Code of Conduct

Last updated: January 15, 2026

Code of Conduct and Business Ethics

Document owner: Chief People Officer & General Counsel (Joint) Version: 3.0 Effective date: January 1, 2026 Last updated: January 15, 2026 Classification: Public — Trust Center Review cadence: Annual, and upon material regulatory or organizational changes Company: Acme Cloud, Inc. Address: 1200 Market Street, Suite 400, San Francisco, CA 94103, USA Primary contacts: trust@acmecloud.com | security@acmecloud.com | privacy@acmecloud.com

1. Executive Summary and Purpose

This Code of Conduct and Business Ethics ("Code") establishes Acme Cloud, Inc.'s ("Company," "we," "us," or "our") expectations for ethical behavior, legal compliance, and professional conduct for all personnel. The Code serves as the foundation of our corporate culture and demonstrates our commitment to integrity, transparency, and accountability to our employees, customers, partners, shareholders, and communities.

Core Principles:

Principle	Commitment	Application
Integrity	We act honestly and transparently in all business dealings	Every interaction with customers, partners, and colleagues
Compliance	We comply with all applicable laws, regulations, and internal policies	All jurisdictions where we operate
Respect	We treat all individuals with dignity and respect	Workplace interactions, customer service, vendor relationships
Accountability	We take responsibility for our actions and their consequences	Decision-making at all levels
Excellence	We strive for the highest standards in our work	Product quality, customer service, professional development

Scope of Application:

This Code applies to all individuals associated with Acme Cloud:

Personnel Category	Application	Acknowledgment Required
Full-time employees	All provisions	Annual certification
Part-time employees	All provisions	Annual certification
Contractors and consultants	All provisions (via contract)	Contract incorporation
Temporary workers	All provisions	Onboarding acknowledgment
Board members	All provisions	Annual certification
Executive officers	All provisions + enhanced obligations	Annual certification
Interns	All provisions	Onboarding acknowledgment
Volunteers	Applicable provisions	Engagement acknowledgment

Violations and Consequences:

Violations of this Code may result in disciplinary action up to and including termination of employment or engagement, and may be referred to appropriate authorities for investigation and prosecution where violations involve illegal conduct. The severity of consequences depends on the nature, frequency, and impact of the violation.

2. Definitions

For purposes of this Code, the following terms shall have the meanings set forth below:

Term	Definition
Conflict of Interest	A situation where personal, financial, or other interests may interfere with, or appear to interfere with, an individual's judgment, objectivity, or loyalty to the Company.
Bribery	Offering, giving, receiving, or soliciting anything of value to influence the actions of an official or business decision-maker in their official capacity.
Kickback	A payment made to a person in a position of influence in exchange for favorable treatment, typically in connection with contracts, procurement, or business transactions.
Facilitation Payment	A small payment made to a government official to expedite or secure performance of a routine, non-discretionary action (prohibited under this Code).
Gift	Anything of value given without expectation of return, including merchandise, meals, entertainment, travel, accommodations, services, discounts, or cash equivalents.
Insider Information	Material, non-public information about the Company or its business partners that could affect investment decisions.
Harassment	Unwelcome conduct based on protected characteristics that creates an intimidating, hostile, or offensive work environment, or that results in adverse employment decisions.
Discrimination	Unfair or unequal treatment based on protected characteristics in employment decisions including hiring, promotion, compensation, and termination.
Retaliation	Adverse action taken against an individual because they reported a concern, participated in an investigation, or exercised rights protected by law or this Code.
Whistleblower	An individual who reports suspected violations of law, regulation, or Company policy through appropriate channels.
Protected Characteristics	Categories protected by law including race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, genetic information, and other characteristics protected by applicable law.
Personal Data	Any information relating to an identified or identifiable individual, as defined under applicable privacy laws.
Confidential Information	Non-public information about the Company, its customers, partners, or employees that should be protected from unauthorized disclosure.
Trade Secret	Confidential business information that provides a competitive advantage and is subject to reasonable efforts to maintain its secrecy.
Export Controls	Laws and regulations governing the export of goods, services, technology, and information to foreign countries, entities, or individuals.
Sanctions	Government restrictions prohibiting transactions with specified countries, entities, or individuals.

