Security

Data residency

We design and operate our services with Malaysia's Personal Data Protection Act 2010 in mind, and we can host and keep your data within Malaysia where data residency matters to you. For customers in regulated sectors, that usually matters more than where the servers are cheapest, so we treat the region as something you choose rather than something we assign.

Infrastructure

• Each customer's workloads run on dedicated instances rather than shared multi-tenant application servers.
• Instances are hardened before handover: unnecessary services removed, firewall rules default-deny, and remote access restricted to key-based SSH.
• We host in reputable data centres and can deploy into a region you nominate, including Malaysia.

Encryption

• Traffic to your services is served over TLS, with certificates provisioned and renewed by us.
• Administrative access to infrastructure is over encrypted channels only.

Access control

• Administrative access is limited to the engineers who need it to run your service, and is removed when they no longer do.
• Staff accounts require multi-factor authentication.
• Access to customer environments is logged, and we access the content you host only when you ask us to for support, or where we must to keep the service running or to comply with the law.

Patching and monitoring

• We track security advisories for the open-source software we operate for you and apply patches, coordinating a window with you where an update needs downtime.
• We monitor availability and resource health, and alert on the conditions that usually precede an outage.

Backups

• Where your plan includes backups, they run on the schedule set out in that plan and are stored separately from the primary instance.
• Backups are a recovery aid, not a guarantee. You should keep your own copies of anything you cannot afford to lose.

Reporting a vulnerability

If you believe you have found a security issue in our website or in a service we operate, email support@dojoapp.ai with the subject line “Security”. Please include enough detail for us to reproduce it, and give us a reasonable window to fix it before disclosing publicly.

We will acknowledge your report within 3 business days and keep you updated while we work on it. We ask that you do not access, modify or delete data belonging to anyone else while investigating, and do not run tests that degrade the service for other customers.

If something goes wrong

If we become aware of a breach affecting your data, we will notify affected customers without undue delay with what we know, what we are doing about it, and what we recommend you do. Where the law requires us to notify a regulator, we will.

Certification

We do not currently hold ISO 27001 or SOC 2 certification. If your procurement process requires a certified provider, tell us early at support@dojoapp.ai.

This document is published in English. Where it is translated, the English version governs.

SUPER SIMPLE TECHNOLOGY SDN. BHD. (202401009740 / 1555590-M) · B323 Merchant Square, Jalan Tropicana Selatan 1, Tropicana, 47410 Petaling Jaya, Selangor, Malaysia · support@dojoapp.ai