Free Cybersecurity Templates

This document outlines a Private Information Removal Policy, detailing the process for requesting the removal of high-risk private information from a platform. It defines what constitutes private information and security risk, specifies appropriate and inappropriate removal requests, and explains the steps involved from investigation to resolution. The policy is designed for platforms hosting user-generated content, particularly software development communities.

This document outlines a Clean Desk Policy designed to enhance security and confidentiality within an organization. It details rules for properly securing or disposing of sensitive information and hardware at workstations when unoccupied, aiming to prevent unauthorized access and data loss. The policy applies to all staff and contractors, with non-compliance potentially leading to disciplinary action.

This document outlines a company's policy on personal data protection, detailing how personal data is collected, processed, stored, and secured. It emphasizes compliance with the EU General Data Protection Regulation (GDPR) and sets forth principles for data handling, employee obligations, and procedures for data breaches and inquiries. The policy also addresses the use of data processors and international data transfers.

This document is a Business Associate Agreement (BAA) designed to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) regulations concerning Protected Health Information (PHI). It outlines the specific obligations of a Provider (acting as a Business Associate or Subcontractor) and a Company (acting as a Business Associate or Covered Entity) regarding the use, disclosure, and safeguarding of PHI. The agreement incorporates standard terms and allows for customization through a key terms cover page.

This document outlines the Terms of Service for 37signals LLC's various online products, including Basecamp and HEY. It details user responsibilities, payment terms, account cancellation, modifications to services, data security, privacy, and intellectual property rights. By using these services, users agree to abide by these terms.

This document outlines a Clean Desk Policy designed to enhance security and confidentiality within an organization. It establishes rules for employees to secure sensitive information and hardware when leaving their workstations, aiming to prevent unauthorized access, loss, or damage. The policy applies to all staff and covers proper disposal of confidential paperwork, locking computer workstations, and securing devices.

This Investors' Rights Agreement outlines the key rights granted to investors in a company, primarily focusing on registration rights for their securities, information access, and the right to participate in future equity offerings. It also includes various post-closing covenants, corporate governance provisions, and compliance requirements for venture capital financings. The document is designed to be tailored to specific deal provisions. Cause such registration statement to become effective and, upon the request of the Holders of a majority of the Registrable Securities registered thereunder, keep such registration statement effective for a period of up to 120 days or, if earlier, until the distribution contemplated in the registration statement has been completed; provided, however, that (i) such 120-day period shall be extended for a period of time equal to the period the Holder refrains, at the request of an underwriter of Common Stock (or other securities) of the Company, from selling any securities included in such registration[, and (ii) in the case of any registration of Registrable Securities on Form S-3 that are intended to be offered on a continuous or delayed basis, subject to compliance with applicable SEC rules, such 120-day period shall be extended for up to an additional [90] days, if necessary, to keep the registration statement effective until all such Registrable Securities are sold]; prepare and file with the SEC such amendments and supplements to such registration statement, and the prospectus used in connection with such registration statement, as may be necessary to comply with the Securities Act in order to enable the disposition of all securities covered by such registration statement; furnish to the selling Holders such numbers of copies of a prospectus, including a preliminary prospectus, as required by the Securities Act, and such other documents as the Holders may reasonably request in order to facilitate their disposition of their Registrable Securities; use its commercially reasonable efforts to register and qualify the securities covered by such registration statement under such other securities or blue-sky laws of such jurisdictions as shall be reasonably requested by the selling Holders; provided that the Company shall not be required to qualify to do business or to file a general consent to service of process in any such states or jurisdictions,[^25] unless the Company is already subject to service in such jurisdiction and except as may be required by the Securities Act; in the event of any underwritten public offering, enter into and perform its obligations under an underwriting agreement, in usual and customary form, with the underwriter(s) of such offering; use