3. Ethical Business Practices

3.1 Honest and Fair Dealing

All personnel must conduct business honestly and fairly:

Requirement	Description	Examples
Truthful Representations	All statements to customers, partners, regulators, and investors must be accurate and not misleading	Sales presentations, marketing materials, financial reports, regulatory filings
Contract Compliance	Honor all contractual commitments	Service level agreements, delivery timelines, payment terms
Fair Competition	Compete fairly without engaging in unfair or deceptive practices	Pricing decisions, customer communications, competitive intelligence
Accurate Records	Maintain accurate books, records, and accounts	Financial transactions, expense reports, time records, contracts
Transparent Pricing	Price products and services fairly and transparently	Customer quotes, invoices, contract terms

3.2 Prohibited Business Practices

The following practices are strictly prohibited:

Prohibited Practice	Description	Consequences
False or Misleading Statements	Making false claims about products, services, or capabilities	Termination, legal action
Bid Rigging	Coordinating with competitors to manipulate bidding processes	Termination, criminal prosecution
Price Fixing	Agreeing with competitors on pricing	Termination, criminal prosecution
Market Allocation	Agreeing with competitors to divide markets or customers	Termination, criminal prosecution
Fraud	Intentional deception for personal or Company gain	Termination, criminal prosecution
Embezzlement	Misappropriation of Company funds or assets	Termination, criminal prosecution
Forgery	Falsifying documents or signatures	Termination, legal action
Off-Books Transactions	Maintaining undisclosed accounts or transactions	Termination, legal action

3.3 Record Keeping and Financial Integrity

Requirement	Standard	Verification
Accurate Recording	All transactions recorded accurately and timely	Internal audit, external audit
Proper Authorization	Transactions authorized by appropriate personnel	Approval workflows, segregation of duties
Asset Protection	Company assets safeguarded from loss or misuse	Asset tracking, access controls
Expense Documentation	All expenses supported by appropriate documentation	Receipt requirements, approval workflows
Retention Compliance	Records retained per legal and policy requirements	Retention schedules, legal holds
Audit Cooperation	Full cooperation with internal and external audits	Audit support procedures

4. Anti-Bribery and Anti-Corruption

4.1 Global Anti-Corruption Commitment

Acme Cloud maintains a zero-tolerance policy for bribery and corruption. We comply with:

Law/Regulation	Jurisdiction	Key Requirements
Foreign Corrupt Practices Act (FCPA)	United States	Prohibits bribes to foreign officials; requires accurate books and records
UK Bribery Act 2010	United Kingdom	Prohibits commercial and public bribery; creates corporate offense for failing to prevent bribery
OECD Anti-Bribery Convention	Member countries	International framework for combating bribery
Local Anti-Corruption Laws	All jurisdictions	Compliance with local anti-corruption requirements

4.2 Prohibited Activities

Activity	Definition	Prohibition
Bribes to Government Officials	Payments to influence official action	Absolutely prohibited
Commercial Bribery	Payments to influence business decisions	Absolutely prohibited
Facilitation Payments	Small payments to expedite routine actions	Prohibited (no exception)
Kickbacks	Payments in exchange for favorable treatment	Absolutely prohibited
Political Contributions (Corporate)	Company funds for political purposes	Prohibited without Board approval
Charitable Donations as Quid Pro Quo	Donations to obtain business advantage	Prohibited

4.3 Third-Party Due Diligence

When engaging third parties who may interact with government officials:

Due Diligence Step	Requirement	Documentation
Risk Assessment	Evaluate corruption risk of engagement	Risk assessment form
Background Check	Verify legitimacy and reputation	Third-party screening report
Contract Terms	Include anti-corruption representations and audit rights	Standard contract clauses
Ongoing Monitoring	Monitor for red flags during engagement	Periodic review
Training	Ensure third parties understand our standards	Training acknowledgment

