Security Statement

1. About This Statement

Talent Cloud Global Ltd ("Talent Cloud", "we", "our" or "us") provides technology that helps organisations design, deliver, govern and measure workforce programmes.

These programmes can involve personal information, programme evidence, assessments, employers, learners and other information requiring appropriate protection.

Security is therefore an important part of how we design, operate and govern the Talent Cloud platform.

This Security Statement explains our public security position, including:

• our security approach;
• authentication and access;
• roles and permissions;
• privileged and production access;
• infrastructure and hosting;
• communications and data protection;
• logging and accountability;
• third-party services;
• software and technical dependencies;
• backups and resilience;
• security incidents;
• responsible disclosure;
• customer and user responsibilities;
• security assurance; and
• the boundaries of our public security claims.

This is a public transparency document.

It does not replace a customer-specific security schedule, data-processing agreement, security questionnaire or other contractual security commitment where one applies.

2. Scope of This Statement

This Statement concerns the security approach associated with Talent Cloud's websites, platform applications, APIs and supporting services where relevant.

Talent Cloud operates multiple technical components.

These can include:

• our public website;
• learner-facing applications;
• administration and programme-management applications;
• APIs;
• databases and storage;
• matching services;
• communications services;
• integration services;
• supporting infrastructure; and
• approved third-party services.

Security controls may differ between products, applications, environments and supporting services.

A control described in this Statement should not be assumed to apply identically to every component unless we expressly say so.

Similarly, a capability supported by one application should not automatically be assumed to exist in another.

Customer-specific security requirements should be confirmed through the appropriate due-diligence and contracting process where they are material to deployment.

3. Our Security Approach

We take a practical, engineering-led approach to security.

Security controls are considered according to factors such as:

• the system involved;
• the information being processed;
• the user's role;
• the operational environment;
• the nature of the workforce programme;
• the technology and service providers involved; and
• applicable contractual and legal requirements.

Our objective is to use proportionate technical and organisational measures to protect Talent Cloud systems and information against risks such as:

• unauthorised access;
• inappropriate disclosure;
• unauthorised alteration;
• loss;
• misuse;
• disruption; and
• other forms of unauthorised processing.

No internet, software or cloud environment can eliminate security risk completely.

We therefore do not describe Talent Cloud, or any individual security control, as providing absolute security.

4. Security and Privacy by Design

Security and privacy should form part of product, architecture and operational decisions rather than being considered only after a feature has been developed.

Depending on the proposed change, relevant considerations may include:

• what information is required;
• whether sensitive information is involved;
• whether the information needs to be collected at all;
• who needs access;
• how permissions should operate;
• whether information needs to be displayed or transferred;
• whether a new provider is introduced;
• whether technology-assisted processing is involved;
• what evidence or logging is required;
• how long information should be retained; and
• whether the change creates new security, privacy or governance risks.

Data minimisation forms part of this approach.

We consider whether information needs to be collected, transferred, displayed or retained for the relevant purpose.

Reducing unnecessary information can reduce both privacy and security risk.

Material changes may require additional product, technical, privacy, security or legal review according to their nature.

5. Authentication

Talent Cloud uses authenticated access for protected platform functionality.

Authentication controls depend on the relevant product, environment and user role.

Current platform authentication measures include mechanisms such as:

• individual user accounts;
• password-based authentication;
• password hashing;
• access tokens;
• refresh-token mechanisms; and
• authentication controls appropriate to the relevant application.

Additional authentication controls may be available for particular applications, roles or environments.

The availability of a security capability does not mean that it is mandatory for every user, role or environment.

We therefore do not claim that multi-factor authentication is currently mandatory across all Talent Cloud platform or infrastructure access unless that position is expressly confirmed for the relevant environment.

6. Password Protection

Passwords are protected using cryptographic password-hashing mechanisms rather than being stored as readable passwords within the application.

Password requirements may differ between applications and account workflows.

We continue to review authentication and password controls as the platform develops.

Users are responsible for:

• choosing passwords that meet applicable requirements;
• keeping credentials confidential;
• not sharing accounts;
• avoiding credential reuse where reasonably possible; and
• reporting suspected account compromise promptly.

7. Roles and Permissions

Talent Cloud uses role and permission controls to restrict access to protected functionality and information.

Different users may require different levels of access depending on their responsibilities.

Examples of platform roles may include:

• administrators;
• project or programme managers;
• facilitators;
• assessors;
• moderators;
• workplace coordinators;
• quality-assurance or ETQA-related users;
• employers;
• recruiters;
• learners; and
• other authorised programme users.