its commercially reasonable efforts to cause all such Registrable Securities covered by such registration statement to be listed on a national securities exchange or trading system and each securities exchange and trading system (if any) on which similar securities issued by the Company are then listed; provide a transfer agent and registrar for all Registrable Securities registered pursuant to this Agreement and provide a CUSIP number for all such Registrable Securities, in each case not later than the effective date of such registration; promptly make available for inspection by the selling Holders, any [managing] underwriter(s) participating in any disposition pursuant to such registration statement, and any attorney or accountant or other agent retained by any such underwriter or selected by the selling Holders, all financial and other records, pertinent corporate documents, and properties of the Company, and cause the Company's officers, directors, employees, and independent accountants to supply all information reasonably requested by any such seller, underwriter, attorney, accountant, or agent, in each case, as necessary or advisable to verify the accuracy of the information in such registration statement and to conduct appropriate due diligence in connection therewith;[^26] notify each selling Holder, promptly after the Company receives notice thereof, of the time when such registration statement has been declared effective or a supplement to any prospectus forming a part of such registration statement has been filed; and after such registration statement becomes effective, notify each selling Holder of any request by the SEC that the Company amend or supplement such registration statement or prospectus. In addition, the Company shall ensure that, at all times after any registration statement covering a public offering of securities of the Company under the Securities Act shall have become effective, its insider trading policy shall provide that the Company's directors may implement a trading program under Rule 10b5-1 of the Exchange Act. Furnish Information. It shall be a condition precedent to the obligations of the Company to take any action pursuant to this Section with respect to the Registrable Securities of any selling Holder that such Holder shall furnish to the Company such information regarding itself, the Registrable Securities held by it, and the intended method of disposition of such securities as is reasonably required to effect the registration of such Holder's Registrable Securities. 2.4 Expenses of Registration. All expenses (other than Selling Expenses) incurred in connection with registrations, filings, or qualifications pursuant to Section, including all registration, filing, and qualification fees; printers' and accounting fees; fees and disbursements of counsel for the Company; and the reasonable fees and disbursements[, not to exceed $[50,000] [per registration],] of one counsel for the selling Holders [selected by Holders of a majority of the Registrable Securities to be registered] ("Selling Holder Counsel”), shall be borne and paid by the Company; provided, however, that the Company shall not be required to pay for any expenses of any registration proceeding begun pursuant to Section 1.2 if the registration request is subsequently withdrawn at the request of the Holders of a majority of the Registrable Securities to be registered (in which case all selling Holders shall bear such expenses pro rata based upon the number of Registrable Securities that were to be included in the withdrawn registration), unless the Holders of a majority of the Registrable Securities agree to forfeit their right to one registration pursuant to Sections 1.2(a) or 1.2(b), as the case may be; provided further that if, at the time of such withdrawal, the Holders shall have learned of a material adverse change in the condition, business, or prospects of the Company from that known to the Holders at the time of their request and have withdrawn the request with reasonable promptness after learning of such information then the Holders shall not be required to pay any of such expenses and shall not forfeit their right to one registration pursuant to Sections 1.2(a) or 1.2(b). All Selling Expenses relating to Registrable Securities registered pursuant to this Section [(other than fees and disbursements of counsel to any Holder, other than the Selling Holder Counsel, which shall be borne solely by the Holder engaging such counsel)] shall be borne and paid by the Holders pro rata on the basis of the number of Registrable Securities registered on their behalf. 2.5 Delay of Registration. No Holder shall have any right to obtain or seek an injunction restraining or otherwise delaying any registration pursuant to this Agreement as the result of any controversy that might arise with respect to the interpretation or implementation of this Section. 2.6 Indemnification.