Security & your data

The question everyone asks first: “what if you get hacked?”Live

Fair question, and here is the direct answer. Every document and every uploaded file is locked in its own individual envelope before it is written to storage. Each file gets its own one-time key. That key is then locked with a key that belongs only to your firm. And your firm’s key comes from a master key that is not kept in the database at all — it lives in a separate encrypted store.

So if someone stole our entire database and our entire file store tomorrow, what they would have is scrambled bytes. Not a passport scan. Not a shareholder register. Nothing readable. They would need the master key as well, and that is somewhere else.

Each envelope is also stamped with which firm it belongs to and a fingerprint of the file itself. Take a sealed file out of one firm and try to open it inside another — it refuses. The maths refuses, not a setting someone could switch off.

One more thing worth knowing: if the key is ever unavailable, the system will not save the file at all. It fails and tells you, rather than quietly storing your client’s passport unprotected.

Sensitive data is masked everywhereLive

Identity numbers are never shown in full. Across the screen, in exports, and in anything the AI sees, an NRIC / FIN / passport number is masked to its first character and last four digits — for example S1234567A becomes S****567A. This means even the AI that drafts your documents never handles a raw identity number.

What exactly is encryptedLive

Two separate things are protected, because they are two separate risks:

• Whole files — every generated document and every uploaded file, including scanned IDs, sealed individually before storage.
• Individual fields — the identity number, address and email on a person record, plus sensitive answers in client forms, are each encrypted on their own. So even a database row read directly shows nothing useful.

Nobody can go around the app — not even with a valid loginLive

A common weak spot in products built on modern cloud databases is that a logged-in user can talk to the database directly and skip the application entirely — bypassing every approval, KYC and filing check the product carefully implemented.

That door is closed here. The database refuses writes from client logins by default. Every change has to come through the application, which means it has to pass four-eyes approval, KYC gates and filing-evidence checks. There is no back route.

An audit trail that cannot be editedLive

Every meaningful action — a document generated, a status changed, a company created, a firm renamed, a KYC gate blocking a document — is written to an audit log. You can read it in Settings → Audit Log or the right panel’s Activity tab.

Crucially, the log is append-only. Records can be added but never changed or deleted — and this is enforced at the database level, not merely by the app. That gives you a tamper-evident history you can stand behind in an inspection.

Export everything — no lock-inLive

Your data is yours. An admin can export the entire firm from Settings → Account → Export firm data. Three shapes are available:

• JSON — a full snapshot: companies, officers, tasks and their workflow state, KYC dossiers, invoices and billing, fee schedule, documents and an audit summary.
• CSV — the ACRA-style registers of companies and officers.
• ZIP — the JSON and CSVs plus every generated document file, with a manifest of what is included.

Inspection evidence packLive

CorpSec.app assembles a regulator-ready evidence pack — a cover attestation, each company’s CDD dossier, a firm summary, and an integrity manifest that lets a third party re-verify nothing was altered, with honest flags wherever screening was on demo data.

It is available today from Settings → Inspection Pack (admin only). Choose the pack type — ACRA CSP AML/CFT, PDPC data protection, or general due-diligence — and generate the bundle in one action. The full JSON / ZIP data export above remains available for a raw snapshot.

Where your data is hosted

CorpSec.app hosts data in Singapore — in-region, close to your clients and to ACRA, so there is no cross-border transfer question to answer. For the full posture — sub-processors, retention and the data-processing agreement — see the Security and Privacy pages.

How the AI works — and what leaves your systemsLive

AI drafting calls out to a third-party provider (Anthropic) over the public internet, using standard TLS encryption in transit — the same kind of connection your browser uses everywhere else on the web.

What we send is never the original file. Not a passport scan, not a photo of an ID card, not a PDF — only text, and only after it has already been through the same masking described above. An identity number becomes S****567A before the request ever leaves our servers.

This is not something we are promising to do carefully — it is enforced by a dedicated guard that inspects every outbound request before it can reach the AI provider. If anything that looks like a raw file, an image, a storage link, or an unmasked identity number turns up anywhere in that request, the guard blocks it and the call is never made. There is no code path that skips this check.

What we don’t haveLive

A security page that only lists strengths is a brochure. These are the real gaps, so you can decide with your eyes open:

• We do not hold SOC 2 or ISO 27001. Both are on the roadmap. If your client or your bank requires a current certificate today, we are not yet the right fit and we will tell you so.
• No independent penetration test has been done yet. Our controls are covered by automated tests that run on every change — including tests that deliberately try to break each control — but that is our own testing, not a third party’s.
• Backups are the managed backups on our hosting plan. We have not run a timed full-restore drill, so we publish no recovery-time guarantee. Your own export (above) is the backup nobody can take away from you.