Effective Date: October 15, 2026 Version: 1.0 Applies to: All Company employees.
Article 1: Introduction and Scope
1.1 This document states the controls that govern how an Employee proves the Employee's identity to a Company System: how credentials are issued and kept, how sessions begin and end, what an Employee shall do on a shared device, and what happens when a credential or a session is compromised. Authentication is the act on which every permission check, every audit record, and every accountability duty in the internal employee-policy set depends.
1.2 This document governs sign-in to the employee portal, the admin portal, and every other Company System, by every Employee, on Company devices and on devices the Company permits. The platform-level rules for accounts generally are stated in the Account Registration and Security Policy and the Information Security Policy; this document states the duties of Employees.
1.3 If a provision of this document conflicts with the Terms of Use, this document controls for the subject it governs. If a provision conflicts with the terms of a program in which the Employee participates, the program terms control for that program. Help pages explain this document; they do not amend it.
Article 2: Definitions
2.1 The definitions in the Employee Code of Conduct are incorporated into this document by reference. This article defines only the additional terms used in this document, in alphabetical order.
2.2 Credential: the means by which an Employee authenticates to a Company System, including a password, a passkey, an authentication application or code, and any token the Company issues for that purpose.
2.3 Session: the period of authenticated use of a Company System that begins when an Employee signs in and ends when the Employee signs out or the session expires.
Article 3: Individual Credentials
3.1 A Credential is issued to an individual Employee and is tied to that Employee's identity and staff record. An Employee signs in only with the Employee's own Credential, only into the Employee's own Account, and only in the role that Account carries. An Employee who holds more than one Account shall sign in under the Account that matches the work being performed; work performed under the wrong Account is recorded against the wrong identity and violates this document where the Employee knew or could have known of the mismatch.
3.2 The Employee shall not share a Credential with any person, shall not disclose a password or a code, shall not sign in so that another person may act, and shall not act under another person's Credential or Session. A shared login is prohibited without exception: where two persons act under one identity, no act can be attributed, and every record made under that identity is unreliable. Where another person needs access, that person is issued a Credential and, where a Module is involved, a Grant under the Data Access and Least Privilege Policy.
3.3 The Employee shall keep a Credential secret, shall not write a password on or near a device, shall not store a password in a personal note or application the Company has not approved for that purpose, and shall use a password for Company Systems that the Employee does not use for a personal account.
3.4 Where the Company provides an additional verification step, including a code sent to or generated by a device the Employee holds, the Employee shall complete the step when it is presented and shall not approve a verification the Employee did not initiate. An unexpected verification prompt is treated as a suspected compromise under Article 6.
Article 4: Sessions and Shared Devices
4.1 A Session belongs to the Employee who signed in. Every act taken in a Session is recorded against that Employee's identity, and the Employee is accountable for acts taken in the Employee's Session except where the Employee reported a compromise promptly under Article 6 and the acts followed the compromise.
4.2 The Employee shall sign out at the end of the Employee's shift, at the end of work on a shared register, terminal, or back-office computer, and whenever such a device is left unattended. On a shared device, sign-out is completed only when the sign-out process has finished; an Employee who leaves while a Session remains open leaves the Employee's identity available to the next user and violates this document. The Employee shall not use a Session another person left open, and shall sign out a Session the Employee finds open on a shared device and report the event to the Manager where the Session was not the Employee's own.
4.3 The Employee's Grants under the Data Access and Least Privilege Policy are tied to the Employee's identity and are exercised only within the Employee's own Session; a Grant confers no access outside a Session and ends with the Session for the purposes of use, and every Grant ends with the employment as that policy and the Termination and Offboarding Policy state.
4.4 A Session that the Company System cannot verify against a current staff record does not open the portal. Where a sign-in succeeds but no staff record is linked to the identity, the Employee shall report the event to the Manager, who links the record on the admin side; the Employee shall not attempt to work through another person's Account in the meantime.
Article 5: Password Changes, Recovery, and Deactivation
5.1 The Employee shall change a password when the Company requires it, when the Employee suspects the password is known to another person, and on the direction of a Manager given for a security reason. A changed password shall be a new password, not a password previously used for a Company System.