[^27] If any Registrable Securities are included in a registration statement under this Section [or in connection with a Direct Listing, as applicable]: (n) To the extent permitted by law, the Company will indemnify and hold harmless each selling Holder, and the partners, members, officers, directors, and stockholders of each such Holder; legal counsel and accountants for each such Holder; any underwriter (as defined in the Securities Act) for each such Holder; and each Person, if any, who controls such Holder or underwriter within the meaning of the Securities Act or the Exchange Act, against any Damages, and the Company will pay to each such Holder, underwriter, controlling Person, or other aforementioned Person any legal or other expenses reasonably incurred thereby in connection with investigating or defending any claim or proceeding from which Damages may result, as such expenses are incurred; provided, however, that the indemnity agreement contained in this Section 1.3(n) shall not apply to amounts paid in settlement of any such claim or proceeding if such settlement is effected without the consent of the Company, which consent shall not be unreasonably withheld, nor shall the Company be liable for any Damages to the extent that they arise out of or are based upon actions or omissions made in reliance upon and in conformity with written information furnished by or on behalf of any such Holder, underwriter, controlling Person, or other aforementioned Person expressly for use in connection with such registration [except to the extent such information has been corrected in a subsequent writing [at least one business day] prior to the sale of Registrable Securities to the Person asserting the claim]. (o) To the extent permitted by law, each selling Holder, severally and not jointly, will indemnify and hold harmless the Company, and each of its directors, each of its officers who has signed the registration statement, each Person (if any), who controls the Company within the meaning of the Securities Act, legal counsel and accountants for the Company, any underwriter (as defined in the Securities Act), any other Holder selling securities in such registration statement, and any controlling Person of any such underwriter or other Holder, against any Damages, in each case only to the extent that such Damages arise out of or are based upon actions or omissions made in reliance upon and in conformity with written information furnished by or on behalf of such selling Holder expressly for use in connection with such registration [and that has not been corrected in a subsequent writing [at least one business day] prior to the sale of Registrable Securities to the Person asserting the claim]; and each such selling Holder will pay to the Company and each other aforementioned Person any legal or other expenses reasonably incurred thereby in connection with investigating or defending any claim or proceeding from which Damages may result, as such expenses are incurred; provided, however, that the indemnity agreement contained in this Section 1.3(o) shall not apply to amounts paid in settlement of any such claim or proceeding if such settlement is effected without the consent of the Holder, which consent shall not be unreasonably withheld; and provided further that in no event shall the aggregate amounts payable by any Holder by way of indemnity or contribution under Sections 1.3(o) and 1.3(q) exceed the proceeds from the offering received by such Holder (net of any Selling Expenses paid by such Holder), except in the case of fraud or willful misconduct by such Holder. (p) Promptly after receipt by an indemnified party under this Section of notice of the commencement of any action (including any governmental action) for which a party may be entitled to indemnification hereunder, such indemnified party will, if a claim in respect thereof is to be made against any indemnifying party under this Section, give the indemnifying party notice of the commencement thereof. The indemnifying party shall have the right to participate in such action and, to the extent the indemnifying party so desires, participate jointly with any other indemnifying party to which notice has been given, and to assume the defense thereof with counsel mutually satisfactory to the parties; provided, however, that an indemnified party (together with all other indemnified parties that may be represented without conflict by one counsel) shall have the right to retain one separate counsel, with the fees and expenses to be paid by the indemnifying party, if representation of such indemnified party by the counsel retained by the indemnifying party would be inappropriate due to actual or potential differing interests between such indemnified party and any other party represented by such counsel in such action. [The failure to give notice to the indemnifying party within a reasonable time of the commencement of any such action shall relieve such indemnifying party of any liability to the indemnified party under this Section, [only] to the extent that such failure materially prejudices the indemnifying party's ability to defend such action. The failure to give notice to the indemnifying party will not relieve it of any liability that it may have to any indemnified party otherwise than under this Section.] (q) To provide for just and equitable contribution to joint liability under the Securities Act in any case in which either: (i) any party otherwise entitled to indemnification hereunder makes a claim for indemnification pursuant to this Section but it is judicially determined (by the entry of a final judgment or decree by a court of competent jurisdiction and the