Responsible Disclosure Policy

1. About This Policy

Talent Cloud Global Ltd ("Talent Cloud", "we", "our" or "us") takes the security of our websites, applications and services seriously.

We welcome responsible reports from security researchers, customers, users and other people who believe they have identified a security vulnerability affecting a Talent Cloud-controlled service.

This Policy explains:

• how to report a suspected security vulnerability;
• which Talent Cloud services are within scope;
• the principles we ask security researchers to follow;
• activities that are not authorised;
• what to do if personal, confidential or customer information is encountered;
• how we assess reports;
• our approach to coordinated disclosure; and
• the boundaries of this responsible disclosure process.

Our objective is to make it straightforward to report legitimate security concerns without encouraging activity that creates unnecessary risk to learners, customers, workforce programmes, our systems or third parties.

2. How to Report a Security Concern

Security concerns should be reported privately to:

[support@talentcloudglobal.com](mailto:support@talentcloudglobal.com)

Please identify the report clearly as a security vulnerability or security concern.

Where possible, include:

• the affected service, application, domain or URL;
• a clear description of the suspected vulnerability;
• the potential security impact;
• safe steps for reproducing the issue;
• relevant request, response or technical information;
• screenshots where useful and safe;
• whether any personal, confidential or customer information was encountered;
• whether you believe the issue is actively being exploited; and
• contact details if you would like us to respond.

Please do not include unnecessary personal information, credentials, large quantities of customer information or other sensitive material merely to demonstrate that a vulnerability exists.

3. Scope

This Policy applies to security vulnerabilities affecting internet-accessible systems and services that are owned or controlled by Talent Cloud Global Ltd.

This may include, where relevant:

• talentcloudglobal.com;
• za.talentcloudglobal.com;
• za-admin.talentcloudglobal.com;
• Talent Cloud-controlled APIs associated with those services; and
• other Talent Cloud-controlled internet-facing services where it is reasonably clear that Talent Cloud is responsible for the affected system.

Different services may use different infrastructure, applications and technology.

The fact that a service contains Talent Cloud branding does not necessarily mean that every underlying third-party system is owned or controlled by Talent Cloud.

4. Third-Party Systems

Talent Cloud uses third-party technology and service providers.

These may support functions such as:

• cloud infrastructure;
• assessments;
• interviews;
• learning;
• scheduling;
• communications;
• integrations; and
• other platform capabilities.

This Policy does not authorise security testing against systems owned or controlled by a third party merely because:

• the service integrates with Talent Cloud;
• a link appears on our website;
• third-party content is embedded in a Talent Cloud page;
• the provider processes information for Talent Cloud; or
• Talent Cloud has a commercial relationship with the provider.

If you believe a vulnerability in a third-party service materially affects Talent Cloud or Talent Cloud users, you may report the concern to us.

Do not conduct testing against the third party beyond any authority you independently have from that provider.

Where appropriate, we may coordinate with the relevant provider.

5. Good-Faith Security Research

We consider responsible security research to be research undertaken genuinely to identify and report a security issue while seeking to minimise harm.

If you investigate a suspected vulnerability affecting an in-scope Talent Cloud service, we ask that you:

• act in good faith;
• minimise interaction with real user information;
• use your own accounts and information where reasonably possible;
• test only to the extent reasonably necessary to establish that a vulnerability may exist;
• avoid causing harm or disruption;
• stop where further testing would materially increase risk;
• protect any sensitive information encountered;
• report the issue privately and promptly; and
• give us a reasonable opportunity to investigate before considering public disclosure.

The objective should be to demonstrate the security issue safely, not to establish the maximum possible harm that could be caused.

6. Minimise Testing

Please use the least intrusive method reasonably sufficient to identify and demonstrate a suspected vulnerability.

A report generally does not require you to:

• download an entire database;
• access multiple user accounts;
• obtain large volumes of personal information;
• modify production records;
• maintain persistent access;
• move laterally between systems;
• obtain administrator privileges beyond what is necessary to establish the issue;
• demonstrate destructive impact; or
• prove that a vulnerability could be exploited at scale.

Where a small, safe proof is sufficient, stop there and report it.

7. Personal, Customer or Confidential Information

Talent Cloud services may process information relating to learners, customers, employers, programme providers, assessors and other users.

