Staff handbook for a software company

A software company's handbook is read by its customers' security teams and its investors' lawyers as well as its staff: the information security policies a customer audit asks for, the intellectual property and open source rules an acquirer checks, the access and leaver procedures a security certification requires. It also has to work for an engineering team that is remote, on call and paid partly in options. I draft that handbook for the company for a fixed fee of £995, delivered in five working days.

Who this is for

Software, SaaS, app and technology companies in England and Wales employing engineers, product, sales and operations staff, from a start-up preparing for its first security questionnaire to an established team.

What matters in a software company handbook

Information security and the policies a customer audit expects

Customer security questionnaires and certifications ask for an information security policy, an acceptable use policy, access control, password and multi-factor authentication rules, secure development practices, data classification and handling, incident response and breach reporting under the UK GDPR, and evidence that staff have read and been trained on them; the handbook should contain the staff-facing versions of each, written so that engineers follow them and auditors recognise them, with breaches treated as disciplinary matters and the technical standards in separate documents the policies refer to.

Intellectual property, open source and side projects

The handbook should state that code and other work created in the course of employment belong to the company under section 11 of the Copyright, Designs and Patents Act 1988 and inventions under section 39 of the Patents Act 1977, set the open source policy (approved licences, the approval process for new dependencies, the rules for contributing to open source projects in the company's time or using its code), the side project policy (disclosure, no competing or related projects, no use of company resources), and the handling of prior work and third-party code; an acquirer's lawyers ask for the policy and the records, and the handbook is where it lives.

Remote and hybrid working for an engineering team

The handbook should contain the homeworking and hybrid policy (the pattern, equipment, expenses, the home workstation assessment under the Health and Safety (Display Screen Equipment) Regulations 1992 and the employer's duties under the Health and Safety at Work etc. Act 1974, security at home), the working abroad policy (consent required, the tax, immigration and data protection reasons, short permitted periods), the communication norms (core hours, response expectations, meeting-free time) and the policy on monitoring and its privacy notice; a distributed engineering team with no written norms drifts, and the handbook sets them.

Bring your own device, access and leavers

The handbook should set the bring your own device policy (which devices may access what, the management software the company requires, the company's right to wipe its data, the separation of personal and company data), the access policy (least privilege, access requests and reviews, no shared credentials), and the leaver procedure (access removed on the last day or at the start of garden leave, devices and repositories returned, the exit checklist), because a leaver who retains access to production is the finding every security audit reports and the handbook is the control.

On-call, incidents and working time

The handbook should set the on-call policy (the rota, the compensation or time off, the response expectations, the escalation), the incident response process and the post-incident review, and the working time rules: on-call time at a place the employer requires counts as working time under the Working Time Regulations 1998, rest periods and compensatory rest apply, and the forty-eight hour opt-out must be signed separately and freely; an engineering team paged at night without a policy is a working time claim and a retention problem.

Equity, options and the policies that refer to them

Where staff hold options or shares, the handbook should explain in general terms how the scheme works (the Enterprise Management Incentives scheme in Schedule 5 to the Income Tax (Earnings and Pensions) Act 2003 where the company qualifies), refer to the option agreements and scheme rules as the governing documents, state the leaver provisions in outline, and say that the handbook gives no rights to equity, alongside the core policies (disciplinary and grievance under the Acas Code, equal opportunities and the duty to prevent sexual harassment under the Worker Protection (Amendment of Equality Act 2010) Act 2023, sickness, holiday, flexible working under section 80F of the Employment Rights Act 1996, family leave with the Employment Rights Act 2025 changes on the timetable the regulations set, expenses, data protection), non-contractual and acknowledged on issue with the records a certification needs.

What it costs

Staff handbook and core policies, £995. Five working days.

Employment contract, £595. One template you can reuse for a grade of staff. Five working days.

Buying online forms the engagement on payment. The scope is what the employment contracts and handbooks page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how you employ people
• Restrictive covenants drafted at a scope a court will uphold
• Confidentiality and intellectual property provisions that put ownership where it belongs
• The statutory particulars, so the document does the job section 1 of the Employment Rights Act 1996 requires it to do
• Flexibility clauses where you genuinely need them, drafted to survive challenge
• Core policies: disciplinary, grievance, sickness absence, equal opportunities, data protection and, increasingly, AI use
• One round of amendments

What is not included

• Acting for employees
• Employment tribunal representation
• Payroll, pensions auto-enrolment and tax
• Immigration and sponsor licence work
• Day to day HR handling, disciplinaries, grievances and redundancy processes

Questions I am often asked

A customer has sent a security questionnaire asking for our policies. Does the handbook help?

It contains the staff-facing security, acceptable use, access, device and incident policies that questionnaires ask for, with acknowledgement records. The technical standards sit in separate documents the policies refer to.

Can engineers contribute to open source?

Under the policy the handbook sets: approved licences, approval for contributions in company time or using company code, and freedom for unrelated projects in their own time. A blanket ban loses engineers.

Does the handbook give staff rights to options?

It does not, and it says so. The option agreements and the scheme rules govern the equity; the handbook explains the scheme in outline and refers to them.

Related guidance and services

• Employment contracts and handbooks, £995, the service this page describes
• Consultancy and contractor agreements, £595
• Employment contract for a software developer

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.