must be voluntary and respect human dignity. We do not tolerate slavery, human trafficking, forced labour or the exploitation of economic dependence to restrict a person’s freedom.

• Employment and service terms should be understandable and agreed before an engagement begins.
• Withholding identity documents, restricting freedom of movement or using threats to compel work is prohibited.
• Recruitment fees and other charges imposed on candidates to make them dependent on an intermediary or organisation are unacceptable.
• We respect the right to end an engagement lawfully, freedom of association and the right to representation.
• We expect partners to uphold the same fundamental principles and address credible indications of violations.

In practice: suspected exploitation must not be ignored or addressed by putting pressure on the person affected. Their safety comes first.

Work must not deprive a child of safety, education or development. We do not permit employment below the legally required minimum age or the assignment of hazardous or otherwise prohibited work to anyone under 18.

• Compliance with age requirements must be verified before a person starts work, in a lawful manner that respects data minimisation.
• Lawful internships, vocational training and other permitted activities for young people require appropriate conditions, supervision and protection of their health and education.
• We do not accept attempts to circumvent these principles through subcontractors, intermediaries or suppliers.
• Where a violation is suspected, activities that put a child at risk must stop, and the response must take account of the child’s best interests and legal obligations.

In practice: the prohibition concerns unlawful child labour; it does not automatically prohibit all lawful educational programmes and internships for young people.

Everyone has the right to be treated professionally and with respect. We do not tolerate discrimination, workplace bullying, harassment, sexual harassment, humiliation, intimidation or violence.

• Recruitment and engagement decisions should be based on competence, experience and the objective requirements of the role.
• Sex, age, disability, ethnic origin, nationality, religion, sexual orientation and other legally protected characteristics must not be grounds for unequal treatment.
• Respectful conduct is required in the office, at client sites, during online meetings, in correspondence and on messaging platforms.
• Feedback should address work and behaviour without undermining personal dignity. Disagreement does not justify abusive language.

In practice: anyone experiencing or witnessing inappropriate behaviour may raise a concern without first having to confront the person concerned.

Access to information carries a duty to protect it. Client data, documentation, code, configurations, test results and commercial information may only be used for an authorised purpose.

• Access must be limited to people who need it for agreed tasks. Accounts, passwords and other authentication credentials must not be shared.
• Work must use approved tools, devices and communication channels, with safeguards appropriate to the risks and project requirements.
• Client information must not be transferred to personal email accounts, private repositories or unapproved cloud services without authorisation.
• Rights to deliverables and the permitted use of materials are governed by the relevant contracts and licences. Access to material does not confer ownership rights.
• When an engagement ends, access must be revoked and materials returned, deleted or retained only on an appropriate basis. Confidentiality obligations continue in accordance with the law and contract.

In practice: suspected data loss, information disclosure or account compromise must be reported promptly through the agreed incident response channel.

Personal data must be processed for a defined purpose and on an appropriate legal basis. The scope of data, access and retention should reflect genuine needs and applicable law, including the GDPR where applicable.

• Only data needed for a specific task should be collected, and individuals must receive the required information about its processing.
• Data must not be used for new, unauthorised purposes or disclosed to recipients without an appropriate basis.
• Where we process data on behalf of a client, the scope and instructions must be set out in the relevant arrangements, including a data processing agreement where required.
• Transfers outside the European Economic Area require the relevant legal conditions to be met.
• Requests to exercise individual rights and suspected personal data breaches must be referred to the person responsible for handling them without undue delay.

Further information: processing related to use of the website is described in the B2B Cyber Privacy Policy. This section does not replace it.

Cybersecurity activities require clear authorisation. Technical knowledge or access to a system does not constitute permission to test any resource.

