myBATI CaaS · Compliance-as-a-Service
Compliance you can prove. Audit-ready, every day.
One workspace for ISO/IEC 27001:2022 and UU PDP: controls, risks, evidence, policies and audits, built for regulated organisations in Indonesia.
- Single sign-on (OIDC)
- Permissions checked on the server
- Hash-chained audit trail
For registered organisations and invited auditors.
CaaSInside the product
Posture
6 modules
- 93
- ISO/IEC 27001:2022 Annex A controls
- 13
- frameworks and regulations in the catalogue
- 3×24
- hour UU PDP breach-notification deadline, tracked per incident
- 8
- report types in PDF and XLSX
Frameworks and regulations in the catalogue
- ISO/IEC 27001:2022
- UU PDP
- BSSN-derived controls
- POJK 11/POJK.03/2022
- PBI 2/2024
- PP 71/2019
- Permenkominfo 5/2020
- PCI DSS v4.0.1
- NIST CSF 2.0
- GDPR
- SOC 2 (TSC 2017)
- ISO/IEC 42001:2023
- ISO 9001:2015
Features
Everything an ISMS needs, in one place
Built on the same records your auditors will ask for, so the work you do every day is also the evidence.
Controls and Statement of Applicability
Track all 93 Annex A controls per organisation, assign owners in bulk, then generate, approve and version your SoA and export it to XLSX or PDF.
Annex A by theme
Organisational37People8Physical14Technological34Risk register
A versioned risk methodology, a likelihood × impact matrix, treatment plans and formal risk acceptance.
Evidence library
Upload, review and version evidence, track expiry, and restore anything removed by mistake.
Policy lifecycle
Approval workflows, distribution and staff acknowledgements, with reminders when a review is due.
Internal audit and CAPA
Audit programmes, checklists, findings and corrective actions, with auditor competence and independence checked on assignment.
UU PDP privacy operations
Records of processing, DPIA, consent, data subject requests and breach notification against the 3×24-hour deadline.
Who it's for
Built for the people who answer to auditors
Compliance and security teams
Run the ISMS day to day: controls, risks, evidence and policies, with owners and due dates.
AdminCompliance managerCompliance officerData protection officers
Keep records of processing, DPIAs, consent and data subject requests ready for UU PDP.
UU PDPAuditors
Plan internal audit programmes and share audit packages with external auditors through the auditor portal.
AuditorLeadership
See posture at a glance and run management reviews with the inputs ISO/IEC 27001 clause 9.3 asks for.
Viewer
How it works
From scope to audit in three steps
- 1
Set your scope
Choose the frameworks that apply, define the ISMS scope and name the owners.
- 2
Do the work
Assess controls, treat risks and attach evidence where the work happens.
- 3
Prove it
Hand auditors an SoA, an audit package and reports built from the same records.
Security
Enterprise-grade by design
Access to tenant data is decided on the server, not just hidden in the browser.
Single sign-on
OIDC with PKCE through your identity provider, with per-organisation OIDC or SAML federation.
SCIM provisioning
Create and remove users from your directory with SCIM 2.0.
Roles and permissions
Five system roles plus custom roles per organisation, enforced on the server.
Tamper-evident audit trail
Append-only, hash-chained events with built-in verification.
Nothing silently lost
Compliance records are soft-deleted and can be restored.
Encrypted credentials
Integration secrets are encrypted with per-organisation keys.