The existence of a role does not mean that every user holding that role has unrestricted access to all information.

Access should be appropriate to the user's authorised responsibilities and the relevant programme or organisation.

Customers and programme organisations also have responsibilities for ensuring that access granted to their authorised users remains appropriate.

8. Privileged Access

Some forms of technical or administrative access can provide greater control over infrastructure, applications, configurations or information than ordinary user access.

Privileged access should therefore be treated differently from routine application access.

Access capable of administering production infrastructure, applications or data should be limited according to operational need and subject to governance appropriate to the level of access involved.

Our security programme includes continuing review of how privileged:

• identities;
• authentication;
• permissions;
• access activity; and
• operational responsibilities

are governed.

A statement that privileged access is restricted does not mean that every possible privileged-access security mechanism has already been implemented across every environment.

9. Organisational Separation and Access Control

Talent Cloud supports organisational and programme contexts in which access to information is controlled according to the relevant user, organisation, programme and permissions.

Application controls may restrict access based on factors such as:

• authentication;
• organisation;
• role;
• permission;
• programme;
• cohort; and
• authorised functionality.

These controls are intended to reduce inappropriate access across organisational or programme boundaries.

The exact access model depends on the relevant product and configuration.

10. Infrastructure and Hosting

Our core South African platform infrastructure uses Amazon Web Services infrastructure in South Africa.

Relevant platform services may include cloud capabilities supporting areas such as:

• application hosting;
• databases;
• object storage;
• queues;
• email;
• event processing;
• monitoring; and
• other infrastructure functions.

Using South African infrastructure does not mean that every person who may lawfully access the environment is physically located in South Africa.

Authorised remote access or external service-provider processing may occur from other jurisdictions.

Our Privacy Notice and Trust & Compliance Centre provide further information about international processing.

11. Communications Security

Talent Cloud uses HTTPS for protected web communications.

This helps protect information transmitted between users and relevant Talent Cloud web services against unauthorised interception during transmission.

Other system-to-system communications may use appropriate authentication mechanisms such as:

• service credentials;
• application keys;
• authenticated APIs; or
• other controlled integration methods.

Security depends on the complete configuration of the systems involved, not simply the presence of HTTPS, an API key or another individual technical control.

12. Data Storage and Cloud Security

Talent Cloud uses cloud infrastructure and database services to store and process platform information.

Security controls can operate at multiple layers, including:

• cloud-provider infrastructure;
• network and transport protection;
• database configuration;
• object storage;
• application access controls;
• user permissions; and
• operational access controls.

We do not make a blanket public claim concerning a particular encryption configuration, key-management implementation or infrastructure setting unless that configuration has been appropriately verified for the relevant environment.

Detailed infrastructure-security information may be made available during appropriate customer due diligence where relevant and subject to suitable confidentiality and security considerations.

13. Secrets and Service Credentials

Talent Cloud systems may use:

• credentials;
• API keys;
• access tokens;
• service accounts;
• integration secrets; and
• other authentication material

to enable applications, infrastructure and third-party services to communicate securely.

These credentials should be:

• restricted to authorised systems and personnel;
• protected from inappropriate disclosure;
• used only for legitimate purposes; and
• managed according to their purpose and sensitivity.

Secrets and credentials should not be treated as substitutes for appropriate permissions or other access controls.

Where compromise is reasonably suspected, relevant credentials should be investigated and changed, revoked or otherwise addressed as appropriate.

We do not publicly disclose sensitive credentials or detailed information that could materially weaken their protection.

14. Files and Documents

Talent Cloud may support storage and retrieval of programme documents, evidence and other files.

Access to protected files may use controlled mechanisms such as authenticated application access and time-limited or otherwise controlled storage links.

Users and programme organisations should upload only information appropriate to the relevant programme and authorised purpose.

Access to documents should remain limited to users who have an appropriate reason to view them.

15. Logging and Accountability

Talent Cloud records relevant system and application activity to support functions such as:

• operations;
• troubleshooting;
• security;
• auditability;
• programme governance; and
• investigation.

Depending on the system, logged activity may include relevant authentication, application, system or data-change events.

Logging is intended to support accountability and investigation.

It should not be interpreted as a claim that every possible user action or system event is permanently recorded.

Log access and retention should be appropriate to the purpose and sensitivity of the information involved.

16. Production Access

Access to production systems and environments is restricted to authorised personnel who require access for legitimate operational, technical, support or development purposes.