5.2 There is no self-service password reset at the employee portal sign-in door. Recovery of access is made through the recovery process the Employee's Manager issues. An Employee who is locked out, whose Credential has stopped working, or whose Session repeatedly fails shall report the event to the Manager and shall not attempt repeated sign-ins with credentials the Employee is unsure of, and shall not use another person's Account while recovery is pending.
5.3 The Company may deactivate a Credential, end a Session, and require re-authentication at any time, including where a staff record is deactivated, where a Grant is withdrawn, where a compromise is suspected, and where the employment ends. Deactivation at the end of employment is governed by the Termination and Offboarding Policy.
Article 6: Compromise and Reporting
6.1 The Employee shall report immediately to the Manager, and in accordance with the Incident Response Policy, every suspected compromise: a password disclosed or observed, a device holding a Session lost or taken, a verification prompt the Employee did not initiate, a sign-in the Employee does not recognize, and any request by any person for the Employee's Credential, including a request that appears to come from the Company.
6.2 The Company does not request a password or a verification code by telephone, message, or email. An Employee who receives such a request shall not comply with it and shall report it under clause 6.1.
6.3 On a report under this article, the Company may end every Session of the Employee, reset the Credential, and review the audit log for acts taken under the Employee's identity, in accordance with the Record Keeping and Audit Policy. Prompt reporting is a mitigating fact in any enforcement under this document; a failure to report a known compromise is an independent violation.
Article 7: Liability
7.1 The Employee is responsible for the Employee's own conduct and shall bear the loss that the Employee's violation of this document causes, to the extent permitted by applicable law. Nothing in this document makes the Company responsible for a loss caused by an act taken in violation of this document or outside the scope of employment.
7.2 To the fullest extent permitted by law, neither party is liable to the other for indirect, incidental, special, punitive, or consequential damages, or for lost profits, lost revenue, or loss of goodwill, arising out of or relating to this document, even if the party has been advised of the possibility of those damages.
7.3 To the fullest extent permitted by law, the Company's total liability arising out of or relating to this document shall not exceed one hundred dollars ($100). This clause does not limit (a) wages, commissions, benefits, or other compensation owed under applicable law or a written agreement; (b) indemnification obligations under this document; (c) liability for fraud or willful misconduct; or (d) liability that cannot be limited under applicable law.
7.4 The parties agree that this article allocates risk between them, that it is an essential part of the basis of their bargain, and that it applies even if a limited remedy fails of its essential purpose.
Article 8: Indemnification
8.1 The Company shall indemnify, defend, and hold harmless the Employee from and against a claim, loss, liability, judgment, settlement, cost, and expense (including reasonable attorneys' fees) brought by a third party and arising out of an act the Employee took within the scope of employment and in compliance with this document and applicable law.
8.2 The Company does not indemnify an Employee for the Employee's own unlawful acts. No indemnification is owed under this article for a claim arising out of (a) the Employee's willful misconduct or fraud; (b) an act outside the scope of employment; or (c) an act taken in violation of this document, including an act taken under another person's Credential or Session.
8.3 The Employee shall indemnify, defend, and hold harmless the Company and its members, managers, employees, and agents from and against every claim, loss, liability, judgment, settlement, cost, and expense (including reasonable attorneys' fees) arising out of (a) the Employee's breach of this document; (b) the Employee's violation of any law or of the rights of any person; and (c) an act outside the scope of employment.
8.4 The party seeking indemnification shall give prompt written notice of a claim under this article. The indemnifying party shall control the defense with counsel reasonably acceptable to the other party; the indemnified party may participate at its own expense. The indemnifying party shall not settle a claim in a manner that imposes an obligation on the other party, or that does not release the other party fully, without the other party's prior written consent. This article survives the end of employment.
Article 9: Enforcement and Appeals
9.1 The Company may investigate any suspected violation of this document, including by review of sign-in and audit records. The Employee shall cooperate with an investigation and shall produce the records this document requires the Employee to keep.
