Cloud and App Use Policy
Every new app, browser extension or online tool is one more place where company or client data can leak. This policy stops “shadow IT”, meaning tools that people start using for work without the IT team knowing, while making it easy to get the tools you actually need.
Document
Policy number
TSS-IT-07
Version
1.0
Effective from
1 September 2026
Next review
March 2027
Owner
IT Team
Approved by
Board of Directors
Applies to
Every employee, trainee and intern, and anyone else who uses an app, cloud service, browser extension, plugin or AI tool for TSS work.
Issued by
Thakur Systems & Structures Private Limited, CIN U62011PN2026PTC254650
Related policies
Acceptable Use Policy (TSS-IT-01), Information Security Policy (TSS-IT-02), Data Privacy and Management Policy (TSS-IT-04), Software Development and Change Management Policy (TSS-IT-10), Expense Reimbursement Policy (TSS-HR-07)
1. THE RULES
Use only the apps, cloud services, browser extensions, plugins and AI tools on the approved list for company work.
Sign in to them with your company account, never a personal one.
Never keep company or client data in personal accounts, such as a personal Google Drive, Dropbox, OneDrive or iCloud, personal email, a personal GitHub account, WhatsApp or Telegram.
Do not sign up for free trials or new tools with company data unless they have been approved.
Do not connect third-party apps to company accounts, for example through “Sign in with Google”, app permissions or repository integrations, unless they have been approved.
Client projects may have their own approved tools. For a client’s data, the client’s rules come first.
2. THE APPROVED LIST
The IT team keeps a list of approved tools, what each one may be used for, and what level of data may go into it (Information Security Policy, section 2). You will get the current list at induction, and the IT team keeps it up to date. It covers these areas:
| AREA | APPROVED FOR |
|---|---|
| Workspace: email, calendar, documents and storage | All company work |
| Code hosting, builds and deployments | Source code, builds and releases |
| Password manager | All work passwords and shared credentials |
| Project management | Tasks, planning and notes, but not Restricted data |
| Chat and video calls | Internal and client communication |
| AI coding assistants and AI chat tools | Development and writing work, within the rules in section 3 |
3. AI TOOLS
Use only AI tools on the approved list, on company-paid plans where our data is not used to train the provider’s models.
Confidential data, including client source code, may go only into AI tools that are approved for it. Restricted data, such as secrets, credentials, personal data and production data, must never go into any AI tool.
Check the client’s contract. Some clients do not allow their code to be used with AI tools at all, or only with particular tools. Their rules come first.
Review everything an AI tool produces before you use it (Software Development and Change Management Policy).
4. ASKING FOR A NEW TOOL
- Send the IT team the tool’s name, what you need it for, what data will go into it, and what it costs.
- The IT team checks its security (sign-in with company accounts, MFA, encryption), where it stores data, the provider’s terms and privacy policy, whether it trains on customer data, DPDP Act requirements, and any client contract restrictions.
- The IT team approves it, approves it with limits, or suggests an alternative, normally within five working days.
- Paid tools also need budget approval from a Director.
- Approved tools are added to the list and set up on company accounts.
5. BROWSER EXTENSIONS
Extensions can often read everything on the pages you visit, including code and passwords. Install only extensions that are on the approved list. The IT team may block others.
6. RETIRING TOOLS, AND PEOPLE LEAVING
When a tool is no longer needed, the IT team exports any company data from it, deletes the account and cancels the subscription. When someone leaves TSS, their access to every tool is removed on their last working day (Access Control Policy).
7. IF YOU ARE ALREADY USING AN UNAPPROVED TOOL
Tell the IT team. We will help you move to an approved tool, or get the one you use approved. Owning up is fine; we would rather know. Carrying on with an unapproved tool after being told is a breach of this policy.