Production access should be:

• individually attributable where appropriate;
• limited to people with an authorised need;
• used only for legitimate purposes;
• subject to appropriate confidentiality and security obligations; and
• reviewed as our operating environment develops.

Authorised personnel may access relevant systems remotely from jurisdictions outside South Africa where this is required for legitimate operational purposes.

International access is subject to the privacy, security and contractual governance applicable to that processing.

17. Service-to-Service Security

Talent Cloud consists of multiple applications and services.

Where systems communicate with one another, access may be protected using controls such as:

• service credentials;
• authenticated API requests;
• access keys;
• permissions; and
• other application-level controls.

Service-to-service access should be limited to the functionality and information required for the relevant integration.

18. Third-Party Technology and Service Providers

Talent Cloud uses third-party technology and infrastructure providers to operate parts of our services.

Depending on the relevant product and configuration, these may support functions such as:

• cloud infrastructure;
• communications;
• assessment;
• interviews;
• learning integrations;
• translation;
• monitoring; and
• other platform capabilities.

Not every provider technically supported by our software is necessarily active in every production environment.

Where a third-party provider processes personal information or has security relevance to our services, the provider should be subject to appropriate privacy, security, contractual and governance consideration according to its role.

Customer-specific information about relevant providers may be made available through appropriate due-diligence or contractual processes.

19. Software and Dependency Security

Talent Cloud uses software libraries, frameworks, cloud services and other technical dependencies as part of the platform.

Security management therefore includes consideration of vulnerabilities or security issues affecting components on which our services depend.

Relevant security work may include areas such as:

• dependency management;
• software updates;
• architecture review;
• remediation of identified issues;
• provider updates; and
• review of relevant technical risk.

Our software-security capabilities continue to mature as part of the wider security programme.

We do not claim that a particular automated vulnerability-scanning, dependency-scanning or software-security tool operates across every Talent Cloud repository or environment unless that position has been appropriately verified.

20. Assessments and AI-Assisted Services

Security and privacy considerations also apply to assessment and technology-assisted processing.

Talent Cloud distinguishes between:

• human assessments;
• deterministic calculations;
• technology-assisted matching;
• third-party AI-assisted services; and
• deterministic reporting and analytics.

Where information is transferred to an approved external assessment or AI provider, the security and data-processing implications of that provider form part of the relevant governance consideration.

Further information about these processes is available in our AI & Assessment Transparency Statement.

21. Backups and Resilience

Talent Cloud maintains database backup arrangements for relevant production systems.

Backup arrangements are intended to support recovery from appropriate operational or technical failures.

The existence of backups does not mean that:

• every individual record can necessarily be restored independently;
• deleted information will always remain recoverable;
• every system has identical backup arrangements; or
• backups replace the need for appropriate operational and security controls.

Backup periods and recovery arrangements may differ according to the relevant system and infrastructure.

Backups are one component of resilience.

Their existence should not be interpreted as a representation that Talent Cloud has implemented a particular:

• disaster-recovery architecture;
• recovery-time objective;
• recovery-point objective;
• business-continuity standard; or
• business-continuity certification

unless that commitment has been separately confirmed.

Customer-specific continuity, recovery or availability requirements should be addressed through appropriate due-diligence and contractual processes where material.

22. Security Incidents

A security incident may include an event that affects, or is reasonably suspected of affecting, the confidentiality, integrity or availability of systems or information.

Where we become aware of a suspected security compromise, we assess the circumstances and take appropriate action according to the nature and significance of the event.

Depending on the incident, this may include:

• investigation;
• containment;
• preservation of relevant evidence;
• assessment of affected systems and information;
• remediation;
• engagement with relevant technology providers;
• consideration of affected customers or individuals;
• consideration of contractual notification requirements; and
• consideration of applicable legal or regulatory notification requirements.

Not every technical event is necessarily a personal-information breach or requires the same response.

Conversely, we do not require absolute certainty before considering appropriate action where applicable law, contractual obligations or the circumstances require action based on an appropriate level of awareness or reasonable suspicion.

23. Personal Information Security Compromises

Where a security incident involves personal information, additional privacy and data-protection obligations may apply.

The appropriate response depends on matters such as:

• the information involved;
• the nature of the incident;
• whether information was accessed or acquired without authorisation;
• affected individuals and organisations;
• the likely consequences;
• applicable law; and
• relevant contractual responsibilities.

Where Talent Cloud processes information on behalf of another organisation, we may also have obligations to assist or notify that organisation according to the applicable processing arrangement.