If you unexpectedly encounter information that is not your own:

1. stop accessing the information once you have enough evidence to identify the issue;
2. do not explore additional records unnecessarily;
3. do not download, copy, share or retain more information than is reasonably necessary to report the issue;
4. do not use the information for any unrelated purpose;
5. protect any information already obtained from further disclosure; and
6. tell us in your report that information may have been exposed.

Where possible, provide evidence showing the nature of the exposure without sending us unnecessary copies of affected personal information.

If sensitive material has been retained solely for the purpose of reporting the vulnerability, follow reasonable instructions concerning its secure deletion once it is no longer required.

8. Activities That Are Not Authorised

This Policy does not authorise activities that create unnecessary harm, disruption or risk.

Please do not:

• intentionally access personal or confidential information beyond what is minimally necessary to establish a vulnerability;
• alter or delete information that is not your own;
• deliberately corrupt information;
• intentionally disrupt or degrade Talent Cloud services;
• perform denial-of-service or distributed denial-of-service attacks;
• carry out high-volume automated testing likely to impair service availability;
• deploy malware;
• install persistent access mechanisms;
• introduce ransomware or destructive code;
• use social engineering against Talent Cloud personnel, customers or users;
• conduct phishing attacks;
• attempt to obtain employee or user passwords through deception;
• physically access Talent Cloud premises or equipment without permission;
• compromise third-party accounts;
• exploit a vulnerability for financial, commercial or personal advantage;
• demand payment as a condition of not exploiting or disclosing a vulnerability;
• publicly disclose sensitive vulnerability information before we have had a reasonable opportunity to investigate; or
• conduct activity that is unlawful or outside authority provided by the relevant system owner.

9. Automated Security Testing

Automated tools can be useful in identifying potential vulnerabilities, but they can also create operational risk.

Do not use automated testing in a way that:

• generates excessive traffic;
• materially affects service performance;
• attempts destructive exploitation;
• creates large numbers of accounts or records;
• floods logs, communications or support channels;
• sends unsolicited messages to users; or
• otherwise disrupts normal operation.

The fact that an automated tool identifies a possible issue does not necessarily mean that the issue is exploitable or has the severity assigned by the tool.

Where possible, reports should contain sufficient evidence for us to understand and reproduce the underlying concern safely.

10. Accounts and Authentication

Where testing requires an account, use an account you are authorised to use.

Do not:

• take over another person's account;
• use credentials obtained without authorisation;
• intentionally access another user's information;
• impersonate another person;
• bypass authentication merely to explore unrelated information; or
• create deceptive identities for social-engineering purposes.

If you discover that a vulnerability appears to permit unauthorised access to another account, demonstrate the issue only to the minimum extent reasonably necessary and report it.

11. Production Systems

Our public services may operate against production infrastructure and real workforce-programme information.

Researchers should therefore assume that apparently accessible functionality may interact with real systems or information.

Do not assume that a test environment exists merely because a URL or endpoint appears non-production.

Where there is uncertainty, minimise testing and report the suspected issue.

12. Examples of Security Concerns We Want Reported

We are interested in credible security concerns that could materially affect the confidentiality, integrity or availability of Talent Cloud-controlled systems or information.

Examples may include:

• authentication or authorisation weaknesses;
• inappropriate access to another organisation's or user's information;
• material privilege-escalation issues;
• injection vulnerabilities;
• exploitable cross-site scripting;
• insecure direct-object access;
• material server-side request vulnerabilities;
• exposed credentials or secrets;
• significant security misconfiguration;
• material weaknesses in file or document access;
• material API access-control issues;
• vulnerabilities capable of exposing personal or confidential information; or
• other security defects with a credible material impact.

This list is illustrative rather than exhaustive.

13. Reports That May Have Limited Security Value

Some reports may describe behaviour that is technically observable but has little or no practical security impact.

Depending on the circumstances, examples may include:

• missing security headers without a credible exploit path;
• software-version disclosure without an exploitable vulnerability;
• low-impact informational findings;
• clickjacking on pages with no material sensitive action;
• issues requiring unrealistic user interaction;
• theoretical concerns without evidence that the relevant vulnerable condition exists;
• automated scanner output without validation;
• previously known or duplicate findings; or
• findings concerning a third-party system outside our control.

We may still review such reports, but their existence does not necessarily mean that remediation is required.

14. Security Configuration and Public Information

Information being publicly visible does not necessarily mean that it represents a security vulnerability.

Likewise, the existence of:

• a public endpoint;
• a software framework;
• a technology identifier;
• a DNS record;
• a public file;
• a website header; or
• a third-party service

does not by itself establish a security defect.

