Security & Trust
Built for data you’re trusted to protect.
You hold your clients’ passports, their beneficial-owner records and their statutory filings. Handing that to any software is a real decision, and it deserves a real answer rather than a badge. So below is what we actually do, in plain English — including a section on what we don’t have.
At a glance
The question you are really asking: “What happens to my clients’ passports if you get hacked?”
Here is the honest answer, in plain English. Every document and every scanned ID in CorpSec.app is locked in its own individual envelope before it is written to storage. Each file gets its own one-time key; that key is itself locked with a key belonging only to your firm; and that firm key is derived from a master key that is not kept in the database at all.
So if an attacker walked away with our entire database and our entire file store tomorrow, what they would hold is a pile of scrambled bytes. Not a passport. Not a shareholder register. Not one readable line. They would need the master key too — and that lives somewhere else entirely.
The same envelope also carries a fingerprint of the file it belongs to and of the firm it belongs to. Lift one firm’s sealed file into another firm’s account and it simply refuses to open. Encryption here is not a checkbox on an invoice from a hosting provider — it is applied by our own code, before the data leaves our hands.
And if the key is ever unavailable, the system refuses to write the file at all rather than quietly saving it unprotected. We would rather fail loudly than store your client’s passport in the clear.
Encryption we apply ourselves
Most vendors mean “our hosting provider encrypts the disk”. We mean that too — but the layer that matters is the one we apply in our own code, before your data ever reaches storage.
- Every uploaded file and generated document is sealed in an envelope of its own before it is written to storage. Each file gets a unique, single-use key; that key is then locked with a key belonging only to your firm.
- The firm key is derived from a master key that is held outside the database — in the hosting platform’s encrypted secret store. Someone holding a copy of the database does not hold the key that opens it.
- Each sealed file is bound to your firm and to that exact file’s fingerprint. A sealed document lifted out of one firm and dropped into another will not open — the cryptography itself refuses.
- The most sensitive fields on a person record — identity number, address, email — are individually encrypted the same way, not just the file they appear in.
- If the key is ever unavailable, the system refuses to write the file at all rather than quietly storing it unprotected. Failing loudly beats storing a passport in the clear.
- On top of that: TLS for all traffic, plus platform-level disk encryption from Supabase and Vercel.
- Documents are never public. Access goes through a signed link that expires in five minutes.
Data residency
Your data is hosted in Singapore — in-region, close to your clients and to ACRA.
- Application and API run in Vercel’s Singapore region (sin1) — data is processed in-region.
- The database, authentication and file storage run on Supabase.
- No data-transfer approval is needed for a Singapore firm serving Singapore clients.
Multi-tenant isolation
Every firm’s data is isolated in three independent layers — a bug in one cannot expose another tenant.
- Every query is explicitly scoped to your firm (
csp_firm_id) in the application layer. - Even privileged service-role queries carry an explicit firm filter — they never rely on trust alone.
- Supabase Row-Level Security (RLS) policies enforce the same boundary at the database.
- The database refuses writes from logged-in clients by default. Even someone holding a valid login and talking straight to the database API cannot insert, update or delete a row — every change must come through the application, where the approval, KYC and filing checks live. Skipping the app is not a shortcut; it is a closed door.
- The layers are independent: defence in depth, so a single mistake does not leak data.
Immutable audit trail
Every meaningful action is logged to an append-only trail that can never be altered.
- The audit log is INSERT-only — the system never updates or deletes an entry.
- Document generation, KYC/AML screening, approvals and ACRA filings are all logged.
- Each entry captures who did what, when — giving you a defensible compliance record.
- Filed documents carry file anchors (content fingerprints) so a record can be tied to the exact file that was lodged.
PII masking
Identity numbers are masked in the interface and before any data reaches the AI.
- NRIC and passport numbers are shown masked (for example
S••••567A) throughout the app. - The full identity number is never sent to the AI model — only the masked form.
- Masking is applied consistently in document previews, fields and AI context.
- Raw identity documents are never sent to external AI. Scanned IDs and images are processed only within our systems; the AI receives locally-extracted, redacted text — never the raw file, image or its data. Scans it cannot read safely are routed to manual entry, never to an external vision model.
Access control & roles
Role-based access ensures the right people prepare, review and approve the right steps.
- Admin — manages the firm, users and settings.
- Reviewer — reviews and approves drafts before they are filed.
- Preparer — drafts documents and runs workflows.
- Viewer — read-only access for stakeholders who only need visibility.
- Sensitive actions such as approvals and filings are gated to the appropriate role.
- Four-eyes on approvals: whoever prepared a document cannot be the person who approves it. The system checks this itself — it is not a policy someone has to remember.
- If your firm is one person, four-eyes is impossible, so the sole operator may approve their own work — and the audit trail records it explicitly as a self-approval, never dressed up as a second person’s review. Add a second colleague and four-eyes switches back on automatically.
Ready for an inspection, not just compliant on paper
One action assembles an evidence bundle a regulator can verify without taking your word for it.
- Settings → Inspection Pack produces a cover attestation, each company’s CDD dossier, a firm-wide summary and a SHA-256 integrity manifest — so a third party can re-hash the files and confirm nothing was altered after the fact.
