Security & Data Protection · Keamanan & Perlindungan Data (Bilingual)

1) Governance & Principles

• Security by Design and Privacy by Design across the product lifecycle.
• CIA Triad: confidentiality, integrity, availability as core objectives.
• Compliance: Indonesian PDP Law; alignment with international best practices.

2) Data Classification & Handling

• Classes: Public · Internal · Confidential · Restricted (e.g., chat content, summaries, identifiers).
• Restricted data encrypted; access tightly controlled and audited.

3) Encryption & Key Management

• At rest: industry-standard AES-256.
• In transit: TLS 1.2+ (prefer TLS 1.3), HSTS, Perfect Forward Secrecy where supported.
• Keys: centrally managed, periodically rotated, stored in a secure vault.

4) Access Control

• Least privilege & need-to-know across all systems.
• Production data access: limited to designated personnel; MFA enforced; device compliance required.
• Strong authentication, session controls, and periodic access reviews.

5) Logging, Monitoring & Detection

• Centralized, tamper-evident logging with time-synced servers.
• Continuous monitoring for anomalies, brute force, and exfiltration patterns.
• Alerting with on-call rotations and documented runbooks.

6) Network & Infrastructure Security

• Segmentation, firewall policies, private subnets, and strict security groups.
• WAF and abuse rate-limiting to mitigate bot/DDoS-like traffic.
• Regular OS patching, hardened images, and baseline configuration standards.

7) Application Security

• Secure SDLC with code reviews; dependency scanning; SAST/DAST on critical services.
• Secrets kept out of code; rotated and scoped via vault.
• Input validation, output encoding, and parameterized queries to mitigate OWASP Top 10.

8) Vulnerability & Patch Management

• Routine vulnerability scans; remediation prioritized by severity (SLA targets).
• Emergency patch path for actively exploited issues.

9) Data Loss Prevention (DLP)

• Outbound monitoring for restricted data patterns and unusual transfer volumes.
• Clipboard/download controls for admin consoles; watermarking for exports where feasible.

10) Backup & Disaster Recovery

• Encrypted backups with tested restores.
• Documented RPO/RTO for critical data; periodic DR drills.
• Deletion requests also propagate to backups at the end of the backup retention window where technically feasible.

11) Incident Response

• Defined IR plan: detect → triage → contain → eradicate → recover → post-mortem.
• Notification: Written notice to affected data subjects and the competent authority **no later than 3×24 hours** after becoming aware of a personal-data breach, including (i) data involved, (ii) when/how it occurred, (iii) mitigation & recovery actions, per Indonesian PDP Law.

12) Third-Party Risk Management

• Service providers assessed for security posture and bound by data-processing terms.
• Data shared on a minimum-necessary basis; no sale of personal data.

13) Employee & Operational Security

• Confidentiality agreements; ongoing security and role-based training.
• Joiner-Mover-Leaver with prompt access revocation.

14) Data Subject Requests & Retention

• Retention: up to 90 days for conversation content and summaries unless law requires longer.
• Verified deletion on request by the group/Connector owner or authorized representative, including reasonable deletion of derived/identifiable artifacts.

15) Cross-Border Transfers

• Given Singapore hosting, cross-border processing follows applicable PDP transfer bases (e.g., consent and/or contractual safeguards ensuring equivalent protection).

16) Physical & Cloud Security

• Hosted in certified data centers with 24/7 security, access controls, and environmental safeguards.
• Shared-responsibility model: we leverage the cloud provider’s compliance programs while maintaining our controls.

17) Business Continuity & Risk Management

• Risk assessments drive controls; risk registers maintained and periodically reviewed.
• Continuity plans ensure essential services under adverse conditions.

18) Contact

Email: support@sumrize.me · Phone/WhatsApp: +628991900000