TalaStar Digital Ltd is committed to protecting the confidentiality, integrity, and availability of all information assets entrusted to us. This policy defines the security principles, controls, and responsibilities that govern how we handle data and operate our systems.
ISO 27001 Principles | UK GDPR | Effective: 10 April 2026 | Version 1.0
TalaStar Digital Ltd (Company No. 17060305) is an early-stage technology company. We do not currently hold ISO 27001 certification, Cyber Essentials accreditation, or any formal security certification. This policy adopts the principles of ISO 27001 as a guiding framework, not as a claim of certification. Our security measures are proportionate to our current size, data processing activities, and risk profile. As the company grows, we will pursue formal certification where appropriate and proportionate.
Every security decision at TalaStar Digital is guided by the CIA triad — the internationally recognised foundation of information security.
Information is accessible only to those authorised to access it. We apply the principle of least privilege — every person and system receives only the minimum access needed to perform their function.
Information is accurate, complete, and has not been tampered with. We use checksums, version control, and audit logging to ensure that data remains trustworthy throughout its lifecycle.
Information and systems are accessible when needed. We use managed cloud infrastructure with built-in redundancy, automated backups, and monitoring to minimise downtime.
Our security controls are organised into six domains, each with specific measures proportionate to TalaStar's current operations and risk profile.
Principle: Least privilege by default
As a sole-founder company, access control is currently straightforward. These principles are documented now so they scale correctly as the team grows.
Principle: Encrypt at rest and in transit
TalaStar currently processes minimal personal data (account emails and names only). These measures are proportionate to our current data footprint and will be expanded as data processing increases.
Principle: Defence in depth
TalaStar uses managed hosting services (Manus, cloud providers) which handle physical security, network firewalls, and OS patching. We do not operate our own data centres or physical servers.
Principle: Zero trust architecture
Network security is primarily managed by our hosting platform. TalaStar configures application-level security controls within the platform's security boundary.
Principle: Secure by design
Application security is continuously improved. We do not currently conduct formal penetration testing or third-party security audits — these are planned as the company scales.
Principle: Trust but verify
TalaStar is currently a sole-founder company. Personnel security controls are documented for when the team expands. The founder is the only person with access to production systems.
If a security incident occurs, TalaStar Digital will follow this five-step procedure to contain, investigate, and resolve the incident while meeting our legal obligations.
Identify the nature, scope, and severity of the incident. Determine what data or systems are affected and whether the incident is ongoing.
Take immediate action to limit the impact. This may include revoking access credentials, isolating affected services, or taking systems offline if necessary.
Assess whether personal data has been compromised. If a personal data breach meets the threshold under UK GDPR Article 33, notify the ICO within 72 hours. Notify affected individuals without undue delay if there is a high risk to their rights.
Remove the root cause of the incident. Restore affected systems from clean backups. Verify that the vulnerability has been addressed before restoring normal operations.
Document the incident, response actions, and lessons learned. Update security controls and this policy if the incident reveals gaps. Communicate findings to relevant stakeholders.
Honest note: TalaStar has not experienced a security incident to date. This procedure is documented proactively. As a sole-founder company, incident response is currently the founder's direct responsibility. As the team grows, a formal incident response team with defined roles will be established.
TalaStar Digital references the following frameworks. We are honest about which we actively comply with, which we aspire to, and which are delegated to our service providers.
Data protection and privacy requirements for personal data processing
Applicable — actively complied with
Privacy and Electronic Communications Regulations — cookie consent and marketing
Applicable — actively complied with
International standard for information security management systems
Aspirational — principles adopted, certification not pursued at current scale
UK government-backed scheme for baseline cybersecurity
Planned — to be pursued as the company scales
Industry-standard awareness document for web application security risks
Referenced — security measures address applicable risks
Payment Card Industry Data Security Standard
Delegated — all payment processing handled by Stripe (PCI Level 1 certified)
If you discover a security vulnerability, suspect a data breach, or have any concern about the security of TalaStar Digital's systems, please report it immediately. We take all security reports seriously and will respond within 48 hours.
This Information Security Policy has been approved by the sole director of TalaStar Digital Ltd and applies to all persons with access to TalaStar Digital's information assets and systems.
Approved by
Kristal Jane Apurado
Founder & Sole Director
Policy Details
Effective: 10 April 2026
Next Review: 10 April 2027
Version: 1.0
TalaStar Digital Ltd | Company No. 17060305 | England & Wales
TalaStar Digital Ltd uses cookies to ensure the basic functionality of our website (essential cookies). We also use optional cookies for analytics and marketing, but only with your explicit consent. We never sell your data. You can change your preferences at any time. Read our Cookie Policy