4.4 Red Flags Requiring Escalation

Red Flag	Required Action
Requests for unusual payment terms (cash, third-party payments)	Escalate to Legal before proceeding
Requests for payments to countries with no business connection	Escalate to Legal; do not proceed
Requests for unusually high commissions or fees	Escalate to Legal and Finance
Third-party has reputation for improper payments	Do not engage without Legal approval
Government official suggests payment could expedite approval	Refuse; document; report to Legal
Pressure to ignore due diligence procedures	Refuse; report to Ethics hotline

5. Conflicts of Interest

5.1 Conflict of Interest Policy

All personnel must avoid situations where personal interests conflict with Company interests:

Conflict Type	Description	Required Action
Financial Interests	Ownership in competitors, suppliers, or customers	Disclosure; potential divestment
Outside Employment	Employment or consulting outside Acme Cloud	Pre-approval required
Board Positions	Service on outside boards	Pre-approval required
Personal Relationships	Family or romantic relationships affecting business decisions	Disclosure; recusal from affected decisions
Business Opportunities	Diverting Company opportunities for personal benefit	Prohibited; disclosure required
Competing Activities	Side projects in competitive space	Pre-approval required

5.2 Disclosure Requirements

Trigger	Disclosure Timing	Disclosure Channel
New employment	Before starting Acme Cloud role	Offer acceptance form
New conflict arising	Within 5 business days	ethics@acmecloud.com
Annual disclosure	During annual certification	Ethics questionnaire
Promotion to management	Before assuming role	HR and Legal review
New personal relationship with business impact	Within 5 business days	Manager and HR

5.3 Conflict Resolution Process

Step	Action	Responsible Party
1	Disclosure of potential conflict	Employee
2	Initial assessment	Manager + HR
3	Conflict determination	Compliance Officer
4	Mitigation plan (if conflict exists)	Compliance Officer
5	Implementation and monitoring	Manager
6	Documentation	HR file

5.4 Common Conflict Scenarios and Guidance

Scenario	Guidance	Approval Required
Spouse works for competitor	Disclosure required; may require information barrier	Compliance Officer
Personal investment in customer	Disclosure required if >$10,000 or >1% ownership	Manager + Compliance
Speaking at paid conference	Generally permitted; disclosure of compensation	Manager approval
Advisory board of non-competitor	Permitted with disclosure	Manager + Legal
Family member applying for job	Disclosure required; recusal from hiring decision	HR
Side project in adjacent space	Pre-approval required	Manager + Legal

6. Gifts, Entertainment, and Hospitality

6.1 Receiving Gifts

Gift Type	Threshold	Approval	Documentation
Business meals	Reasonable and customary	None required	Receipt recommended
Small promotional items	<$25	None required	None
Gifts from vendors/partners	$25–$100	Manager notification	Gift log
Gifts from vendors/partners	>$100	Manager approval required	Gift log, approval
Cash or cash equivalents	Any amount	Prohibited	N/A
Entertainment (sporting events, concerts)	<$250	Manager notification	Gift log
Entertainment	>$250	Manager + Compliance approval	Gift log, approval
Travel or accommodations	Any	Pre-approval required	Gift log, approval

6.2 Giving Gifts

Recipient Type	Guidance	Approval
Commercial customers	Reasonable business gifts permitted	Manager for >$100
Government officials	Generally prohibited; very limited exceptions	Legal pre-approval required
Prospective customers	Modest, branded items only	Manager for >$50
Vendors/partners	Reasonable business gifts permitted	Manager for >$100

6.3 Entertainment Guidelines

Principle	Application
Business purpose	Entertainment should have legitimate business purpose
Reasonable value	Entertainment should be reasonable and customary for industry
Transparency	Host should be present; no secret entertainment
Legal compliance	Entertainment must not violate laws or counterparty policies
Reciprocity	Pattern of one-sided entertainment is red flag

