Purpose
This policy defines the acceptable and secure use of email and instant messaging systems at Carriyo. It establishes controls to protect against data leakage, phishing, social engineering, and other threats transmitted through electronic communications.
Scope
This policy applies to all Carriyo employees, contractors, and third-party personnel who use Carriyo-provided email (Google Workspace) and messaging platforms (Slack) in the course of their duties.
Policy Statements
Email Usage
- Carriyo email accounts are provided primarily for business communication. Limited personal use is permitted provided it does not violate this policy or interfere with work duties.
- Employees must use their Carriyo email address (@carriyo.com) for all work-related correspondence. Personal email accounts must not be used for business communications.
- Auto-forwarding of Carriyo email to external email addresses is prohibited.
- Email signatures must conform to the approved Carriyo format and must not contain misleading information.
Instant Messaging Usage
- Slack is Carriyo's approved instant messaging platform. Business discussions and decisions should be conducted through official Slack channels where practical.
- Sensitive or confidential discussions that require a record should use appropriate private channels with restricted membership.
- The use of unapproved messaging platforms (WhatsApp, Telegram, personal Discord) for transmitting company data is prohibited.
Data Classification in Communications
- Restricted data (credentials, encryption keys, API secrets) must never be transmitted via email or instant messaging. Use approved secrets management tools instead.
- Confidential data (customer data, PII, financial information) may only be shared via email when encrypted or when transmitted within the Google Workspace environment between Carriyo accounts. External sharing of confidential data via email requires encryption or approved secure file-sharing links.
- Attachments containing confidential data must be password-protected or shared via approved secure channels (e.g., Google Drive with restricted access).
Phishing and Social Engineering Defence
- Employees must exercise caution with all incoming email, particularly messages containing links, attachments, or requests for sensitive information.
- Suspicious emails must be reported immediately to the security team using the designated reporting mechanism.
- Employees must not click on links or open attachments from unknown or untrusted senders.
- The security team conducts periodic phishing simulation exercises to assess and improve employee awareness.
Email Security Controls
- Google Workspace advanced phishing and malware protection is enabled for all Carriyo accounts.
- SPF, DKIM, and DMARC records are configured and maintained for the carriyo.com domain to prevent email spoofing.
- Inbound email attachments are scanned for malware before delivery.
- Google Workspace external-sharing restrictions and access logging are applied to limit the transmission of sensitive data via email; no dedicated Data Loss Prevention (DLP) product is operated.
Retention and Archival
- Business email is retained in accordance with Carriyo's data retention schedule.
- Employees should not delete emails that may be relevant to legal, regulatory, or compliance obligations.
- Slack message retention is configured centrally and managed by the security team.
Roles and Responsibilities
| Role | Responsibility |
|---|---|
| Security Team | Configure and maintain email security controls; conduct phishing simulations; investigate email incidents |
| IT Administration | Manage Google Workspace and Slack settings; enforce external-sharing restrictions; manage retention policies |
| All Employees | Follow email and messaging security practices; report phishing; protect classified data in communications |
| CISO | Approve policy; oversee communications security strategy |
Compliance and Enforcement
Compliance is monitored through email security logs, Google Workspace access logs, and the results of the internally run annual phishing exercise (no phishing simulation platform is operated). Employees who repeatedly fail phishing simulations are required to complete additional security awareness training. Deliberate violations of this policy, including intentional data leakage via email or messaging, may result in disciplinary action up to and including termination.