Security and data protection
Business software holds business-critical data. Here’s how we approach protecting it, in plain language and without inflated claims.
Access control
Role-based permissions so people only see and do what their job requires. Strong password rules and optional two-factor sign-in where appropriate.
Encrypted connections
All applications are served over HTTPS. Sensitive values such as passwords are stored hashed, never in plain text.
Backups and recovery
Scheduled backups of your data, and restore procedures that are tested, so a mistake or incident is a short delay, not a disaster.
Secure development
Input validation, protection against common web attacks, dependency updates and code review before release. Secrets are kept out of source code.
Least privilege
We ask for the minimum access needed to do the work, use separate credentials per project and remove access when the project ends.
Clear ownership
You own your data and, once the project is paid for, the code we write for you. We document how the system works so you’re never locked in.
Personal data and PDPA
When we build systems that handle personal data, such as customer records in a CRM, we design them with Malaysia’s Personal Data Protection Act 2010 in mind: collecting only what’s needed, limiting who can see it and supporting correction and deletion. Your business remains responsible for how it uses its data, and we’re happy to discuss the practical requirements at the start of a project.
Confidentiality
We treat everything you share as confidential. We’re happy to sign a mutual non-disclosure agreement before you send sensitive details such as internal processes, pricing or customer data.
Hosting and third-party services
We recommend hosting that suits your size and risk, and we explain any third-party services involved, such as email delivery or payment gateways, so there are no surprises. Where a system connects to your accounting, POS or the MyInvois API, credentials are stored securely and scoped to the minimum permissions.
What we don’t claim
We don’t claim formal certifications such as ISO 27001 or SOC 2, and no software can be guaranteed free of risk. What we commit to is careful engineering, sensible defaults and prompt action if something goes wrong. If your industry requires specific certifications or audits, tell us early and we’ll advise honestly on what’s achievable.
Report a concern
If you believe you’ve found a security issue on this website or in something we’ve built, please email hello@uniqsign.com with the details. We’ll acknowledge your report within 1–2 working days and take it seriously. Please don’t publicly disclose the issue until we’ve had a chance to fix it.
Questions about security?
Email us your requirements and we’ll explain how we’d handle them for your project.