Compliance

What CALACC does and does not claim

There are two different things called compliance. One is the statutory filing your company owes. The other is a certification a vendor holds. This page separates them.

Supported filings

Statutory work the product covers

Figures are derived from your posted entries, and the deadline is tracked against what has been prepared.

SST-02

Output and input tax for a two-month taxable period, net payable, due the last day of the following month.

PCB / MTD

Monthly tax deduction computed per employee, remitted by the 15th of the following month.

EPF, SOCSO and EIS

Employee and employer contributions computed per statutory table and posted to the ledger.

Form C

Chargeable income and corporate tax estimate, with the return deadline at seven months after the financial year end.

SSM annual return

Tracked against the AGM window that follows the financial year end.

LHDN e-Invoice

Submissions logged against the document they belong to, with responses retained.

What we do claim

Every figure traceable, every calculation tested

This is the claim we are willing to be held to, and it is checkable rather than aspirational.

Traceable

Reports are not assembled from typed-in totals. Balances are derived from posted journal lines, each entry records who posted it and when, and the audit log retains the change history. The dashboard states its basis explicitly — posted entries only, as at a timestamp, with any draft documents excluded and counted.

Tested

An automated suite of 200+ tests covers the areas where a wrong number is expensive: EPF rates, the PERKESO wage-band schedules for SOCSO, EIS and SKBBK, monthly tax deduction including additional remuneration, the RM400 rebate and the zakat offset, payroll posting to the ledger, money integrity against double-posting, the SST-02 figures drawn from posted entries, and backup and restore. It runs against PostgreSQL, because SQLite hides the locking and type behaviour that matters.

Known limits, stated rather than hidden. SOCSO and EIS are computed from PERKESO's wage-band schedule rather than as a percentage of the wage, which would be wrong inside every band. The bands up to RM4,000 are transcribed from Akta 4 Jadual Ketiga Bahagian II and Akta 800; the bands between there and the current RM6,000 ceiling are derived by the rule those rows obey, and reproduce PERKESO's published ceiling figures exactly — employee RM29.75, employer RM104.15, EIS RM11.90 from each party. SKBBK (LINDUNG 24, the 24-hour cover) is computed at 0.75% of the wage band, reproducing all 44 published rows including the RM44.65 ceiling. The schedule states the rate and the amount but not the payer, so it is deducted as an employee share, which is how the published summaries describe it — confirm that against the Act before relying on it. Not covered: nothing in the PERKESO schedule remains unimplemented. Both contribution categories are computed — category 1 (employment injury and invalidity, both parties) and category 2 (employment injury only, employer pays 1.25%, no employee deduction, no invalidity cover, for employees aged 60 and over, first-time contributors at 55 and over, and foreign workers). The category is set on the employee record and snapshotted onto each payslip. Monthly tax deduction supports a bonus (additional remuneration) and a zakat offset, on the payroll run screen and in the standalone calculator. A bonus joins the EPF, SOCSO, EIS and SKBBK base as wages. What it does not model is the other reliefs: lifestyle, medical, spouse and child reliefs are not applied, and the result must be reconciled against e-PCB before a filing is made.
What we do not claim

No certification badges

CALACC does not hold SOC 2 Type II or ISO 27001 certification, and we do not claim to be "bank-grade" or to guarantee a specific uptime figure under an SLA we have not signed. The security page lists the controls that are actually operated, so you can assess them directly.

If your procurement process requires a specific certification or a data processing agreement, tell us — we would rather answer honestly than have you discover a gap later.

Where your data sits

StoragePostgreSQL database
IsolationPer company, enforced in queries
BackupsScheduled dump to object storage
RetentionPer Malaysian tax and company law
Requestscalmic@calmic.com.my

Need a specific answer for procurement?

Ask us directly — including where a control or document does not exist.