Our Privacy Notice provides further information about personal-information security compromises.

24. Responsible Disclosure

We welcome responsible reporting of suspected security vulnerabilities affecting Talent Cloud websites or services.

Security concerns should be reported privately to:

[support@talentcloudglobal.com](mailto:support@talentcloudglobal.com)

A useful report may include:

• the affected service or URL;
• a description of the suspected issue;
• safe steps for reproducing it;
• relevant technical information; and
• contact details if you would like us to respond.

We ask reporters not to:

• access information that is not their own;
• alter information without authorisation;
• retain personal or confidential information obtained without authorisation;
• intentionally disrupt our services; or
• publicly disclose a vulnerability before we have had a reasonable opportunity to investigate it.

Our Responsible Disclosure guidance provides further information.

25. Security Testing and Continuous Improvement

Our security environment continues to develop as the platform and organisation mature.

Security improvement may involve areas such as:

• architecture review;
• dependency management;
• access-control review;
• authentication improvements;
• infrastructure review;
• monitoring;
• security testing;
• incident preparedness;
• provider governance; and
• operational process improvement.

The inclusion of an area in our security programme does not mean that every possible control, tool or assurance mechanism is already implemented across every environment.

We distinguish between implemented controls and future or developing controls.

We do not present planned security measures as though they are already operating.

26. Customer Responsibilities

Security is a shared responsibility.

Customers and programme organisations using Talent Cloud should take reasonable steps to protect their own use of the platform.

Depending on their role, this may include:

• granting access only to authorised people;
• removing or changing access when responsibilities change;
• maintaining accurate user information;
• protecting account credentials;
• avoiding shared accounts;
• applying appropriate internal access governance;
• ensuring users understand their responsibilities;
• reporting suspected compromise promptly;
• using platform information only for authorised purposes; and
• maintaining appropriate security controls for their own devices, networks and connected systems.

Talent Cloud cannot protect a customer environment from every risk created by compromised customer credentials, insecure customer devices or inappropriate access granted by the customer.

27. Exported and Downloaded Information

Authorised users may be able to export, download or otherwise transfer information from Talent Cloud for legitimate programme, reporting or operational purposes.

Once information has been legitimately exported from the Talent Cloud-controlled environment, the security of that separate copy may depend on systems, devices and processes controlled by the customer or authorised recipient.

Customers and authorised users are therefore responsible for protecting information they export, download or transfer into systems, devices or locations under their control.

This may include applying appropriate:

• access controls;
• storage security;
• confidentiality protections;
• sharing restrictions;
• retention arrangements; and
• deletion processes.

Talent Cloud's platform security controls cannot continue to protect a separate copy after it has legitimately left the Talent Cloud-controlled environment.

This does not remove any legal or contractual responsibilities Talent Cloud may continue to have in relation to the original processing.

28. User Responsibilities

Individual users also contribute to platform security.

Users should:

• keep passwords and authentication information confidential;
• not share accounts;
• use only accounts they are authorised to access;
• secure devices where appropriate;
• avoid accessing the platform through devices they know to be compromised;
• exercise care with unexpected links or requests for credentials;
• report suspected account compromise promptly; and
• comply with applicable acceptable-use and security requirements.

Users should never attempt to bypass security controls or access information they are not authorised to view.

29. Security Certifications and Standards

Talent Cloud may consider recognised security standards, frameworks and industry practices when developing our security approach.

A reference to a security standard, framework or good practice does not mean that Talent Cloud is certified against that standard.

At the date of this Statement, we do not publicly claim:

• ISO 27001 certification;
• SOC 2 certification or attestation;
• Cyber Essentials certification; or
• another security certification

unless a current status is expressly confirmed through appropriate Talent Cloud documentation.

We will not present a certification as current unless there is an appropriate basis for that claim.

30. Customer Security Assurance

Enterprise and programme customers may require additional security information before using Talent Cloud.

Depending on the proposed service, confidentiality requirements and appropriate scope, additional due-diligence information may be available concerning matters such as:

• architecture;
• hosting;
• access controls;
• authentication;
• infrastructure;
• data processing;
• international access;
• technology providers;
• logging;
• backups;
• incident governance;
• retention;
• assessments and AI-assisted processing; and
• other relevant security matters.

Public website statements provide a general transparency baseline.

They do not replace a customer-specific:

• security questionnaire;
• security schedule;
• data-processing agreement;
• service description;
• procurement response; or
• other contractual commitment

where one is required.