Reports should, where reasonably possible, explain the security consequence rather than simply identify a technology or configuration.

15. Reporting Exposed Credentials

If you believe you have discovered a Talent Cloud credential, API key, token, secret or other authentication material that is publicly exposed or otherwise compromised, report it immediately.

Do not use the credential beyond what is minimally necessary to identify that it appears valid or relevant.

Where possible, avoid testing the credential against production services.

Provide enough information for us to identify and investigate the affected credential without unnecessarily reproducing the secret in multiple places.

16. What Happens After You Report

When we receive a security report, we aim to:

• review the information provided;
• determine whether the issue appears to affect a Talent Cloud-controlled service;
• assess whether further information is required;
• consider potential impact;
• investigate the issue as appropriate; and
• determine an appropriate response.

Depending on the issue, investigation may involve:

• technical review;
• reproduction;
• log review;
• infrastructure review;
• provider engagement;
• privacy assessment;
• customer-impact assessment;
• containment;
• remediation; or
• other appropriate action.

Not every reported concern will ultimately be confirmed as a vulnerability.

17. Acknowledgement and Communication

We aim to acknowledge credible security reports and assess them according to their potential impact.

Response times can vary according to factors such as:

• severity;
• reproducibility;
• complexity;
• affected systems;
• third-party involvement;
• available evidence;
• operational priorities; and
• whether immediate containment is required.

We do not publish a guaranteed acknowledgement, investigation or remediation service level through this Policy.

Where contact details have been provided, we may communicate with the reporter where additional information would materially assist the investigation.

18. Severity and Remediation

The severity of a vulnerability depends on its actual circumstances and impact.

Relevant factors may include:

• exploitability;
• information affected;
• privileges required;
• user interaction required;
• affected users or organisations;
• scope;
• availability impact;
• integrity impact;
• confidentiality impact;
• existing mitigations; and
• whether exploitation has been observed.

A theoretical maximum impact does not necessarily represent the actual severity of a vulnerability.

Remediation timing depends on the risk, complexity and affected systems.

Some issues may require immediate containment.

Others may require:

• application changes;
• infrastructure changes;
• provider coordination;
• configuration changes;
• architectural work; or
• longer-term remediation.

19. Security Incidents and Personal Information

A vulnerability report may identify a security weakness without establishing that a security incident or personal-information compromise has occurred.

Where evidence suggests that an incident may have occurred, we will consider the issue under our applicable security, privacy and contractual processes.

This may include consideration of:

• affected systems;
• information involved;
• unauthorised access;
• containment;
• preservation of relevant evidence;
• customer responsibilities;
• provider responsibilities;
• contractual notification requirements; and
• applicable legal or regulatory obligations.

Our Security Statement and Privacy Notice provide further information about our public security and privacy position.

20. Coordinated Disclosure

We recognise that responsible security research can contribute to improved security.

We ask researchers to report vulnerabilities privately and allow us a reasonable opportunity to:

• confirm the issue;
• understand its impact;
• contain immediate risk;
• develop and deploy appropriate remediation;
• coordinate with affected providers or customers where necessary; and
• consider relevant legal, privacy or contractual obligations.

The time reasonably required will depend on the vulnerability.

We do not require researchers to agree to indefinite secrecy merely because an issue has been reported.

However, public disclosure before reasonable investigation and remediation can create risk for users and customers.

If you believe public disclosure is appropriate, we encourage you to discuss timing with us first so that disclosure can be coordinated responsibly where possible.

21. Publication of Sensitive Information

Even after remediation, responsible disclosure should avoid unnecessary publication of:

• personal information;
• customer confidential information;
• credentials;
• secrets;
• information belonging to unrelated third parties; or
• technical detail that creates an unreasonable ongoing risk to systems that remain exposed.

Remediation of one affected component does not necessarily mean that identical vulnerabilities have been eliminated from every third-party or unrelated system.

22. Good-Faith Research and Our Response

Where a researcher acts in good faith and substantially follows this Policy when investigating an in-scope Talent Cloud-controlled service, our intention is to work constructively with that researcher to understand and address the reported issue.

We do not intend to pursue legal action solely because a good-faith researcher has identified and responsibly reported a vulnerability through this process where their activity remained within the boundaries described in this Policy.

This statement is not:

• permission to break the law;
• permission to access third-party systems;
• permission to access information beyond what is minimally necessary;
• a waiver of the rights of our customers, users or third parties;
• authorisation for disruptive or destructive activity;
• authorisation to breach contractual obligations owed to another person; or
• a guarantee that activity will be lawful in every jurisdiction.

