Our policies, in full

Enterprise Compliance Policy

The compliance framework: obligations, ownership, monitoring and escalation.

AML / CFT / CPF — KYC Manual

Customer due diligence, sanctions screening, transaction monitoring and suspicious activity reporting.

Data Protection Policy

How personal data is collected, processed, retained and erased, and how data subject rights are met.

Risk Assessment and Treatment Process

How risks are identified, scored, treated and accepted, and who signs off.

Whistleblowing Policy

Protected reporting channels and how disclosures are investigated.

Network Security Policy

Segmentation, perimeter controls, monitoring and permitted traffic.

Cryptographic Policy

Approved algorithms, key management, and encryption in transit and at rest.

Access Control Policy

Least privilege, separation of duties, and privileged access.

User Access Management Process

Joiners, movers and leavers, and periodic access review.

Technical Vulnerability Management Policy

Scanning, severity ratings and remediation timelines.

Incident Response Procedure

Detection, triage, containment, notification and post-incident review.

Bring Your Own Device Policy

Conditions under which personal devices may access company systems.

Secure Software Development Policy

Security requirements, code review and testing through the build pipeline.

Software Development Lifecycle

How changes move from request to production, and the controls at each stage.

Release and Deployment Management Policy

Change approval, deployment, rollback and post-release verification.

Operating Procedure

Day-to-day operational controls, monitoring and service management.