Rulebook

Here's a practical remote work policy framework for a 30-person startup:

1. Work Schedule & Availability:

• Core collaboration hours: 10 AM - 3 PM in your primary timezone (allows flexibility on start/end times)
• Respond to messages within 2 hours during core hours
• Block focus time on your calendar — it's respected, not questioned
• Update your Slack status when unavailable for more than 30 minutes

2. Communication Standards:

• Default to async (Slack, Notion) for non-urgent items
• Meetings require an agenda shared 24 hours in advance — no agenda, no meeting
• Cameras on for team meetings and 1:1s (optional for large all-hands)
• Weekly team sync: 30 min max, standup format

3. Equipment & Workspace:

• Company provides: laptop, monitor, keyboard, mouse, headset
• $500 one-time home office setup stipend
• $50/month internet stipend
• Co-working space: reimbursed up to $200/month with manager approval

4. Security Requirements:

• Use company VPN when accessing internal systems
• No work on public Wi-Fi without VPN
• Lock screen when stepping away
• No company data on personal devices

5. In-Person Expectations:

• Quarterly team offsites (company-funded, 3 days)
• Optional monthly local meetups for those in the same city

Want me to expand any section or add policies for time-off, expense reporting, or performance evaluation?

Here's a data retention policy tailored for a SaaS product:

1. Customer Account Data:

• Active accounts: retained for the lifetime of the account
• After account deletion request: personal data purged within 30 days
• Anonymized usage analytics: retained indefinitely (no PII)
• Backups containing deleted user data: purged within 90 days (next backup rotation cycle)

2. Application Logs:

• Access logs (who logged in, from where): 12 months, then auto-deleted
• Error logs: 6 months (sufficient for debugging, reduces storage costs)
• Audit logs (permission changes, data exports, admin actions): 3 years (compliance requirement)

3. Payment Data:

• Transaction records: 7 years (tax and financial compliance)
• Credit card numbers: never stored — handled entirely by payment processor (Stripe)
• Invoices and receipts: 7 years

4. Communication Data:

• Support tickets: 2 years after resolution, then anonymized
• Email communications: 1 year, then auto-archived
• In-app messages: retained while account is active, deleted with account

5. Data Disposal Methods:

• Database records: hard delete with verification query
• File storage (S3/GCS): delete objects + verify bucket lifecycle rules
• Backups: encrypted, auto-expire based on retention schedule
• Physical media (if any): NIST 800-88 compliant destruction

6. Compliance Mapping:

• GDPR: 30-day deletion window satisfies right-to-erasure
• SOC 2: audit logs at 3 years meets Trust Services Criteria
• CCPA: deletion request process documented above

This should be reviewed annually. Want me to draft the employee-facing summary version?