More than thirteen controls. Dated readiness windows. No slogans.

Thirteen named operational controls.

Each control names a specific behaviour, not a posture. If we cannot demonstrate it in a buyer audit, it does not appear here.

1. C1

   Dedicated secure hardware per operator

   Each TTPA operates on a Toptronic-issued laptop which is securely held in secured premises. One secured laptop, one operator, one buyer LinkedIn account at any time. No shared workstations, no BYOD, no personal devices in the Operating Loop. TTPA are issued a Remote Desktop Laptop to connect via a time-restricted and PIN-Enabled encrypted link for each working cession. That issued laptop do not run your account at all and your TTPA has never access to your user name and password, so that in the case of their issued laptop being stolen, it does not affect your LinkedIn account.

2. C2

   Dedicated egress IP

   Operator workstations egress through a Toptronic-controlled IP allocation. No rotating residential proxies, no shared cloud workstations, no Tor exits. The LinkedIn fraud-graph sees one consistent operator on one consistent IP simply because this is similar to the way it would be if your TTPA was sitting in your office. Your dedicated laptop running your LinkedIn account is "FIXED Physically" and never moves. The Toptronic Issued laptop to the TTPA does not have your account on it, it only has the customized remote desktop software to access your laptop using a PIN code valid for the duration of the "Time-Slot Job". The "Time-Slot Job" are prepared in advance using Excel and Word. During that "Time-Slot Job", the majority of the actions are "Copy and Paste".

3. C3

   Identity and access (1:1 binding)

   Your dedicated LinkedIn account laptop is physically in a secure location. Your dedicated LinkedIn account laptop is bound 1:1 to a named TTPA operator on a named Toptronic issued work laptop, only through a secure encrypted remote desktop link, for a "Time-Slot Job" limited in date and time. Your TTPA never knows your user name and your password (and never participate during the 2FA either). Back-up TTPA assignment is documented and we have a monthly backup of all your data. We do not allow silent operator swaps.

4. C4

   Encryption at rest

   All the laptops utilized run BitLocker full-disk encryption (AES-256-XTS). Removable media is GPO-blocked. Workspace mailboxes use Google-managed at-rest encryption (AES-128 at minimum, AES-256 for newer regions) and Proton mail also use encrypted and privacy rich protocols.

5. C5

   Encryption in transit

   Every connection to our public services is protected by modern encryption (TLS 1.2 or newer) — the same kind of protection your bank uses — so nothing you send or receive can be read or altered while it travels across the internet. Web browsers are told to always use that secure connection and never quietly fall back to an unprotected one (a control called HSTS), which removes a common way attackers try to eavesdrop. Our pages are delivered over the newest, faster and more reliable web standard (HTTP/3). And the behind-the-scenes traffic our own staff use to administer the system runs inside a private, fully encrypted tunnel (WireGuard) whose access keys are changed on a regular schedule, so our back office is never left exposed on the open internet.

6. C6

   Credential storage (zero-knowledge)

   All your LinkedIn credentials live in the Toptronic's LastPass. Your TTPA does not have access to the Toptronic's LastPass and only access your laptop which uses these credential, through a secured encrypted remote desktop protocol.

7. C7

   Endpoint security

   Microsoft Defender for Endpoint (EDR) on every laptop. Application allow-list for browser + LinkedIn-only. USB mass-storage GPO-blocked. Auto-patch within 24 hours of Microsoft release.

8. C8

   Backup and recovery

   Monthly encrypted backups of buyer-deliverable artefacts (all Dataset components, CSVs, content briefs). Quarterly restore drill. Other customer requested time slots for encrypted backups possible.

9. C9

   Logging and monitoring

   TTPA Operator laptop telemetry feeds the TTPA Discovery binary (private app). First-party site telemetry (eleven named events) is documented at /legal/privacy/ §1. No third-party tracking pixels — see /legal/privacy/ §2.

10. C10

    Vendor and subprocessor management

    Five named subprocessors at /legal/subprocessors/ — Airwallex, Stripe, Google Workspace, LastPass (Toptronic tenant), Plausible. Thirty-day prior notice on additions, one-business-day buyer veto window.

11. C11

    Incident response

    If something goes wrong, we work to a clear clock (our service-level commitments, or SLAs): we start investigating within 24 hours, contain the problem within 72 hours, and write up exactly what happened and how we will stop it recurring within 10 business days (a post-mortem). If your personal data is ever actually exposed, our breach procedure follows the law (UK/EU GDPR Articles 33 and 34): within 72 hours of confirming a breach we notify the data-protection regulator (the ICO in the UK) and tell the people whose data was affected.

12. C12

    Change management

    Every change to the TTPA Discovery software must pass an automatic gate before it is accepted: if the code will not build perfectly cleanly — any error, or even a warning — the gate blocks it (a pre-commit hook). A second person reviews every change before it goes in (code review), each change is digitally signed so we can always prove who made it (signed commits), and once a version is released its record is locked and cannot be altered after the fact (immutable release tags). We never make rushed, untracked fixes straight onto the live system (no ad-hoc production patches).

13. C13

    Personnel and vetting

    Before anyone is allowed to work on your account, they pass a formal background check (carried out in Hong Kong). At the start of their engagement they sign a two-way confidentiality agreement (a Mutual NDA — template at /legal/nda/), so the duty to keep your information private runs in both directions. They also receive recurring training on spotting scam emails (phishing), handling passwords and logins safely (credential hygiene), and staying within LinkedIn's rules (its Terms of Service, or ToS).