expiration of time to appeal or the denial of the last right of appeal) that such indemnification may not be enforced in such case, notwithstanding the fact that this Section provides for indemnification in such case, or (ii) contribution under the Securities Act may be required on the part of any party hereto for which indemnification is provided under this Section, then, and in each such case, such parties will contribute to the aggregate losses, claims, damages, liabilities, or expenses to which they may be subject (after contribution from others) in such proportion as is appropriate to reflect the relative fault of each of the indemnifying party and the indemnified party in connection with the statements, omissions, or other actions that resulted in such loss, claim, damage, liability, or expense, as well as to reflect any other relevant equitable considerations. The relative fault of the indemnifying party and of the indemnified party shall be determined by reference to, among other things, whether the untrue or allegedly untrue statement of a material fact, or the omission or alleged omission of a material fact, relates to information supplied by the indemnifying party or by the indemnified party and the parties' relative intent, knowledge, access to information, and opportunity to correct or prevent such statement or omission; provided, however, that, in any such case (x) no Holder will be required to contribute any amount in excess of the public offering price of all such Registrable Securities offered and sold by such Holder pursuant to such registration statement, and (y) no Person guilty of fraudulent misrepresentation (within the meaning of Section 11(f) of the Securities Act) will be entitled to contribution from any Person who was not guilty of such fraudulent misrepresentation; and provided further that in no event shall a Holder's liability pursuant to this Section 1.3(q), when combined with the amounts paid or payable by such Holder pursuant to Section 1.3(o), exceed the proceeds from the offering received by such Holder (net of any Selling Expenses paid by such Holder), except in the case of willful misconduct or fraud by such Holder. (r) [Notwithstanding the foregoing, to the extent that the provisions on indemnification and contribution contained in the underwriting agreement entered into in connection with the underwritten public offering are in conflict with the foregoing provisions, the provisions in the underwriting agreement shall control; provided, however, that any matter expressly provided for or addressed by the provisions of this Section 2.6 that is not expressly provided for or addressed by the underwriting agreement shall be controlled by the foregoing provisions.] (s) Unless otherwise superseded by an underwriting agreement entered into in connection with the underwritten public offering, the obligations of the Company and Holders under this Section shall survive the completion of any offering of Registrable Securities in a registration under this Section, and otherwise shall survive the termination of this Agreement or any provision(s) of this Agreement. 2.7 Reports Under Exchange Act. With a view to making available to the Holders the benefits of SEC Rule 144 and any other rule or regulation of the SEC that may at any time permit a Holder to sell securities of the Company to the public without registration or pursuant to a registration on Form S-3, the Company shall: (t) make and keep available adequate current public information, as those terms are understood and defined in SEC Rule 144, at all times after the effective date of the registration statement filed by the Company for the IPO[ or Direct Listing, as applicable]; (u) use commercially reasonable efforts to file with the SEC in a timely manner all reports and other documents required of the Company under the Securities Act and the Exchange Act (at any time after the Company has become subject to such reporting requirements); and (v) furnish to any Holder, so long as the Holder owns any Registrable Securities, forthwith upon request (i) to the extent accurate, a written statement by the Company that it has complied with the reporting requirements of SEC Rule 144 (at any time after 90 days after the effective date of the registration statement filed by the Company for the IPO[ or Direct Listing, as applicable]), the Securities Act, and the Exchange Act (at any time after the Company has become subject to such reporting requirements), or that it qualifies as a registrant whose securities may be resold pursuant to Form S-3 (at any time after the Company so qualifies); [(ii) a copy of the most recent annual or quarterly report of the Company and such other reports and documents so filed by the Company;[^28]] and (iii) such other information as may be reasonably requested in availing any Holder of any rule or regulation of the SEC that permits the selling of any such securities without registration (at any time after the Company has become subject to the reporting requirements under the Exchange Act) or pursuant to Form S-3 (at any time after the Company so qualifies to use such form). 