Compliance Roadmap

Already in place

• Encryption in transit (TLS 1.2 / 1.3) and at rest (AES-256, AWS KMS-managed keys).
• AWS infrastructure with multi-availability-zone deployment and AWS Shield Standard.
• Account-scoped data isolation enforced at the database layer.
• Daily encrypted backups with point-in-time recovery.
• No customer data is used to train AI models. Enterprise data-processing agreements are in place with Anthropic and Google.
• Sub-processor list published with a 30-day change-notice commitment. See Sub-processors.
• Standard Contractual Clauses and the UK International Data Transfer Addendum for cross-border data flows.
• Data Processing Agreement available to all customers. See DPA.
• Vulnerability disclosure contact published at /.well-known/security.txt per RFC 9116.

What we commit to today

• Data Protection Officer designated — accountable for PDPA compliance under the 2024 Amendment Act, reachable at support@smaltai.com. Formal registration with Malaysia's PDPC will be filed when the platform crosses the personal-data thresholds set by the JPDP DPO Appointment Guidelines (20,000 individuals, or 10,000 sensitive-data individuals).
• Singapore data residency — customer data, including authentication and primary application storage, is hosted in Singapore (AWS ap-southeast-1, Supabase Singapore). See Sub-processors for the full hosting map.
• Cross-border transfer safeguards — where personal data leaves the SEA region (for example, AI model providers operating in the US), transfers rely on Standard Contractual Clauses, the UK International Data Transfer Addendum where applicable, and Data Processing Agreements with each sub-processor. Routing follows Singapore PDPC and Malaysia PDPC cross-border guidance.
• Data breach notification — we follow the breach-notification timelines set by Malaysia PDPC (2025 Guidelines), Singapore PDPC (72-hour materially significant breach), and GDPR (72 hours). One incident-response process meets all three.
• Direct accountability as a data processor — under Malaysia's PDPA 2024 Amendment, data processors are directly liable. We accept that responsibility for customer data processed on our platform.

Under evaluation for the regional roadmap

• Singapore Data Protection Trustmark (DPTM, SS 714:2025) — voluntary IMDA / PDPC certification under evaluation as enterprise customer demand emerges. Eligible for the Enterprise Singapore (ESG) Enterprise Development Grant. Targeted for 2027.
• Indonesia data residency — pinned-region deployment evaluated as Indonesian enterprise demand grows; the PDP Agency is expected to issue implementing regulations from 2026 onward.
• Bahasa Malaysia and Bahasa Indonesia language coverage in privacy notices and DPA templates.

Engineering hardening underway

Work that is being completed before the Type I observation point so that the controls map cleanly to what runs in production:

• Browser auth hardening: migrating session tokens out of localStorage into HttpOnly secure cookies, with CSRF tokens on all state-changing endpoints.
• Background workers: moving indexing, memory synthesis, AI employee, and file processing onto a real queue with retry, idempotency, and failure visibility.
• Object storage as source of truth: signed access, TTL cleanup, per-account quotas, and audit logs for file preview and download.
• Billing integrity: immutable credit-transactions ledger with idempotency keys and reconciliation against the payment provider.
• Observability: structured logs with request IDs across the stack, and alerting for auth-denial spikes, provider failures, indexing failures, and ledger mismatches.
• Backup restore testing: documented restore drills on a fixed cadence.

Policy and operational controls being formalised

• Information Security Policy
• Access Control Policy and quarterly access reviews
• Password and MFA Policy (MFA enforced for all production admin access)
• Change Management Policy with required PR review and CI checks before deploy
• Incident Response Plan with severity tiers and tabletop exercises
• Vendor Risk Management Policy with security review before onboarding any vendor that handles customer data
• Data Classification, Retention, and Deletion Policies
• Backup and Disaster Recovery Policy
• Vulnerability Management Policy with dependency and secret scanning in CI
• Secure SDLC Policy
• Acceptable Use Policy (already public — see AUP)
• Employee onboarding and offboarding checklist with 24-hour access removal
• Risk Register reviewed by management on a fixed cadence

What we can share on request

• Security questionnaire response (SIG Lite or your standard format)
• Control overview mapped to SOC 2 Trust Services Criteria
• Architecture and data-flow diagrams
• Vendor and sub-processor inventory beyond what is published on Sub-processors
• Backup, restore, and incident-response procedure summaries
• Risk register summary

Email support@smaltai.com to start a security review or request documents under NDA.