7. Workplace Conduct and Respect

7.1 Equal Employment Opportunity

Acme Cloud is an equal opportunity employer committed to non-discrimination:

Protected Category	Applicable Laws	Our Commitment
Race, Color	Title VII, state laws	Zero tolerance for discrimination
Religion	Title VII, state laws	Reasonable accommodation
Sex, Gender	Title VII, Equal Pay Act	Equal treatment, pay equity
Sexual Orientation	State laws, company policy	Full inclusion and respect
Gender Identity	State laws, company policy	Affirming workplace policies
National Origin	Title VII, IRCA	Non-discrimination, lawful employment
Age	ADEA	Merit-based decisions
Disability	ADA, state laws	Reasonable accommodation
Veteran Status	VEVRAA	Support and recognition
Genetic Information	GINA	Non-discrimination
Pregnancy	PDA	Accommodation and leave

7.2 Anti-Harassment Policy

Prohibited Conduct:

Harassment Type	Examples	Prohibited In
Sexual harassment	Unwelcome advances, requests for favors, inappropriate comments	All work contexts including remote
Hostile environment	Conduct creating intimidating or offensive environment	All work contexts
Quid pro quo	Conditioning employment benefits on submission	All contexts
Bullying	Repeated mistreatment, threatening behavior	All contexts
Cyberbullying	Harassment via digital channels (Slack, email, social media)	All contexts
Microaggressions	Subtle, often unintentional discrimination	All contexts

Reporting Channels:

Channel	Contact	Anonymity	Best For
Manager	Direct conversation	No	Initial concerns, immediate issues
HR Business Partner	people@acmecloud.com	No	Formal complaints, investigations
Ethics Hotline	+1-800-555-0199	Yes	Anonymous reporting
Ethics Web Portal	ethics.acmecloud.com	Yes	Anonymous reporting, documentation
General Counsel	legal@acmecloud.com	No	Senior executive concerns

7.3 Investigation Process

Phase	Timeline	Actions
Acknowledgment	2 business days	Receipt confirmation, preliminary assessment
Investigation	15–30 business days	Witness interviews, evidence review
Findings	5 business days after investigation	Determination of substantiation
Corrective Action	Per finding severity	Discipline, training, policy changes
Reporter Notification	10 business days after resolution	Outcome communication (as appropriate)

7.4 Workplace Safety

Safety Element	Requirement	Enforcement
Violence-free workplace	No threats, violence, or weapons	Immediate termination
Drug and alcohol	No impairment affecting work	Performance management, EAP referral
Emergency procedures	Compliance with emergency protocols	Training, drills
Reporting hazards	Report safety concerns promptly	No retaliation
Remote work safety	Maintain safe home office	Ergonomic guidelines, stipend

8. Information Protection and Privacy

8.1 Confidential Information

Information Type	Protection Requirements	Disclosure Restrictions
Customer data	Highest protection; access controls, encryption	Need-to-know only; no external disclosure
Trade secrets	Access controls; NDA required for access	Authorized personnel only
Financial information	Restricted access pre-disclosure	Insider trading rules apply
Personnel records	HR access controls	HRBP and manager only
Security information	Security team access	Classified handling
Product roadmap	Product team access	Under NDA only
Pricing information	Sales and Finance access	Customer-specific; no broad sharing

8.2 Data Protection Obligations

Obligation	Description	Reference
Minimize collection	Collect only data necessary for business purposes	Privacy Policy
Purpose limitation	Use data only for stated purposes	Privacy Policy
Accuracy	Maintain accurate personal data	Data governance procedures
Security	Apply appropriate security controls	Security policies
Retention	Retain only as long as necessary	Data Retention Policy
Individual rights	Support data subject rights requests	DSR procedures

8.3 Acceptable Use of Technology

Permitted Use	Prohibited Use
Business communications	Personal use that interferes with work
Authorized personal use (limited)	Illegal content or activities
Professional development	Unauthorized software installation
Collaboration tools	Circumventing security controls
Cloud services (approved)	Shadow IT
AI tools (approved)	Unapproved AI with customer data