9.2 If the Company determines that the Employee has violated this document, the Company shall give written notice stating the provision violated and the facts relied on, except where notice would compromise an investigation of fraud, a safety risk, or a legal obligation. The Employee may submit a written response within ten (10) business days, and the person deciding the matter shall consider the response before a measure is imposed. Where a violation is capable of cure, the Employee has ten (10) business days from notice to cure it and to confirm the cure in writing; no cure period applies to fraud, a safety risk, unlawful conduct, credential sharing, or a violation that cannot be cured.
9.3 If a violation is established, the Company may, proportionate to the violation: (a) issue a written warning; (b) require retraining; (c) restrict or withdraw access or a Grant, and reset or deactivate a Credential; (d) place the Employee on a written improvement plan; (e) suspend the Employee's employment; (f) terminate the Employee's employment; and (g) exercise any other right or remedy available at law. Sharing a Credential, and acting under another person's Credential or Session, are serious violations for the purposes of this article.
9.4 The Employee may appeal a measure under this article by written notice to the Employee's Manager within thirty (30) days of the measure, stating the grounds and attaching the records relied on. Where the Manager made the decision appealed from, the appeal is made to the Manager's manager. The appeal is decided by a person who did not make the original decision, and the Company's decision on appeal is final. A measure remains in effect during an appeal unless the Company directs otherwise in writing.
9.5 No measure under this article may be imposed in retaliation for a report made in good faith under the Whistleblower and Internal Reporting Policy or for the exercise of a right protected by applicable law. The Company's delay in acting on a violation is not a waiver of the violation or of any later violation of the same kind.
Article 10: Term and Termination
10.1 This document applies from the commencement of employment until the employment ends for any reason. A Credential terminates with the employment, without further act, and no Session survives separation.
10.2 On the end of employment, Articles 7, 8, 9 (for measures taken before the employment ended), 11, and 12 survive. The end of employment and of access is governed by the Termination and Offboarding Policy.
Article 11: Dispute Resolution
11.1 Any dispute arising out of or relating to this document, or to the relationship it governs, is governed by the Dispute Resolution Policy, which is incorporated into this document by reference.
11.2 Nothing in this document limits an Employee's right to file a charge or complaint with a government agency, to participate in an agency proceeding, or to engage in concerted activity protected by applicable law, and no provision of this document requires the Employee to give notice of, or to obtain consent to, the exercise of such a right.
Article 12: General Provisions
12.1 The Company may amend this document by posting the amended document in the Document Center and giving notice to the Employee at the email address in the Employee's employment record. An amendment that materially increases the Employee's obligations takes effect thirty (30) days after notice; other amendments take effect on posting.
12.2 Legal notices under this document shall be sent to legal@aapawz.com; operational notices and all other communications shall be sent to support@aapawz.com. A notice to the Company is effective when the Company acknowledges receipt or, for email, one business day after sending, whichever is earlier. Notices to the Employee are effective when sent to the email address in the Employee's employment record or posted in the employee portal, whichever occurs first. The Employee shall keep that email address current. Notices under the DMCA and Copyright Policy are given as provided in that policy, to the designated agent at legal@aapawz.com.
12.3 This document is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws rules. Subject to the Dispute Resolution Policy, any proceeding arising out of this document shall be brought in the state or federal courts located in Shelby County, Tennessee, and the parties consent to personal jurisdiction there.
12.4 If any provision of this document is held unenforceable, the provision shall be enforced to the fullest extent permitted, and the remaining provisions continue in full effect.
12.5 This document, together with the documents it incorporates by reference, is the entire agreement between the Company and the Employee for the subject it governs and supersedes every prior statement or agreement on that subject. This clause does not supersede an offer letter or a written employment agreement signed by the Company.
12.6 The Employee shall not assign this document or any right or obligation under it, and an assignment without the Company's prior written consent is void. The Company may assign this document to an affiliate or in connection with a sale of all or part of its business, on notice to the Employee. A waiver of any provision of this document is effective only in writing and only for the instance stated; no waiver is a waiver of any other provision or instance.
12.7 Headings are for convenience only. "Including" means "including without limitation." This document shall not be construed against a party on the ground that the party prepared this document. The English-language text controls over any translation.
Related articles