2.8 Limitations on Subsequent Registration Rights. From and after the date of this Agreement, the Company shall not, without the prior written consent of the Holders of [specify percentage] of the Registrable Securities then outstanding, enter into any agreement with any holder or prospective holder of any securities of the Company that would (i) [provide to such holder or prospective holder the right to include securities in any registration on other than either a pro rata basis with respect to the Registrable Securities or on a subordinate basis after all Holders have had the opportunity to include in the registration and offering all shares of Registrable Securities that they wish to so include]/[allow such holder or prospective holder to include such securities in any registration unless, under the terms of such agreement, such holder or prospective holder may include such securities in any such registration only to the extent that the inclusion of such securities will not reduce the number of the Registrable Securities of the Holders that are included]; or (ii) allow such holder or prospective holder to initiate a demand for registration of any securities held by such holder or prospective holder; provided that this limitation shall not apply to Registrable Securities acquired by any additional Investor that becomes a party to this Agreement in accordance with Section .[^29] 2.9 “Market Stand-off” Agreement-[^30]. Each Holder hereby agrees that it will not, without the prior written consent of the managing underwriter, during the period commencing on the date of the final prospectus relating to the registration by the Company for its own behalf of shares of its Common Stock or any other equity securities under the Securities Act on a registration statement (other than an Excluded Registration) on Form S-1 [or Form S-3], and ending on the date specified by the Company and the managing underwriter (such period not to exceed 180 days in the case of the IPO [or 90 days in the case of any registration other than the IPO][^31] [or, if the Company is not then an emerging growth company as defined in the applicable SEC regulations, such other period as may be requested by the Company or an underwriter to accommodate regulatory restrictions on (1) the publication or other distribution of research reports and (2) analyst recommendations and opinions, including, but not limited to, the restrictions contained in applicable FINRA rules, or any successor provisions or amendments thereto)], (i) lend; offer; pledge; sell; contract to sell; sell any option or contract to purchase; purchase any option or contract to sell; grant any option, right, or warrant to purchase; or otherwise transfer or dispose of, directly or indirectly, any shares of Common Stock or any securities convertible into or exercisable or exchangeable (directly or indirectly) for Common Stock held immediately before the effective date of the registration statement for such offering[^32] or (ii) enter into any swap, hedging, or other transaction or arrangement that transfers, or is designed to transfer, to another, in whole or in part, any of the economic consequences of ownership, directly or indirectly, of such securities, whether or not any such transaction or arrangement described in clause (i) or (ii) above is to be settled by delivery of Common Stock or other securities, in cash, or otherwise. The foregoing provisions of this Section [shall apply only to the IPO,] shall not apply to the sale of any shares to an underwriter pursuant to an underwriting agreement [or to the establishment of a trading plan pursuant to Rule 10b5-1, provided that such plan does not permit transfers during the restricted period ], [or the transfer of any shares to any trust for the direct or indirect benefit of the Holder or the immediate family of the Holder, provided that the trustee of the trust agrees to be bound in writing by the restrictions set forth herein, and provided further that any such transfer shall not involve a disposition for value,] and shall be applicable to the Holders only if all officers and directors of the Company are subject to the same restrictions and the Company uses commercially reasonable efforts to obtain a similar agreement from all stockholders individually owning more than [1-3]% of the Company's outstanding Common Stock (after giving effect to the conversion into Common Stock of all outstanding Preferred Stock). The underwriters in connection with such registration are intended third-party beneficiaries of this Section and shall have the right, power and authority to enforce the provisions hereof as though they were a party hereto. Each Holder further agrees to execute such agreements as may be reasonably requested by the underwriters in connection with such registration that are consistent with this Section or that are necessary to give further effect thereto. [Any discretionary waiver or termination of the restrictions of any or all of such agreements by the Company or the underwriters shall apply pro rata to all Company stockholders that are subject to such agreements, based on the number of shares subject to such agreements[, except that, notwithstanding the foregoing, the Company and the underwriters may, in their sole discretion, waive or terminate these restrictions with respect to up to [_] shares of the Common Stock].][^33] 1.1 Restrictions on Transfer.