Assume company devices, company accounts, and company networks are not private. You do not need paranoia theatre. You do need cleaner habits.
If you can, do this instead
- use a personal phone and personal email
- use a personal messaging app with end-to-end encryption
- meet in person for the most sensitive early conversations when that is practical
- use personal notes, not company docs, for your timeline and issue comparisons
Lock down the basics on personal accounts
- use strong unique passwords
- turn on multifactor authentication
- update your phone, laptop, browser, and messaging apps
- slow down before clicking links or attachments that look urgent or strange
Those are plain habits, but they matter. CISA's baseline guidance still starts there for a reason.
Do not do this on employer systems if you can avoid it
- do not organize in company chat
- do not use company email for planning
- do not store worker notes in company docs, tickets, or project boards
- do not assume deleting a message means it stopped existing
- do not mix your personal life into a company-managed phone or laptop just because it is convenient
Why this matters
An employer can administer its devices, accounts, identity provider, network, backups, and retention systems. Exactly what it may monitor depends on the technology, policy, contract, and applicable law; this checklist does not decide that question. Its narrower purpose is to stop workers from casually putting sensitive organizing activity into systems the employer controls.
Safer communication defaults
- in person is often the cleanest choice for early sensitive conversation
- if you need a digital channel, prefer end-to-end encrypted messaging
- keep group spaces smaller and later than your instincts may want
- keep the first notes and conversations one-to-one where possible
The EFF's communication guidance makes the same basic point: in-person is often most privacy-protective, and otherwise end-to-end encryption is the next best move. CISA's mobile communications guidance also points targeted users toward end-to-end encrypted communications.
What this checklist is not
This is not a promise that personal tools make workers anonymous. It is not a guide to defeating monitoring software. It is a discipline checklist for reducing needless exposure before trust and structure are real.