• Testing must be based on documented authorisation, within the agreed scope and time frame, with permitted methods and stop conditions defined.
• Exceeding the agreed scope, retaining unauthorised access or collecting more data than necessary to demonstrate a finding is prohibited.
• Results and vulnerability information must be shared with authorised recipients through secure channels. Publication requires appropriate agreement and a lawful basis.
• Automation tools, including AI tools, must not extend the authorisation to test. Their use requires compliance with agreed limits and oversight by the person responsible for the test.

In practice: uncertainty about authorisation must be resolved before an activity begins. Additional requirements for the use of AI are set out in section 12.

People’s safety takes priority over a delivery deadline. This principle applies in the office, at client sites and when working remotely, as well as during crises and epidemic threats.

• Applicable occupational health and safety rules must be followed, and accidents, hazards and conditions that may cause harm must be reported.
• Working arrangements should account for ergonomics, rest and safe use of equipment. Remote working does not remove information security obligations.
• When health threats arise, working arrangements should be adapted to the risks, applicable law and guidance from the relevant authorities.
• For critical services, emergency communications, responsibilities, cover arrangements and recovery priorities must be agreed.
• Information about disruptions must be communicated accurately while respecting personal privacy and client confidentiality.

In practice: support availability, response times and recovery parameters are defined in the contract or agreed plan. This policy does not constitute a commitment to round-the-clock support.

Responsible development combines environmental care with fair treatment of people. At B2B Cyber, we consider the impact of our activities on our team, partners and wider society, and tailor our actions to the scale of our operations and available resources.

Environment and resources

• We favour digital documentation where legal and security requirements permit, and limit unnecessary printing.
• Equipment purchasing and use should take account of durability, repairability, energy efficiency and secure reuse.
• End-of-life equipment and storage media must be passed to authorised recipients after data has been protected or securely removed.
• We consider remote meetings and lower-emission travel where they meet the purpose of the engagement and client requirements.
• We do not make unsupported claims about climate neutrality, environmental certifications or achieved emissions reductions.

Fair employment and social responsibility

• Employment and engagement terms should be transparent, lawful and respect agreed remuneration, payment deadlines and the rights applicable to each type of working relationship.
• We respect equal opportunities, dignity and the right to safe working conditions. Sections 2–4 set out the specific principles on human rights, child protection and equal treatment.
• Project planning should consider the impact on people, including risks of exclusion and barriers to accessibility, and reduce adverse effects within our area of responsibility.
• Social initiatives, educational activities and knowledge sharing should respond to genuine needs and organisational capacity. Participation in voluntary activities must not be coerced.

In practice: environmental and social goals and results must be communicated on the basis of evidence and actions actually taken. We do not claim programmes, partnerships or achievements that do not exist.

B2B Cyber applies a risk-based approach to managing security risks associated with suppliers, subcontractors and third-party service providers. The extent of assessment and safeguards depends on service criticality, the types of data involved, system access and the potential impact of disruption.

• Pre-engagement assessment: the supplier’s role, service criticality and risk must be established. Higher-risk third parties require enhanced due diligence appropriate to the service, such as a review of safeguards, documentation or independent reports.
• Terms and responsibilities: contracts should define services, payment terms, confidentiality, data protection, security requirements and arrangements for reporting and responding to incidents. Verification of compliance should be possible within the agreed scope.
• Access and subcontracting: permissions must be limited to what is necessary, and additional third parties may be engaged only in accordance with contractual conditions and required approvals. This also applies to cloud, SaaS and AI tool providers.
• Ongoing oversight: the scope and frequency of reviews should reflect the risk. Material changes to services, access or data processing, and security incidents, require reassessment and appropriate action.
• Risk treatment: material findings, corrective actions and risk acceptance decisions must be documented and assigned to an authorised person. Unacceptable risk requires restrictions on, or suspension of, the engagement.
• Exit arrangements: access must be revoked, data return or secure deletion agreed subject to retention obligations, and the transition of critical services arranged.
• Partner responsibility: selection also considers competence, reliability and ethical standards. We do not accept corruption, discrimination, unlawful child labour or forced labour.

