# A one-page email policy for a company of five > Five people do not need a thick policy. Here is a one-page email policy covering ownership, reply times, privacy, security and leavers, ready to adapt. - Published: 2026-10-16 - Author: Koltrix Team - Category: Startups - Source: https://koltrix.com/blog/a-one-page-email-policy-for-a-company-of-five A company of five does not need a twenty-page email policy that nobody reads. It does need a few agreed rules, because email is where customers, money and private details meet. Without them, each person invents their own habits, and the gaps show up at the worst time: a customer waits three days, an invoice goes to the wrong person, or a departing teammate takes the only copy of an important thread. This guide gives you a one-page policy you can adapt in half an hour. It is written in plain language, covers the points that cause most trouble, and fits on a single sheet so people actually remember it. ## What a one-page policy should cover Keep it to six short sections. Each answers a question your team would otherwise argue about. 1. Who owns which mailbox 2. How fast we reply 3. What we never send by email 4. How we keep accounts safe 5. How we write to customers 6. What happens when someone leaves ## The policy, ready to adapt Copy this, change the names and numbers, and put it where the team can find it. ### 1. Mailboxes and ownership - Customer mail goes to shared addresses (for example support@ and billing@), not to one person's inbox. - Each shared address has one named owner who makes sure it is covered. Owner for support: ______. Owner for billing: ______. - If you reply to a customer, make it clear in the team's tool that you have taken the conversation, so two people do not answer the same message. - Personal mailboxes are for personal work mail. If a customer writes to you directly about a support matter, move it to the shared inbox. For setting up shared addresses well, see [when a team needs a shared inbox](/blog/shared-inbox-when-a-team-needs-one). ### 2. Reply times - First reply to a customer within one working day. Target: 4 working hours. - If you cannot solve it yet, say what you are checking and when you will write back. - Billing and access problems come first. They block the customer's work. - Outside working hours, nobody is expected to answer. The auto-reply says when we are back. Pick numbers you can keep. A promise of two hours that you miss is worse than a promise of one day that you meet. ### 3. What we never send by email - Passwords, full card numbers or secret keys. Use a password manager or the product's own secure setting. - Customer data in bulk, such as exports of names and addresses, to personal accounts. - Anything we would not want a customer to read. Assume a message can be forwarded. If a customer sends us a password or card number, we tell them not to, and we do not copy it into notes. Our guide on [personal data in email](/blog/personal-data-in-email-plain-rules-for-small-teams) goes deeper on this. ### 4. Account safety - Everyone uses a password manager and a unique password for work mail. - Two-step verification is on for every mailbox. No exceptions, including the founder. - We do not share logins. Each person has their own access to shared addresses. - If you think an account was compromised, tell the founder at once, change the password, and do not wait to be sure. - We check the list of connected apps for each account every quarter and remove what we do not use. Rolling this out takes a short meeting; [rolling out 2FA for team email](/blog/rolling-out-2fa-team-email) walks through it. ### 5. Writing to customers - Lead with the answer. Keep it short. - Use the customer's name, and sign with your own. - Check the To and Cc fields before sending. Reply to the person who wrote, and add others only if they need it. - Do not promise what we have not decided. "I will check and tell you by Thursday" is better than a guess. - If we make a mistake, we say so plainly and say what we are doing about it. The [Cc and Bcc rules for teams](/blog/team-cc-bcc-rules) cover the most common slips. ### 6. When someone leaves - Their access to shared addresses is removed on their last day. - Their open conversations are reassigned before they go. - Their personal mailbox is kept for 90 days, set to forward to a named person, then closed. - Passwords they knew for shared tools are changed. [Team mailbox archive and retention habits](/blog/team-mailbox-archive-retention-habits) explains how long to keep what. ## How to roll it out 1. **Write it with the whole team.** Fifteen minutes in a meeting beats a document that appears from nowhere. 2. **Fill in the blanks.** Names, numbers and addresses make it real. 3. **Put it somewhere visible.** A pinned page or the first note in your team tool. 4. **Read it again in three months.** Change what did not work. ## Signs the policy is working - Customers rarely get two answers to the same message. - Nobody asks "who is handling this?" more than once. - A new hire can read the page and start on day one. - When something goes wrong, you can tell what the rule was. ## Signs it is too long If people say "I never read it", cut it. A policy that is skipped does nothing. One page means one page. Move extras, such as tone examples or tool setup, into separate notes that people read when they need them. ## What to remember A good small-company email policy is short, specific and agreed by the people who must follow it. Cover ownership, reply times, what never goes in email, account safety, how you write and what happens when someone leaves. Fill in the blanks together, put it where everyone can see it, and revisit it when the company grows.