9. External Communications and Representation

9.1 Public Communications

Communication Type	Authorization	Guidance
Media inquiries	Communications team only	Refer all inquiries to communications@acmecloud.com
Press releases	Executive approval	Coordinated by Communications
Conference presentations	Manager approval	Review by Communications for external-facing
Social media (company)	Social media team	Brand guidelines
Social media (personal)	Personal responsibility	See personal social media guidelines
Analyst/investor	Investor Relations only	IR coordination required
Regulatory	Legal coordination	Coordinated response

9.2 Personal Social Media Guidelines

Guideline	Description
Disclosure	When discussing work, clarify opinions are personal, not company positions
Confidentiality	Never share confidential or proprietary information
Respect	Do not disparage customers, partners, or colleagues
Compliance	Follow securities laws regarding material non-public information
Judgment	Consider how posts reflect on you and the Company
Separation	Maintain clear separation between personal and official accounts

9.3 Intellectual Property

IP Type	Protection	Personnel Obligations
Patents	Patent applications, trade secrets	Disclose inventions; assign to Company per agreement
Trademarks	Registration, enforcement	Use properly; report misuse
Copyrights	Automatic protection	Work product belongs to Company
Trade secrets	Confidentiality controls	Protect proprietary information
Open source	License compliance	Follow OSS policy; pre-approval for contributions

10. Trade Compliance and International Business

10.1 Export Controls Compliance

Requirement	Description	Applicable Laws
Export licensing	Obtain required licenses before export	EAR, ITAR
Classification	Properly classify products and technology	ECCN determination
Screening	Screen all parties before transactions	Denied party lists
Record keeping	Maintain export records	EAR requirements
Training	Complete export controls training	Annual requirement for relevant roles

10.2 Sanctions Compliance

Sanctions Type	Examples	Acme Cloud Approach
Country sanctions	Comprehensive embargoes (North Korea, Cuba, etc.)	No business with sanctioned countries
Sectoral sanctions	Restrictions on specific industries	Case-by-case legal review
SDN list	Specially Designated Nationals	Automated screening; no transactions
Secondary sanctions	Restrictions on non-US persons	Legal guidance required

10.3 Anti-Money Laundering

Control	Implementation
Customer due diligence	KYC procedures for enterprise customers
Transaction monitoring	Suspicious activity review
Record keeping	Transaction records retention
Reporting	SAR filing where required
Training	AML awareness for relevant roles

11. Reporting Violations and Non-Retaliation

11.1 Reporting Channels

Channel	Contact	Availability	Anonymity
Direct manager	Direct conversation	Business hours	No
HR Business Partner	people@acmecloud.com	Business hours	No
Ethics email	ethics@acmecloud.com	Monitored business hours	Partial (email visible)
Ethics hotline	+1-800-555-0199	24/7/365	Yes
Ethics portal	ethics.acmecloud.com	24/7/365	Yes
General Counsel	legal@acmecloud.com	Business hours	No
Board Audit Committee	audit-committee@acmecloud.com	For executive matters	Confidential

11.2 Non-Retaliation Commitment

Acme Cloud strictly prohibits retaliation against anyone who:

Protected Activity	Examples
Reports a concern in good faith	Ethics hotline, manager, HR
Participates in an investigation	Witness interviews, document production
Refuses to participate in illegal activity	Declining to make prohibited payment
Exercises legal rights	Workers' compensation, FMLA
Cooperates with regulatory inquiry	Responding to government requests

Prohibited Retaliatory Actions:

Category	Examples
Employment actions	Termination, demotion, suspension
Compensation impacts	Pay reduction, bonus denial
Career impacts	Negative evaluation, promotion denial, unfavorable assignment
Workplace treatment	Exclusion, harassment, intimidation
Subtle retaliation	Silent treatment, micromanagement, reduced responsibilities

