TASC Software Ethical Sourcing Policy

Statement and purpose of policy

TASC Software Solutions Ltd (“we” or “us”) aim to provide its customers with quality products and value for money. However, this does not mean we can compromise when sourcing our own products and services both nationally and internationally.

Over the last few years, concerns about working conditions and environmental unsustainability in developing countries and so called emerging markets have meant that our customers are likely to have identified specific social criteria that they expect the suppliers of products and services that they purchase from to adhere to.  These criteria are expected to apply to the supply chains of these suppliers too.

We are committed to upholding human rights, fair working conditions and environmental protection, in accordance with the expectations of our customers, the community, and the requirements of the Law.  We will endeavour to always operate responsibly within the community and we expect the same from our suppliers.

Maintaining a reputation for the highest legal, moral information security and ethical standards in our dealings with our customers and other key stakeholders is important for our ongoing success. The Policy has been developed to compliment our core values of integrity, trust and acting responsibly.

This Ethical Sourcing Policy is designed to ensure that we, and all key suppliers in our supply chain 

 

• source their products and services in a responsible manner,
• work with their suppliers to improve their social, environmental and security practices
• provide clear guidance to staff purchasing products or services
• protecting their corporate reputation and the reputation of their brands.
• Protect both TASC’s and customers’ reputation
• Meet information security, data protection, and modern slavery responsibilities
• This is a universal policy that applies to all suppliers of products and services to TASC Software. 

This policy covers our own purchases, and by association the purchases of our suppliers. Some aspects of this policy affect areas governed by local legislation in certain countries (e.g., employee privacy laws): in such cases the need for local legal compliance has clear precedence over this policy within the bounds of that jurisdiction. In such cases local teams should develop and issue users with a clarification of how the policy applies locally. Responsibilities

• Staff members at TASC Software who monitor and enforce compliance with this policy are responsible for ensuring that they remain compliant with relevant legislation at all times including:
• UK GDPR
• Modern Slavery Act 2015
• ISO/IEC 27001:2022 Annex A controls
• Environmental and labour regulations
• The ISMS Manager is responsible for supplier risk assessments, security checks, and ensuring suppliers meet information security and ethical requirements.

ETI expectations placed upon suppliers

• TASC Software has committed to working with suppliers with good labour and environmental practices by insisting that suppliers support the ethical standards set out in this Policy.  These requirements adhere to the nine principles of the ETI base code, which is an internationally recognised code of labour practice. 

Labour Rights

• Employment is freely chosen
• There is no forced, bonded or involuntary prison labour
• Workers are not required to lodge deposits or their identity papers with their employer and are free to leave their employer after reasonable notice

Freedom of association and the right to collective bargaining are respected

• Workers, without distinction, have the right to join or form trade unions of their own choosing and to bargain collectively
• The employer adopts an open attitude towards the activities of trade unions and their organisational activities
• Workers representatives are not discriminated against and have access to carry out their representative functions in the workplace
• Where the right to freedom of association and collective bargaining is restricted under Law, the employer facilitates, and does not hinder, the development of parallel means for independent and free association and bargaining

Working conditions are safe and hygienic

• A safe and hygienic working environment shall be provided, bearing in mind the prevailing knowledge of the industry and of any specific hazards. Adequate steps shall be taken to prevent accidents and injury to health in the working environment.
• Workers shall receive regular and recorded health and safety training, and such training shall be repeated for new or reassigned workers.
• Access to clean toilet facilities and to clean and drinkable water and, if appropriate, sanitary facilities for food storage shall be provided.
• Accommodation, where provided, shall be clean, safe, and meet the basic needs of the workers
• Suppliers shall assign responsibility for health and safety to a senior management representative.
• Suppliers will ensure that personal protective equipment, sanitary products such as cleaning gels, and notices highlighting hygiene principles are available and workers are trained in their use. 
• Safeguards on machinery must meet or exceed local laws.

Child labour shall not be used

• We will not engage suppliers who use child labour that
• Is mentally, physically, or morally harmful to children;
• Can negatively affect their mental, physical, or social development, and
• Interferes with their schooling:
• by depriving them of the opportunity to attend school;
• by obliging them to leave school prematurely; or
• by requiring them to attempt to combine school attendance with excessively long and heavy work.

 Living wages are paid

• Wages and benefits paid for a standard working week meet, at a minimum, national legal standards or industry benchmark standards, whichever is higher. In any event wages should always be enough to meet basic needs and to provide some discretionary income.
• All workers shall be provided with written and understandable information about their employment conditions in respect to wages before they enter employment and about the particulars of their wages for the pay period concerned each time that they are paid.
• Deductions from wages as a disciplinary measure or any deductions from wages not provided for by Law shall not occur without the expressed permission of the worker concerned. All disciplinary measures should be recorded.

