Security and operations · checked 29 September 2026

Your IT team will ask.
The answers are
already here.

A site we build is plain pages, served exactly as written. The public server has one door, and it is the front one. Each page goes out with six browser security settings. At handover you get a written list of every account the site runs on. Each practice below sits beside the place you can check it yourself.

01

At a glance

Four numbers your reviewer asks for first

What a stranger's browser can reach A typical plugin-based site puts a login page, an admin panel, plugins and a database beside its pages. A site Upcial builds puts its pages there, and only its pages. TYPICAL PLUGIN SITE Login page Admin panel Plugins Database Pages A SITE WE BUILD Login page Admin panel Plugins Database Pages What a stranger’s browser can reach on the public server
Login pages on the public site
0
Add /wp-login.php to the end of this site's address. You get a 404.
Browser security settings
6 of 6
On this site. HTTPS only, a content policy and four more.
Accounts listed at handover
6
Domain, hosting, analytics, Search Console, form mail and source code, each with who holds it.
Breach notice to you
24 hours
By phone and in writing, set in the PDPA agreement we sign with you.
02

The practices

Eight things we do, and where you check each

Your IT or compliance team will want this before they approve a new vendor. Most rows take a minute to check from your own browser.

PracticeWhat we doWhere you check it
How the site is built Plain pages served as written. The public server holds the pages and the files that draw them Open /wp-login.php or /admin on this site
Browser security settings HTTPS only, a content policy, frame and file-type protection, a referrer rule and a permissions rule, on every page securityheaders.com, enter upcial.com.my
HTTPS forced Any http:// address moves to https:// before a page loads, checked before launch Type http://upcial.com.my into your browser
Private keys kept on the server Private keys, like this site’s mail key, sit in the host’s settings. Every page is read for them before launch View source on our contact page
Who holds each account A written handover names every account the site runs on, who holds it and the date. Passwords travel in a password manager Our handover template, shown on request
What you own Full rights in the design and code pass to you on final payment The Service Agreement, clause 7
Every version kept Each version we publish is recorded with its date, so an earlier page can be put back Ask for your own site’s version history at any time
A breach involving your data We phone you and write to you within 24 hours of becoming aware The PDPA agreement, clause 6.1
03

Your data

Your data, and the Act we both answer to

Under the PDPA as amended by Act A1727, your firm is the data controller for what your site collects. We act as your data processor.

So our side goes in writing, in a PDPA agreement signed with the Service Agreement. It names each party’s role and the services your project data passes through.

Has your compliance team sent a vendor form? We keep a vendor due-diligence pack for exactly that, available on request.

Before your vendor review

See your homepage first.

We build your homepage on your own content, free, before anything is signed. Bring your IT reviewer to the call.

Request a concept →