In practice: a provider with access to client environments or confidential data requires a different level of assurance from a provider with limited security impact. A statement or certificate alone does not replace assessment of the specific service.

Concerns regarding suspected misconduct, unethical behaviour or violations of applicable laws and B2B Cyber policies may be reported confidentially to [email protected]. Reports are handled by designated authorised personnel with appropriate confidentiality safeguards. No separate reporting platform or form is required.

The channel is available to employees, contractors, candidates, former team members, suppliers and others who obtain information connected with B2B Cyber’s activities. There is no requirement to confront the person concerned before making a report.

• What to report: describe the event, approximate date and circumstances, and provide available, lawfully obtained information. Distinguish facts from assumptions. You do not need to conduct your own investigation or have complete evidence.
• Safe information sharing: do not send passwords, access keys, complete databases or unnecessary personal data. Agree on suitable safeguards before sharing particularly sensitive material.
• Handling responsibility: authorised personnel assess reports impartially, determine the appropriate process, document follow-up actions and provide feedback where contact is possible, in accordance with the applicable procedure and law. Anyone implicated in a report or affected by a conflict of interest must not handle it.
• Confidentiality: access to the reporting person’s identity, messages and records is restricted to authorised personnel. Information is protected against unauthorised disclosure, subject to legal obligations and the rights of the people concerned.
• Non-retaliation: we do not tolerate threats, intimidation or adverse changes to employment or engagement terms because someone raises a concern based on reasonable grounds or assists with such a report. An unsubstantiated concern is not, by itself, a knowingly false report.

Confidentiality and anonymity: confidential handling does not make email anonymous. The sender’s address and technical information may identify them. We do not guarantee the anonymity of email correspondence.

Scope of protection: accepting a wider range of ethical concerns does not mean that every concern constitutes a statutory whistleblower report. Statutory protection depends on the relevant legal conditions being met; this page does not replace a formal internal reporting procedure where one is required.

Under the conditions set out in the Polish Whistleblower Protection Act, an external report may be made to the Polish Commissioner for Human Rights or the competent public authority without first making an internal report.

Operational incidents: [email protected] is for reporting misconduct and ethical concerns, not round-the-clock fault response. Report urgent service-related events through the channel agreed for the project. Send general enquiries to [email protected].

AI can support work, but does not replace human accountability. At B2B Cyber, the use of AI tools, including generative AI, coding assistants and automation, requires assessment of the intended use, data and potential impact on clients and other people.

• Approval and accountability: the purpose, use-case owner, permitted data and access scope must be defined before use. Approved tools and material use cases must be recorded in an inventory proportionate to their scale and risk.
• Provider assessment: confidentiality, data retention and deletion, potential use of data for model training, processing locations and downstream providers must be assessed. The risk assessment principles in section 10 also apply.
• Information protection: personal data, confidential information and client code must not be shared with AI without an appropriate basis, authorisation and safeguards. Passwords, private keys and other active credentials must not be entered into prompts, attachments or model context.
• Output verification: the person using AI is responsible for checking facts, code security, rights to materials and discrimination risks. Generated test results, sources or assessments must not be presented as verified without supporting evidence.
• Oversight and limits: material actions on client systems require agreed authorisation and human oversight. AI must not independently expand access or make decisions with significant effects on individuals without a separate legal and organisational assessment and the required safeguards. Uses prohibited by law are not permitted.
• Transparency and competence: AI use must be disclosed as required by law, client agreements and the nature of the service. People using AI must receive guidance or training appropriate to their roles, tools and risks.
• Review and response: material changes to the model, provider terms, data or purpose require reassessment. Suspected unauthorised disclosure or harmful behaviour requires suspension of the risky use and notification to the appropriate responsible person.

In practice: approval of a tool for public materials does not authorise uploading client data or taking actions in client systems. Questions about a permitted use must be resolved before using AI.