Security policy

Scope

This policy covers the CALACC application and the data it holds on behalf of customer companies. It describes the controls we operate today. It deliberately does not claim certifications we do not hold — CALACC is not currently SOC 2 or ISO 27001 certified.

Authentication and access

• Credentials are stored as salted password hashes, never in recoverable form.
• TOTP two-factor authentication is available per account, with single-use backup codes.
• Roles set a baseline, and individual capabilities are granted per user.
• Company data is scoped: every query is filtered by company, so one company cannot read another's records.
• Sessions are invalidated when a password changes.

Transport and application hardening

• TLS in front of the application, with secure, HttpOnly, SameSite cookies and HSTS.
• CSRF tokens on state-changing requests.
• A restrictive Content-Security-Policy and frame-denial headers to prevent injection and clickjacking.
• Rate limiting on authentication endpoints.
• Reverse-proxy headers validated, so the client address the application records is the real one.

Data protection

• Values that must be recoverable, such as stored certificates, are encrypted with a key held outside the database.
• Actions are recorded in an audit log with the acting user and timestamp.
• The database is dumped and stored off-site on a schedule, with the retention period configured per deployment.
• Records are retained for the period required by Malaysian tax and company law.

Incident response

Suspected incidents are triaged on discovery, contained, and assessed for the personal data affected. Where a breach is likely to result in significant harm, affected companies are notified without undue delay so they can meet their own obligations under the Personal Data Protection Act 2010.

Reporting a vulnerability

Please report suspected vulnerabilities privately to calmic@calmic.com.my with enough detail to reproduce the issue. We will acknowledge receipt, keep you informed of remediation, and will not pursue action against researchers who act in good faith and avoid accessing or altering customer data.

Changes

This policy is reviewed as the product changes. The date above records the last material revision.