An employee violated company policy by using an online service provider to host a document containing custodian account user names and passwords.