11.3 Investigation Confidentiality

Principle	Application
Need-to-know	Information shared only with those required for investigation
Reporter identity	Protected to extent possible; disclosed only if legally required
Investigation details	Not disclosed beyond necessary participants
Outcomes	Specific disciplinary actions generally confidential

12. Disciplinary Framework

12.1 Violation Categories and Consequences

Severity	Examples	Typical Consequences
Minor	Late policy acknowledgment, minor gift violation, inadvertent policy deviation	Verbal coaching, additional training
Moderate	Inappropriate communication, minor confidentiality breach, repeated minor violations	Written warning, performance improvement plan
Serious	Harassment, significant data mishandling, policy circumvention, discrimination	Final written warning, suspension, termination
Critical	Fraud, bribery, violence, intentional data breach, retaliation	Immediate termination, legal referral

12.2 Factors in Disciplinary Decisions

Factor	Consideration
Severity of violation	Impact on individuals, Company, customers
Intent	Deliberate vs. negligent vs. inadvertent
Prior history	Previous violations or warnings
Position	Greater expectations for senior roles
Cooperation	Self-reporting, cooperation with investigation
Remediation	Efforts to correct harm
Pattern	Isolated incident vs. pattern of behavior

12.3 Appeal Process

Step	Action	Timeline
1	Written appeal to HR	10 business days after disciplinary action
2	HR review with General Counsel	10 business days
3	Decision communication	5 business days after review
4	Final appeal to CEO (termination only)	5 business days after HR decision

13. Training and Certification

13.1 Required Training

Training	Audience	Frequency	Deadline
Code of Conduct	All personnel	Annual	30 days from hire; annual by January 31
Anti-harassment	All personnel	Annual	30 days from hire; annual
Anti-bribery/corruption	Finance, Sales, Executives	Annual	60 days from role start
Export controls	Engineering, Sales, Operations	Annual	60 days from role start
Insider trading	All personnel	At hire; upon material events	Before trading window
Data protection	All personnel	Annual	30 days from hire; annual
Manager ethics	All people managers	At promotion; annual	Before assuming role

13.2 Annual Certification Process

Step	Timeline	Action
1	January 1	Certification window opens
2	January 1–31	Complete Code of Conduct training
3	January 1–31	Complete conflict of interest questionnaire
4	January 31	Certification deadline
5	February 1–15	Manager follow-up with non-completers
6	February 15	Escalation to HR for non-completion
7	March 1	Access restrictions for persistent non-completion

13.3 FY2025 Certification Metrics

Metric	Result
Overall completion rate	99.1%
On-time completion (by January 31)	94.7%
Conflicts disclosed	47
Conflicts requiring mitigation	12
Average completion time	28 minutes
Manager completion rate	100%

14. SOC 2 and ISO 27001 Control Mapping

14.1 SOC 2 Trust Services Criteria Mapping

Control ID	Control Description	Code Implementation
CC1.1	Demonstrates commitment to integrity and ethical values	This Code, ethics program, certification requirement
CC1.2	Board exercises oversight	Board Audit Committee ethics oversight
CC1.3	Management establishes structures and reporting	Ethics organization, reporting channels
CC1.4	Commitment to attract and retain competent individuals	Training, performance management
CC1.5	Holds individuals accountable	Disciplinary framework, certification
CC2.1	Information generation and use	Records management, confidentiality
CC2.2	Internal communication	Policy communication, training
CC2.3	External communication	Communications policy, spokesperson rules
CC3.1	Risk identification	Conflict of interest disclosure
CC3.2	Risk assessment	Due diligence, vendor assessment
CC6.1	Logical access controls	Need-to-know principles
CC6.7	Information handling	Confidentiality requirements