[^34] The Preferred Stock and the Registrable Securities shall not be sold, pledged, or otherwise transferred, and the Company shall not recognize and shall issue stop-transfer instructions to its transfer agent with respect to any such sale, pledge, or transfer, except upon the conditions specified in this Agreement, which conditions are intended to ensure compliance with the provisions of the Securities Act and all other applicable U.S. laws and regulations. A transferring Holder will cause any proposed purchaser, pledgee, or transferee of the Preferred Stock and the Registrable Securities held by such Holder to agree to take and hold such securities subject to the provisions and upon the conditions specified in this Agreement. [Notwithstanding the foregoing, the Company shall not require any transferee of shares pursuant to an effective registration statement or, following the IPO [or Direct Listing, as applicable,] SEC Rule 144, in each case, to be bound by the terms of this Section 1.1.] (W) Each certificate, instrument, or book entry representing (i) the Preferred Stock, (ii) the Registrable Securities, and (iii) any other securities issued in respect of the securities referenced in clauses (i) and (ii), upon any stock split, stock dividend, recapitalization, merger, consolidation, or similar event, shall (unless otherwise permitted by the provisions of Section 1.3(y)) be notated with a legend substantially in the following form: THE SECURITIES REPRESENTED HEREBY HAVE BEEN ACQUIRED FOR INVESTMENT AND HAVE NOT BEEN REGISTERED UNDER THE SECURITIES ACT OF 1933. SUCH SHARES MAY NOT BE SOLD, PLEDGED, OR TRANSFERRED IN THE ABSENCE OF SUCH REGISTRATION OR A VALID EXEMPTION FROM THE REGISTRATION AND PROSPECTUS DELIVERY REQUIREMENTS OF SAID ACT. THE SECURITIES REPRESENTED HEREBY MAY BE TRANSFERRED ONLY IN ACCORDANCE WITH THE TERMS OF AN AGREEMENT BETWEEN THE COMPANY AND THE STOCKHOLDER, A COPY OF WHICH IS ON FILE WITH THE SECRETARY OF THE COMPANY. The Holders consent to the Company making a notation in its records and giving instructions to any transfer agent of the Restricted Securities in order to implement the restrictions on transfer set forth in this Section 1.1. (x) The holder of such Restricted Securities, by acceptance of ownership thereof, agrees to comply in all respects with the provisions of this Section. Before any proposed sale, pledge, or transfer of any Restricted Securities, unless there is in effect a registration statement under the Securities Act covering the proposed transaction [or following the IPO [or Direct Listing, as applicable], the transfer is made pursuant to SEC Rule 144], the Holder thereof shall give notice to the Company of such Holder's intention to effect such sale, pledge, or transfer[, provided that no such notice shall be required in connection if the intended sale, pledge or transfer complies with SEC Rule 144]. Each such notice shall describe the manner and circumstances of the proposed sale, pledge, or transfer in sufficient detail and, if reasonably requested by the Company, shall be accompanied at such Holder's expense by either (i) a written opinion of legal counsel who shall, and whose legal opinion shall, be reasonably satisfactory to the Company, addressed to the Company, to the effect that the proposed transaction may be effected without registration under the Securities Act; (ii) a “no action” letter from the SEC to the effect that the proposed sale, pledge, or transfer of such Restricted Securities without registration will not result in a recommendation by the staff of the SEC that action be taken with respect thereto; or (iii) any other evidence reasonably satisfactory to counsel to the Company to the effect that the proposed sale, pledge, or transfer of the Restricted Securities may be effected without registration under the Securities Act, whereupon the Holder of such Restricted Securities shall be entitled to sell, pledge, or transfer such Restricted Securities in accordance with the terms of the notice given by the Holder to the Company. The Company will not require such a notice, legal opinion or

This document outlines GitHub's policy and process for requesting the removal of private information from its platform. It defines what constitutes "private information" for removal purposes, focusing on high-risk content like exposed access credentials that pose a specific security threat. The policy details the steps involved, from submitting a request with specific links and line numbers to GitHub's review, user notification, and dispute resolution.

This template provides a privacy policy designed for companies that collect, handle, and process customer data, particularly those operating under the General Data Protection Regulation (GDPR) in the European Union, with specific suitability for Portugal. It details how personal information is collected, used, shared, and stored, and outlines the data subject's rights under GDPR.

This document outlines GitHub's policy and process for removing private, high-risk information, such as exposed access credentials or sensitive personal data, from its repositories. It details what qualifies as "private information" and guides users on how to submit a removal request, including the necessary information and the steps GitHub will take. The policy also clarifies what types of content are not covered by this specific removal process.