- Pack types map to who is knocking: ACRA CSP AML/CFT, PDPC data protection, or general due diligence.
- Where a screening ran on demo or unavailable data, the pack says so in red. A record that looks clean but hides a mock screen is a forgery; a record that admits the gap is examinable. We chose examinable.
- Identity numbers stay masked by default. Producing an unmasked version takes a deliberate extra confirmation, and that action is itself written to the audit log.
Second-AI review & human-in-the-loop
AI drafts are put through a second, independent AI review — and when that review cannot be run, we say so rather than imply it happened. A human signs off before anything is filed.
- After a document is drafted, an independent second-AI review checks wording, statutory references, dates and completeness. The reviewing model is chosen by our servers and is always a different model from the one that drafted the document. You can inspect the evidence under Right panel → Browse → Independent AI review.
- When no independent reviewer is available, the document changes while the review is running, or the review record cannot be saved, the result is shown as “review unavailable” — never as a pass. Provider output does not count as a completed review until its provenance and all result rows are durably recorded.
- A review result is tied to the exact version of the document it read. Edit the document and its earlier results stop counting as current; they stay visible as history, clearly marked, until you re-run the check.
- Results recorded before we introduced version binding — and any check that does not record which version it read — are shown as historical only. They do not count as an independent review of the document on screen.
- Compliance rules act as a hard gate — filings that would breach a rule are blocked, not silently sent.
- Nothing is filed automatically: a human reviewer confirms and signs off every submission.
- The AI does the work and shows its reasoning; you stay in control of the outcome.
Your data is never used to train AI models
We do not use your firm or client data to train, fine-tune or improve any AI model — ours or our providers’.
- Data sent to the AI is used solely to complete the specific request you made.
- Your data is never used for model training, fine-tuning or evaluation.
- Identity numbers are masked before they reach the model, minimising what is ever transmitted.
- This applies to all AI features: drafting, review and KYC/AML analysis.
Backups & recovery
Durability comes from our infrastructure provider’s managed backups. We will not quote you a recovery guarantee we have not tested.
- The database is covered by Supabase’s managed backups on our current plan.
- Recovery relies on platform-level guarantees from Supabase rather than ad-hoc scripts.
- We have not yet run and timed a full restore drill, so we do not publish an RTO/RPO figure. Ask us before you sign and we will tell you exactly which tier we are on and what it covers that day.
- Independent of any of this, you can export everything yourself at any time — see below. Your own copy is the backup nobody can take away.
Data export & portability
Your data is yours. You can export it, and there is no lock-in on your records.
- Company records, officers and documents can be exported from the platform.
- Generated documents are produced as standard .docx files you can keep independently.
- On offboarding we will return or delete your data in line with our DPA and your instructions.
Sub-processors
CorpSec.app relies on these infrastructure providers, each for a specific and limited purpose. We do not sell data, and we list every provider that processes your data here. When we add a provider, this table changes first.
| Sub-processor | Purpose | Region |
|---|---|---|
| Vercel | Application & API hosting (compute, edge). | Singapore (sin1) |
| Supabase | PostgreSQL database, authentication and private file storage. | Singapore / Asia-Pacific |
| Anthropic (Claude) | AI model that drafts and independently reviews documents. Not used to train on your data. | API-based; data not retained for training |
| Resend | Transactional email delivery (notifications, reminders, lead emails). | United States (global email infrastructure) |
Compliance mapping
CorpSec.app is designed to help Singapore CSPs meet their obligations. The controls above map to the frameworks that matter for corporate-secretarial work.
| Framework | How CorpSec.app supports it |
|---|---|
| PDPA (Singapore) | PII masking, purpose-limited processing, in-region hosting, role-based access, export and deletion support, and a template DPA covering data-subject rights. |
| CSP Act 2024 | Immutable audit trail, KYC/AML screening workflows, and retention aligned to CSP record-keeping obligations (≥5 years). |
| Companies Act 1967 | Resolutions, filings and deadline logic encode the actual statutory requirements enforced by ACRA. |
Certifications & roadmap
We believe in stating our security posture honestly. Below is what is in place today and what is planned. We do not claim certifications we do not hold.
What we don’t have
A security page that only lists strengths is a sales brochure. These are the gaps we know about. If any of them is a dealbreaker for you, we would rather you find out here than three months in.
- We do not hold SOC 2 or ISO 27001. Both are on the roadmap and we will not imply otherwise. If your procurement process requires a current certificate today, we are not yet the right fit — tell us and we will say so plainly rather than sell around it.
- We are a small, young company. That is a real risk factor and you should price it in. What we offer against it is full data export at any time (JSON, CSV, or a ZIP with every generated document) so that leaving is always a decision you can make in an afternoon.
- Database backups are the managed backups provided by Supabase on our current plan. We are not going to quote a recovery-time guarantee we have not tested end to end. Ask us and we will tell you exactly what tier we are on at the time you ask.
- Independent penetration testing has not been carried out yet. Our security controls are covered by an automated test suite that runs on every change — including tests that deliberately try to bypass each control — but that is our own testing, not a third party’s.
Doing security due diligence?
We’re happy to walk your team through our controls, complete a vendor questionnaire, or sign a Data Processing Agreement before you go live.
Related: Privacy Policy · Terms of Service · Data Processing Agreement