Trust Center
Every control that protects your data — and the data-residency guarantees behind those controls — is documented below. This document is the source of truth for Bijak Cloud’s security posture.
Design principles — Designed around:
Theme · 01
The platform-level guarantees that nothing leaves Malaysian jurisdiction.
Bijak Cloud is designed so that every byte — prompts, embeddings, model weights, audit logs, telemetry, backups — stays inside Malaysian data centres operating under Malaysian jurisdiction.
There is no public-internet failover path, no out-of-region replication, and no exception path. Data residency is a platform property, not a configuration option, and is written into our contractual terms.
Data is encrypted at rest using AES-256 with sovereign-managed keys, and in transit using TLS 1.3 with modern cipher suites only. Cross-region replication inside Malaysia preserves the same encryption envelope.
The Sovereign tier ships with customer-managed keys held in dedicated hardware security modules. Key rotation, revocation, and destruction are auditable events surfaced through the audit log.
Theme · 02
The controls around who can touch your data and what they leave behind.
Single sign-on via SAML 2.0 and OIDC, with SCIM 2.0 for user provisioning. Bring your own IdP — Okta, Azure AD, Google Workspace — or use Bijak Cloud native identities with hardware-key MFA enforcement.
Every platform action — compute provisioning, storage access, inference invocation, key operation — produces an immutable audit record. Retention is configurable per tenant, and records are exportable to your SIEM for compliance review.
Theme · 03
How Malaysian regulatory obligations map to platform controls.
PDPA 2010 (Act 709) alignment is designed into the platform: lawful-basis records, data-subject request workflows, breach-notification runbooks, and Malaysia-only processing. We do not claim ISO 27001 or SOC 2 certification; our security control description and data processing agreement are available under NDA.
Security testing is built into the release programme, including independent third-party penetration tests before major launches. Findings are tracked to remediation, and test summaries can be shared under NDA.
A coordinated vulnerability disclosure programme accepts reports at security@bijakcloud.com. We aim to acknowledge reports within 24 hours and share a remediation timeline within five business days.
We maintain a current list of subprocessors with the data category, location, and purpose for each. Material changes trigger 30-day customer notice.
Next step
Need our security control description, a subprocessor list, or a custom data processing agreement? Our compliance team aims to respond within one business day.
Bijak Cloud · Sovereign AI for Malaysian enterprise