Researchers remain responsible for understanding the laws and permissions applicable to their activities.

Where there is uncertainty about whether proposed testing would fall within this Policy, contact us before conducting that testing.

23. No Bug Bounty Commitment

This Responsible Disclosure Policy is not a bug-bounty programme.

Unless Talent Cloud has separately agreed otherwise in writing, reporting a vulnerability does not create an entitlement to:

• payment;
• reward;
• reimbursement;
• employment;
• commercial work;
• public recognition; or
• any other benefit.

Do not conduct additional or intrusive testing on the assumption that greater demonstrated impact will result in payment.

24. Recognition

We may choose to recognise a researcher who has made a helpful responsible disclosure, but we are not required to do so.

Any recognition would be subject to:

• the researcher's wishes;
• confidentiality considerations;
• customer and third-party interests;
• the nature of the vulnerability; and
• Talent Cloud's discretion.

We will not intentionally publish a researcher's personal details as part of recognition without appropriate permission.

25. Customer and User Security Concerns

This Policy is primarily intended for vulnerability reporting.

Customers or users reporting matters such as:

• suspected account compromise;
• unexpected account activity;
• lost credentials;
• suspected phishing;
• suspected personal-information exposure; or
• other operational security concerns

should also contact:

[support@talentcloudglobal.com](mailto:support@talentcloudglobal.com)

Please provide sufficient information for us to identify the affected account or service without sending passwords or unnecessary sensitive information by email.

26. Evidence Handling

Security reports may contain technical or sensitive information.

We aim to use information submitted through this process for purposes connected with:

• investigating the reported concern;
• protecting our services;
• remediation;
• security governance;
• legal or regulatory responsibilities; and
• related operational requirements.

Reporters should minimise the personal and confidential information included in submissions.

We may retain relevant report information where reasonably necessary for security, audit, legal, operational or evidential purposes.

Our Privacy Notice provides further information about personal-information processing.

27. Confidential Security Information

We support appropriate transparency about our security position, but some technical information should remain confidential where disclosure could increase security risk.

We may therefore limit disclosure concerning matters such as:

• internal architecture;
• credentials;
• security configurations;
• detailed infrastructure topology;
• internal access arrangements;
• known vulnerabilities;
• security-sensitive logs;
• investigation methods; or
• remediation details.

This does not prevent us from providing appropriate customer assurance through controlled due-diligence processes.

28. Evidence Before Assurance

Our Evidence Before Assurance principle applies to vulnerability handling.

We should not:

• confirm a vulnerability before sufficient investigation;
• claim remediation is complete without appropriate evidence;
• state that no information was accessed where that has not been established;
• state that an issue affected no customers without an appropriate basis;
• describe a provider issue as a Talent Cloud vulnerability without understanding the boundary; or
• make public security assurances based only on intention.

Likewise, a vulnerability report should distinguish where possible between:

• observed behaviour;
• demonstrated impact;
• potential impact; and
• theoretical impact.

This helps both the reporter and Talent Cloud assess the issue accurately.

29. Relationship With Other Governance Documents

This Responsible Disclosure Policy forms part of our wider governance framework.

Security Statement

Explains our public security position, security approach and assurance boundaries.

Privacy Notice

Explains how Talent Cloud processes personal information and addresses relevant privacy and security matters.

Trust & Compliance Centre

Provides an overview of our wider public governance position.

Website Terms of Use

Sets out conditions applying to use of our public website.

Nothing in this Policy should be interpreted as authorising activity prohibited by applicable law or granting rights over third-party systems.

30. Changes to This Policy

We may update this Responsible Disclosure Policy as:

• our platform changes;
• security practices develop;
• infrastructure changes;
• reporting processes mature;
• third-party services change;
• relevant risks change; or
• legal and regulatory requirements develop.

The current version and last-updated date will be published on the Talent Cloud website.

A previous version of this Policy should not be relied upon as continuing authorisation for activity after the Policy has materially changed.

31. Contact Us

Security vulnerabilities and security concerns should be reported privately to:

[support@talentcloudglobal.com](mailto:support@talentcloudglobal.com)

Talent Cloud Global Ltd

Suite A 82 James Carter Road Mildenhall Suffolk IP28 7DE United Kingdom

Registered in England and Wales Company number: 16914164

Please identify security vulnerability reports clearly so they can be routed appropriately.