Security & Trust
This page is written for the IT, compliance, and procurement people who review a vendor before a call. It describes how the systems we build and run handle access, data, and abuse, in the specific terms we can stand behind.
Last updated: October 22, 2026. Questions about anything here: hello@indonesianstandard.com.
One client, one instance
Every client runs on its own installation with its own database. Nothing is shared between clients: no tables, no contacts, no accounts.
Access is enforced on the server
Permissions are checked on every request, not only hidden in the menu. What a role cannot see, it also cannot call.
Written down, not implied
What we have is listed. What we do not have yet is listed too, at the bottom of this page, so nobody finds out during an audit.
How the systems are built
These controls are part of the systems we deliver, not options. Each one is checked against the running code before it appears on this page.
Access control
- Role-based access with named roles. An administrator decides which sections of the system each role may open.
- Settings that affect the whole system, such as user accounts, role permissions, and mail configuration, are restricted to administrators.
- The last administrator account cannot be deleted or demoted, so a system can never be locked out of itself.
- An account with no permissions assigned cannot sign in at all; it is refused rather than given a blank dashboard.
Authentication and sessions
- Passwords are stored only as salted hashes using current algorithms. Nobody at Indonesian Standard can read a password.
- Passwords must be at least eight characters and contain both letters and numbers. Changing one requires the current password.
- Repeated failed sign-in attempts lock the account and address out temporarily.
- Session cookies are HttpOnly and SameSite, sent only over HTTPS in production, and regenerated at sign-in and invalidated at sign-out.
In transit and in the browser
- All traffic is served over HTTPS. HTTP Strict Transport Security tells browsers never to fall back to plain HTTP.
- Responses carry security headers that stop the system from being framed by other sites, stop content-type sniffing, and limit what the browser sends in the Referer header.
- This website additionally runs a Content Security Policy that restricts which scripts and resources a page may load.
Public forms and abuse
- Every form carries a CSRF token. Public forms, including registration and contact forms, are rate-limited per address and use a honeypot field against automated submissions.
- File uploads are checked against an allow-list of types and a size limit; filenames are generated by the server, never taken from the upload.
- Staging environments are marked not to be indexed by search engines.
AI features
- Before any text is sent to a model provider, email addresses, Indonesian phone numbers, and 16-digit national ID numbers are masked.
- Assistant logs store a hashed IP address, not the address itself, together with the masked query.
- Assistant requests are rate-limited per address, and every assistant runs under a written set of rules about what it may and may not claim.
Your data
Operational data is the most sensitive thing a client gives us: participant identities, driver records, payroll. These are the terms it is held under.
- Ownership
- The data in your system is yours. We do not reuse it, aggregate it across clients, or use it to train anything.
- Where it runs
- Managed hosting operated by us, or an installation on infrastructure you control when your policy requires it. Decided before the quote.
- Who can reach it
- Our engineers access a client system only to deliver, support, or fix it, through accounts that belong to us, never through a client user account.
- Backups and encryption at rest
- Set per deployment and written into the scope, because they depend on where the system runs. For on-premise installations, your IT team owns the schedule and we configure it with them.
- Export
- A complete export of your database is available on request, in a standard format, at any point in the engagement.
- Personal data
- Processing follows Indonesia's Personal Data Protection Law (Law No. 27 of 2022). What this website itself collects is described in the Privacy Policy.
Reporting a vulnerability
If you find a security issue in this website or in a system we run, email hello@indonesianstandard.com with the subject "Security report". Include the URL or system, the steps to reproduce, and what you observed. We acknowledge every report within 24 hours and tell you what we did about it once it is resolved.
Please do not access or modify data that is not yours, do not run automated scanners against production systems, and give us a reasonable time to fix the issue before sharing it publicly. We will not take action against anyone who reports in good faith under these terms.
What we do not claim
A trust page that only lists strengths is a marketing page. These are the things a careful reviewer will ask about that we do not have yet, so the answer is on record before the question.
- We do not hold ISO 27001, SOC 2, or any comparable certification.
- Two-factor authentication is not yet available in the systems we ship.
- There is no application-level audit log of administrator actions yet. Sign-in and session events are recorded; individual edits are not.
- Application-level encryption of individual fields is not implemented; protection at rest relies on the hosting environment.
- We have not commissioned an external penetration test.
If one of these is a requirement for your organisation, say so during requirement mapping. Some can be built into the scope of your deployment; others we will tell you plainly we cannot meet yet.
Explore Our Ecosystem or Build Your Own.
Schedule a discovery call to see our platforms in action or discuss your custom software requirements. Our technical consultations are free and non-binding.