Evidence Before Assurance

Where a customer requires confirmation of a specific security control, certification, configuration or technical measure, we aim to respond on the basis of current evidence rather than assumption, historical configuration or intended future state.

Where appropriate, confirmation may require input from the relevant technical, security, privacy or legal owner before an assurance is given.

31. Confidential Security Information

Transparency is important, but responsible security also requires some information to remain confidential.

We may therefore decline to publish or provide detailed information concerning matters such as:

• credentials or secrets;
• sensitive security configurations;
• detailed infrastructure topology;
• known vulnerabilities;
• exploit techniques;
• detailed penetration or security-testing information;
• internal access arrangements;
• security-sensitive logs; or
• other information where disclosure could materially increase security risk.

This does not mean that legitimate customer assurance requests will automatically be refused.

Where appropriate, more detailed information may instead be provided:

• through a controlled due-diligence process;
• to appropriately authorised recipients;
• under suitable confidentiality arrangements; or
• at a level of detail that provides meaningful assurance without unnecessarily increasing security risk.

32. Current Assurance Position

Our security environment continues to mature alongside the Talent Cloud platform.

We distinguish between the following categories.

Implemented Controls

These are controls or operational arrangements that currently exist and can be supported by available evidence.

Security Requirements and Governance

These define how we expect security to be managed and how the environment should continue to develop.

A governance requirement does not necessarily mean that every technical mechanism associated with that requirement is already fully implemented.

Customer-Specific Commitments

These are security obligations expressly agreed with a particular customer through an applicable agreement or schedule.

Customer-specific commitments should not be inferred merely from general public website language.

Evidence Before Assurance

Security assurances should be based on evidence.

Where a statement depends on a specific configuration, provider, environment or technical control, the relevant evidence should be checked before the statement is treated as current.

Our Claims Discipline

We aim to describe our security position accurately.

We do not present:

• planned controls as implemented controls;
• optional controls as universally mandatory;
• configured but inactive services as active production services;
• a security capability as applying to every product when it does not;
• a certification as current where it is not;
• an intended configuration as a verified production configuration; or
• a customer-specific commitment as a universal platform commitment.

33. What We Do Not Claim

Talent Cloud does not claim that:

• any internet or cloud service can be completely secure;
• our platform is immune from every vulnerability or cyber threat;
• every possible security control has been implemented;
• every Talent Cloud product has identical security controls;
• every supported third-party integration is active in production;
• all platform access occurs from South Africa;
• multi-factor authentication is currently mandatory for every account or environment;
• every security event can be prevented;
• every dependency is free from vulnerabilities;
• backups eliminate all operational or data-loss risk;
• the existence of backups establishes a particular disaster-recovery capability;
• every customer security requirement automatically applies to every deployment; or
• a public Security Statement replaces customer-specific security diligence.

Security requires ongoing technical, operational and governance work.

34. Relationship With Our Other Governance Documents

This Security Statement should be read alongside our other public governance documents.

Privacy Notice

Explains how personal information is processed, including security, international processing and privacy rights.

Trust & Compliance Centre

Provides an overview of our wider public governance position and directs users to the appropriate detailed documents.

AI & Assessment Transparency Statement

Explains human assessment, readiness, matching and AI-assisted processing.

Responsible Disclosure

Explains how suspected vulnerabilities should be reported.

Website Terms of Use

Sets out the conditions applying to use of our public website.

Cookie Policy

Explains cookies, browser storage and similar public website technologies.

Accessibility Statement

Explains our approach to accessible website and platform experiences.

Customer agreements, data-processing agreements, security schedules and other contractual documents may create additional obligations for particular services or relationships.

Where an applicable signed agreement creates a specific security obligation concerning a matter within its scope, that agreement governs that obligation.

35. Changes to This Statement

We may update this Security Statement as:

• our platform changes;
• security controls develop;
• infrastructure changes;
• providers change;
• operational practices mature;
• customer requirements develop; or
• legal and regulatory requirements change.

The current version and last-updated date will be published on the relevant Talent Cloud website.

A change to this public Statement does not by itself amend a customer-specific contractual security commitment.

Where a contractual security commitment needs to change, that change is governed by the applicable agreement.

36. Contact Us

For security questions, due-diligence enquiries or suspected security concerns, contact:

Talent Cloud Global Ltd

Suite A 82 James Carter Road Mildenhall Suffolk IP28 7DE United Kingdom

Registered in England and Wales Company number: 16914164

Email: support@talentcloudglobal.com

Suspected vulnerabilities should be reported in accordance with our Responsible Disclosure guidance.