Security & Compliance
Built for businesses that take governance seriously.
Security architecture, Malaysia statutory workflow readiness, and buyer-facing Trust Center evidence - written plainly for IT and finance review.
Architecture
Security at every layer.
Multi-tenant isolation, strong authentication, tenant-scoped audit trails, and deployment encryption controls — documented for security review.
Row-level tenant isolation
Every tenant-scoped table (~594 of them) carries a PostgreSQL row-level security policy, applied as a database migration and re-verified on every deploy — database-enforced isolation as defense in depth, not just application-layer tenant_id filters.
Authentication & SSO
JWT access tokens with 15-minute expiry and refresh token rotation. TOTP-based two-factor authentication (RFC 6238) with backup codes. Enterprise SSO should be confirmed per deployment.
Full audit trail
Security-sensitive and business-critical actions are logged where wired, with user identity, timestamp, and affected record context available for review.
Encryption & access control
Encrypted deployment controls and TLS settings are confirmed per environment. Role-based access control is enforced across core modules with granular permission sets.
Compliance Matrix
Malaysian statutory workflow readiness.
Buyer-facing pages separate implemented workflows from validations that still require customer credentials, authority setup, or legal review.
Statutory Compliance
- LHDN readiness— MyInvois UBL 2.1 workflow; validation required
- EPF Borang A— Monthly & annual filing
- SOCSO Form 8A— Employer & employee contributions
- EIS Form 3— Employment Insurance System
- CP39 PCB— Monthly tax deduction
- SST-02— Service tax 6–8% and sales tax 5–10% by category
Security Controls
- Row-level tenant isolation— PostgreSQL RLS across ~594 tenant tables; deploy-gated
- 2FA with TOTP— Time-based one-time passwords + backup codes
- SSO (SAML2 / OIDC)— Confirm per deployment
- Full audit logging— Sensitive actions recorded with review context
- RBAC permissions— Role-based access control across all modules
- Data encryption— Confirmed per deployment environment
- Performance SLOs— Per-route p95 OLTP latency targets, monitored
Data Sovereignty
Customer Data is stored in Singapore.
The database, uploaded files and backups are in DigitalOcean’s Singapore region (SGP1). Every vendor that receives Customer Data, and where, is on the published sub-processor list. Tenant isolation is backed by database-level RLS evidence.
Reliability
Reliability evidence you can review.
Uptime commitments
Service-level terms are confirmed in the customer agreement and deployment plan.
Incident response
Real-time health monitoring with automated alerting. Response targets are set in the customer agreement.
Singapore hosting
Application and database infrastructure hosted on DigitalOcean in Singapore. Automated daily backups kept for seven days, plus point-in-time recovery on the managed cluster.
Certification Roadmap
Where we're headed.
We are building toward industry-standard certifications. This roadmap reflects current plans, not completed certifications.
SOC 2 Type II
On roadmapFormal evaluation planned as part of our enterprise compliance program.
ISO 27001
PlannedInformation security management certification targeted for future implementation.
Penetration testing
Planned annuallyThird-party penetration testing to be conducted on an annual cycle.
Need more detail?
We're happy to walk through our security architecture, Trust Center evidence, and infrastructure with your IT or procurement team.