14.2 ISO 27001:2022 Annex A Control Mapping

Control	Control Title	Code Implementation
A.5.1	Policies for information security	Code as foundational policy
A.5.4	Management responsibilities	Management accountability
A.5.10	Acceptable use of information	Acceptable use provisions
A.5.36	Compliance with policies	Certification, disciplinary framework
A.6.1	Screening	Background check requirements
A.6.2	Terms and conditions of employment	Code acknowledgment
A.6.3	Information security awareness	Training program
A.6.4	Disciplinary process	Disciplinary framework
A.6.5	Responsibilities after termination	Confidentiality obligations
A.6.6	Confidentiality agreements	NDA requirements
A.6.7	Remote working	Remote work guidelines

Document revision history

Version	Date	Author	Summary of changes
1.0	2024-06-01	Legal & Compliance	Initial Trust Center publication
2.0	2025-03-15	GRC Program	SOC 2 Type II alignment refresh; expanded subprocessors
2.5	2025-09-01	Security Engineering	Encryption standards update; ISO 27001 mapping
3.0	2026-01-15	Trust Center Program	Full procurement-grade expansion; 34-document set

Contact

Acme Cloud, Inc. 1200 Market Street, Suite 400 San Francisco, CA 94103, USA

Channel	Email	Use case
Trust & procurement	trust@acmecloud.com	Security questionnaires, trust reviews
Security	security@acmecloud.com	Incidents, vulnerabilities, control questions
Privacy	privacy@acmecloud.com	DSRs, privacy assessments
Legal	legal@acmecloud.com	Contractual, DPA, legal notices

15. Program Governance and Metrics

15.1 Ethics Program Oversight

Role	Responsibilities	Reporting
General Counsel	Ethics program ownership, policy updates	CEO, Board Audit Committee
Chief People Officer	Training, culture, HR integration	CEO
Compliance Officer	Day-to-day operations, investigations	General Counsel
Ethics Ambassadors	Departmental ethics champions (12 volunteers)	Compliance Officer
Board Audit Committee	Program oversight, executive concerns	Full Board

15.2 FY2025 Ethics Program Metrics

Metric	Value	Trend	Benchmark
Ethics hotline reports	23	+4 YoY	Healthy
Substantiated reports	8 (35%)	Stable	Industry: 30–40%
Retaliation claims	2 (unsubstantiated)	-1 YoY	Target: 0
Average investigation time	22 days	-3 days YoY	Target: <30 days
Training completion	99.1%	+0.5% YoY	Target: 100%
Ethics culture survey (fear of retaliation)	91% feel safe reporting	+3% YoY	Industry: 82%
Leadership models ethics	88% agree	+2% YoY	Industry: 78%

15.3 Program Benchmarking

Acme Cloud's ethics program is benchmarked against:

Framework	Result	Date
Ethisphere World's Most Ethical Companies	Criteria assessment completed	Q4 2025
DOJ Evaluation of Corporate Compliance Programs	Self-assessment: meets expectations	Q3 2025
Industry peer comparison	Above median for SaaS 200–500 employees	Q4 2025

16. Acknowledgment and Commitment

By working at or with Acme Cloud, all personnel acknowledge and commit to:

Commitment	Acknowledgment
I have read and understand this Code	Required at hire, annually
I will comply with all Code provisions	Required
I will report suspected violations	Required
I will complete required training	Required
I will disclose conflicts of interest	Required
I understand consequences of violations	Required
I will not retaliate against reporters	Required
I will protect confidential information	Required

Annual Certification Statement:

"I certify that I have read, understand, and agree to comply with the Acme Cloud Code of Conduct and Business Ethics. I have disclosed all actual or potential conflicts of interest. I understand that violations may result in disciplinary action, including termination. I know how to report concerns and understand that retaliation is prohibited."

Contact Information:

Purpose	Contact
Ethics questions	ethics@acmecloud.com
HR matters	people@acmecloud.com
Legal questions	legal@acmecloud.com
Anonymous reporting	+1-800-555-0199 / ethics.acmecloud.com
Trust inquiries	trust@acmecloud.com

This Code is effective as of January 1, 2026 and supersedes all prior versions. Acme Cloud may update this Code at any time. Material changes will be communicated to all personnel.