Equipment Policy

Purpose

Most people at Epcotec work from a company laptop; the lab team works with lasers, optics, discharge apparatus and test instruments. This policy covers all equipment Epcotec owns, hires or licenses ("Epcotec Equipment"): how it is issued, used, protected and returned. It exists for two reasons: the physical safety of the people using lab equipment, and the security of the client code, data and intellectual property that live on our devices.

Scope

This policy applies to all Epcotec employees, and to any third party authorised by Epcotec to use Epcotec Equipment. It does not cover motor vehicles. Read it with our Personal Protective Equipment Policy, our Environmental Policy and our security and acceptable-use controls.

What we provide

As a remote-first studio, we equip people for the work they do. This typically includes:

• a company-managed laptop with our standard security configuration;
• one or more external monitors and docking peripherals, where agreed;
• peripherals such as keyboard, mouse and headset; and
• lab and optical equipment (lasers, optics, discharge-physics apparatus, sensors and test instruments) for approved applied R&D work.

Equipment remains the property of Epcotec unless ownership is expressly transferred.

Acceptable use

Epcotec Equipment is provided for Epcotec work. Reasonable, incidental personal use of a company laptop is permitted where it does not interfere with work, breach our security controls, or store personal material that could be confused with Epcotec or client data. Equipment must never be used for unlawful purposes, or to access or store material that is offensive, discriminatory or otherwise at odds with the standards in our Code of Conduct.

Security expectations

Because our devices carry client code, data and intellectual property, every user observes our security controls:

• laptops use full-disk encryption and remain on our managed device configuration;
• multi-factor authentication (MFA) is required for access to Epcotec and client systems;
• no unapproved devices, storage media or software are connected or installed; cloud sync and external storage go through approved services only;
• devices are locked when unattended, and are never left unsecured in vehicles or public spaces;
• lost or stolen equipment, and any suspected compromise, are reported immediately; and
• Epcotec may remotely lock or wipe a managed device that is lost or stolen.

These controls are consistent with our ISO 27001-aligned and Essential Eight security posture.

Personal devices (BYOD)

We are a laptop-provided company. Personal devices are not used for client work or client-system access unless approved in writing, and then only where they meet the same controls: encryption, MFA and current patching. Where a personal device is approved, its owner keeps it secure and keeps personal material separate from Epcotec and client data.

Care, maintenance and calibration

Users of Epcotec Equipment must:

• follow the manufacturer's directions for use, storage and maintenance;
• operate equipment only where authorised and, where required, trained or qualified to do so;
• keep equipment clean and in good working order;
• report faults immediately and cease use until safe operation is restored; and
• report any medical condition or other restriction that could affect their ability to operate equipment safely.

Lab and optical equipment is serviced, maintained and calibrated in accordance with the manufacturer's requirements and our procedures, and calibration records are retained. Damaged equipment is assessed for repair or replacement. Epcotec maintains appropriate insurance over its equipment, and end-of-life equipment is disposed of through certified e-waste recycling channels.

Return on separation

When a person leaves Epcotec, through resignation, termination or the end of an engagement, all Epcotec Equipment is returned in good working order: laptop, monitors, peripherals, security tokens, access cards and lab equipment. Epcotec and client data must not be copied or retained, and returned devices are wiped and re-provisioned before reuse. Epcotec may withhold or offset the cost of equipment that is not returned, or that is returned damaged beyond reasonable wear and tear.

Breach of policy

A breach of this policy may lead to disciplinary action, up to and including termination of employment. Epcotec also owes reporting obligations and duties to statutory authorities, and may be required by law to report breaches of work health and safety legislation.

---

Approved: Eugene Pivnev, Founder & Managing Director, Epcotec

Version 1.2, 2 October 2026