Your IT or compliance team will want this before they approve a new vendor. Most rows take a minute to check from your own browser.
| Practice | What we do | Where you check it |
|---|---|---|
| How the site is built | Plain pages served as written. The public server holds the pages and the files that draw them | Open /wp-login.php or /admin on this site |
| Browser security settings | HTTPS only, a content policy, frame and file-type protection, a referrer rule and a permissions rule, on every page | securityheaders.com, enter upcial.com.my |
| HTTPS forced | Any http:// address moves to https:// before a page loads, checked before launch | Type http://upcial.com.my into your browser |
| Private keys kept on the server | Private keys, like this site’s mail key, sit in the host’s settings. Every page is read for them before launch | View source on our contact page |
| Who holds each account | A written handover names every account the site runs on, who holds it and the date. Passwords travel in a password manager | Our handover template, shown on request |
| What you own | Full rights in the design and code pass to you on final payment | The Service Agreement, clause 7 |
| Every version kept | Each version we publish is recorded with its date, so an earlier page can be put back | Ask for your own site’s version history at any time |
| A breach involving your data | We phone you and write to you within 24 hours of becoming aware | The PDPA agreement, clause 6.1 |
Under the PDPA as amended by Act A1727, your firm is the data controller for what your site collects. We act as your data processor.
So our side goes in writing, in a PDPA agreement signed with the Service Agreement. It names each party’s role and the services your project data passes through.
Has your compliance team sent a vendor form? We keep a vendor due-diligence pack for exactly that, available on request.
The PDPA as amended by Act A1727
Data protection officers, breach notification, and what a contact form has to say.
Data protection by design
The Commissioner’s guideline, and what it asks of the studio that builds your forms.
Who owns your domain
How to read your own domain record, and whose login can move it.
Who we are, and where to verify it
Registration, a live client site, the prices and the terms.