Code of Conduct and Acceptable Use Policy

Document owner: Oscar Ramos
Approved by: Eli Johnson, Product Manager
Version: 1.0
Approved date: 9/21/2026
Next review: 9/21/2027
Applies to: Founders, Co-Founders, Designers, Head of Education Partnerships, and Software Developers

This document has two parts. Part A — Code of Conduct is about how we treat people. Part B — Acceptable Use is about how we treat company software and data. Together they set the ethical and practical baseline for working at Ladderly Learning, and they anchor our SOC 2 control environment and our FERPA duty to handle student data responsibly.

Part A — Code of Conduct (how we treat people)

A1. Our commitment

Ladderly Learning serves students, families, and schools. That means we hold ourselves to a high standard of integrity and care. We expect everyone here to act honestly, treat others with respect, and put the trust placed in us — especially with children’s data — above short-term convenience.

A2. Respect and inclusion

Treat colleagues, customers, and partners with respect and professionalism.
We do not tolerate harassment, discrimination, bullying, or retaliation of any kind, including on the basis of race, color, national origin, sex, gender identity, sexual orientation, religion, age, disability, or any legally protected characteristic.
Maintain a safe, inclusive environment in person and online (email, chat, video, social media when identifiable with the company).

A3. Integrity and honesty

Be truthful in your work, records, and communications.
Don’t misrepresent the company, our product, or our security/privacy practices to customers.
Deliver on the commitments we make to schools about how their students’ data is handled.

A4. Conflicts of interest

Avoid situations where personal interests conflict with the company’s or a customer’s. Disclose potential conflicts (outside work, financial interests, personal relationships in the reporting chain) to Data Privacy Lead.

A5. Protecting those we serve

Never access, view, or use student data out of curiosity or for any purpose other than your legitimate job duties.
Never share student or customer information with anyone who isn’t authorized to have it — inside or outside the company.
If something about how data is being handled feels wrong, raise it.

A6. Compliance with laws and policies

Follow the law and company policies, including FERPA and applicable student-privacy laws, the Information Security and Access Control policies, and the Acceptable Use rules below.

A7. Speaking up (and no retaliation)

If you see misconduct, a security or privacy concern, or anything unethical, report it to J Hathaway.

A8. Consequences

Violations of this Code may result in disciplinary action up to and including termination, and referral to authorities where laws are broken.

Part B — Acceptable Use Policy (how we treat company software and data)

B1. Purpose and scope

This defines acceptable use of Ladderly Learning’s systems, devices, networks, accounts, and data. It applies to all company-managed and personal devices used for work, and all company accounts and services.

B2. General use

Company systems are provided for business purposes. Limited, reasonable personal use is permitted only if it doesn’t interfere with work, security, or these policies.
You are responsible for activity under your accounts. Keep credentials secret; never share passwords; use a password manager and MFA.
Don’t attempt to bypass security controls, escalate your own privileges, or access data or systems you aren’t authorized to use.

B3. Protecting data (especially student data)

Access student and customer data only when your job requires it, and use it only for its authorized purpose. No browsing out of curiosity.
Keep Restricted and Confidential data in approved company systems only. Do not copy it to personal email, personal cloud storage, personal devices, USB drives, or unapproved third-party tools (including unapproved AI/chatbot tools).
Don’t export, download, or screenshot student data unless required for your job, and delete local copies when done (see Data Retention & Disposal Policy).
Encrypt data when required; lock your screen when you step away; don’t leave devices or printouts with sensitive data unattended.

B4. Devices and networks

Keep your devices updated, encrypted, and running required security software; don’t disable security controls.
Don’t install unapproved or pirated software. Get new SaaS tools approved before putting company or student data in them.
Avoid conducting sensitive work over untrusted public Wi-Fi without VPN; report lost or stolen devices immediately.

B5. Email, messaging, and phishing

Be alert to phishing; verify unexpected requests for credentials, money, or data through a second channel.
Don’t send Restricted data to the wrong recipients — double-check addresses on anything containing student data.
Report suspected phishing or suspicious messages.

B6. Prohibited uses

The following are not allowed on company systems:

Illegal activity, or accessing/storing/sharing unlawful, harassing, or explicit material.
Unauthorized access to data or systems; sharing accounts; disabling security controls.
Moving student/customer data to unapproved locations or tools.
Using company resources to run a personal business or for significant personal gain.
Introducing malware or knowingly creating security risks.