Working hours are not excessive

• Working hours comply with any Law and benchmark industry standards, whichever affords greater protection.
• In any event, workers shall not on a regular basis be required to work in excess of 60 hours per week and shall be provided with at least one day off for every 7 day period on average. Overtime shall be voluntary, shall not be excessive, shall not be demanded on a regular basis and shall always be compensated at a premium rate.

No discrimination in practices

• There is no discrimination in hiring, compensation, access to training, promotion, termination or retirement based on race, caste, national origin, religion, age, disability, gender, marital status, sexual orientation, union membership or political affiliation.

Regular employment is provided

• To every extent possible work performed must be on the basis of recognised employment relationships established through national law and practice.
• Obligations to employees under labour or social security laws and regulations arising from the regular employment relationship shall not be avoided through the use of labour only contracting, sub-contracting, or home-working arrangements, or through apprenticeship schemes where there is no real intent to impart skills or provide regular employment, nor shall any such obligations be avoided through the excessive use of fixed-term contracts of employment.

No harsh or inhumane treatment is allowed

• Physical abuse or discipline, the threat of physical abuse, sexual or other harassment and verbal abuse or other forms of intimidation shall be prohibited.

Additional expectations placed upon suppliers

• In addition to the expectations laid out by the Ethical Trading Initiative, suppliers to TASC Software are expected to be able to demonstrate commitment to the following tenets.

Entitlement to work and Immigration

• Only workers with a legal right to work shall be employed or used by the supplier.
• All workers, including employment agency staff must be validated by the supplier for their legal right to work by reviewing original documentation.
• The supplier shall implement processes to enable adequate control over agencies with regards to the above points and related legislation.

Subcontracting and Working From Home

• There shall be no subcontracting unless inherent or previously agreed

• Suppliers must have adequate processes in place for properly managing sub-contracting and home-working to ensure subcontractors do not abuse, exploit or provide unsafe working conditions for their employees

Environment Compliance

• The supplier must comply with national and local environmental laws and regulations.
• The supplier must dispose of its production waste, where pertinent, in accordance with local environmental laws and regulations.
• The supplier must have identified and documented its key Environmental Impacts and implemented management systems and controls to minimise its impact on the environment.

Information Security & Data Protection As a software company processing sensitive information, TASC requires all suppliers to:

• Information Security Requirements

Suppliers must:

• Protect all TASC information in accordance with the principles of ISO/IEC 27001
• Maintain appropriate security controls for the services provided
• Notify TASC immediately of any data breach, security incident, or suspected compromise
• Use encryption and secure handling for any TASC data
• Ensure staff are vetted appropriately for the services they provide
• Implement secure development and maintenance practices for software services
• Data Protection Requirements

Where suppliers process personal data on behalf of TASC, they must:

• Comply with the UK GDPR and the Data Protection Act 2018
• Provide transparency about processing locations
• Only use sub-processors approved by TASC
• Support data subject rights when required
• Cloud & SaaS Providers

Cloud and SaaS suppliers (e.g., AWS, GitHub, Azure DevOps, third-party APIs) must:

• Maintain recognised security certifications (ISO 27001, SOC 2, CSA STAR, etc.)
• Provide compliance documentation upon request
• Disclose regional data storage locations
• Maintain uptime and resilience commitments
• Provide documented business continuity processes

Software Supply Chain Security

• Suppliers providing software, libraries, APIs, or development tools must:
• Maintain secure coding practices
• Provide timely vulnerability notifications
• Not include malicious, unlicensed, or harmful components
• Manage open-source software responsibly (e.g., licensing compliance)
• Patch security vulnerabilities promptly

This applies to:

• Third-party APIs
• Libraries and frameworks
• CI/CD tools
• Development platforms or plugins

Sustainability & Environmental Responsibility Suppliers must:

• Operate in compliance with national and local environmental laws
• Reduce environmental impact where possible
• Dispose of electronic waste responsibly
• Prefer renewable energy and sustainable hosting (cloud providers) 
• Demonstrate efforts to reduce carbon emissions

Modern Slavery & Human Rights

• Suppliers must comply with the Modern Slavery Act 2015 and confirm that:
• No forced labour is used anywhere in the supply chain
• All workers are treated fairly and with dignity
• Any subcontractors also meet these standards
• TASC may request annual statements or declarations as part of supplier due diligence.

Supplier Due Diligence & Monitoring

• TASC will perform a risk-based assessment of suppliers before engagement, covering:
• Labour welfare and ethical practices
• Data protection and information security
• Environmental impact
• Financial stability
• Compliance with this policy
• Critical suppliers (e.g., AWS, SaaS platforms, support tools) will be:

1. Reviewed at least annually
2. Required to provide security or compliance documentation
3. Monitored for incidents, breaches, or ESG performance concerns
4. Non-critical suppliers will be reviewed periodically.

Suppliers must notify TASC of any major organisational changes that could affect service or compliance.