Information Security Policy

Version 1.0 · Adopted 25 July 2026 · Reviewed annually or on material change

This policy describes how TCG Hamster protects the information entrusted to it by its users, and by the merchants and platforms it integrates with. It describes controls that are in place, not intentions.

1. Scope and responsibility

This policy covers all systems, data and third-party integrations operated by TCG Hamster in delivering the tcghamster.com marketplace. All personnel and contractors with system access are required to follow it.

Security ownership. Information security is owned by the company director, who is a practising IT security professional and has led organisations through ISO/IEC 27001 certification in previous roles. Security is assessed against recognised ISO 27001 control domains — access control, cryptography, operations security, supplier relationships and incident management. TCG Hamster is not itself ISO 27001 certified; the standard is used as the reference framework for the controls described here. The director approves this policy, reviews it at least annually, and leads incident response.

2. Infrastructure and network security

TCG Hamster operates no self-managed servers and no corporate network. All production workloads run on managed cloud platforms: Vercel (serverless compute, TLS termination, edge network, platform-level DDoS mitigation and request filtering) and Supabase/PostgreSQL (managed database, authentication and object storage, with provider-managed network isolation, patching and backups). Network-layer segregation, intrusion prevention and infrastructure monitoring are delivered by these providers under their own certified security programmes. Our responsibility is the application, data and access layers described below.

3. Environment separation

Production and staging run as entirely separate projects with separate databases, credentials and secrets. Schema changes are applied through a version-controlled migration ledger and exercised in staging before production. Production data is not copied into development environments.

4. Access control

  • Privileged database credentials execute server-side only and are never transmitted to browsers or mobile clients.
  • Row-level security is enforced on all user data tables, so an authenticated user's queries can reach only their own records. Administrative functions are gated on an explicit account-level flag.
  • Third-party platform credentials are held per integration and scoped to the minimum permissions that integration requires.
  • Secrets are stored in the deployment platform's encrypted environment variable store, never in source control.

5. Data protection

  • In transit: HTTPS/TLS is enforced for all connections; non-TLS requests are redirected.
  • At rest: managed database and object storage encryption is provided by the platform. Third-party access tokens and integration secrets are additionally encrypted by the application using AES-256-GCM before being written to the database.
  • Integrity of inbound data: every inbound webhook — payment, commerce platform or partner — is verified by HMAC signature using a constant-time comparison before any processing occurs. Requests with a missing or invalid signature are rejected.

6. Data minimisation and third-party data

  • Payment data: card details are never received, processed or stored by TCG Hamster. All payments are handled by Stripe, a PCI-DSS Level 1 service provider, via hosted checkout.
  • Connected merchant platforms: where a merchant connects a commerce platform, we ingest the product, inventory and order-status data required to keep listings and stock accurate. Merchant end-customer personal data is not required, requested or retained.
  • Data received from integrations is used solely to operate that merchant's own listings on the marketplace. It is never sold, licensed, redistributed, or exposed through any public API of ours.

7. Retention and deletion

Integration data is retained only while the integration remains connected. When a merchant disconnects or uninstalls an integration, the associated access token is invalidated immediately and the stored credential record is erased on request or within the platform's mandated window. Deletion and data access requests received through platform compliance channels are actioned and answered within the timeframe that platform requires.

8. Logging and monitoring

Application, database and serverless function logs are retained by the platform providers and reviewed for errors and anomalous activity. Automated jobs record their outcomes, and integration failures surface to operators through in-application notifications.

9. Secure development and security testing

All application code is version-controlled. Changes are built and type-checked before deployment, deployed first to staging, and promoted to production only from a reviewed mainline branch. Database changes are applied via sequential, reviewed migrations.

AI-assisted security review. Code changes are subject to automated, AI-assisted security review before release, and the codebase is reviewed periodically on the same basis. Reviews target the vulnerability classes that matter for a marketplace holding money and third-party credentials: missing or bypassable authentication and authorisation on API endpoints, injection and unsafe query construction, secret and token handling, unverified inbound webhooks, insecure direct object references, and information disclosure through error paths or diagnostic endpoints. Findings are triaged by the director and remediated before release.

This is a code-level assurance activity and is not a substitute for independent penetration testing, which we have not yet commissioned. Externally exposed infrastructure is operated and tested by our managed platform providers under their own assurance programmes.

10. Incident response

Suspected security incidents are triaged by the director on discovery. The response sequence is: contain (revoke affected credentials and disable the affected integration), assess scope from logs, remediate, and notify. Where an incident affects a connected platform's data, that platform is notified through its published security contact without undue delay. Where personal data of UK data subjects is affected, the ICO is notified in line with UK GDPR obligations.

11. Compliance

TCG Hamster processes personal data in accordance with the UK GDPR and the Data Protection Act 2018. Our Privacy Policy and Terms of Service set out how we handle personal data and operate the marketplace.

12. Contact

Security questions, vulnerability reports and platform security reviews: security@tcghamster.com. We welcome good-faith vulnerability reports and will acknowledge them promptly.