Draft — requires legal review. This page is a template and has not been reviewed or approved by qualified legal counsel. Do not rely on it as final legal advice or a binding statement until it has been reviewed.

Bahasa Indonesia

Keamanan

Ringkasan praktik keamanan yang diterapkan pada platform myBATI CaaS, yang dioperasikan oleh PT BATI Consulting. Halaman ini bukan sertifikasi; klaim sertifikasi hanya dipublikasikan setelah diverifikasi dengan bukti yang disetujui.

Isolasi Penyewa (Tenant)

Setiap permintaan dicakup oleh organisasi pemanggil melalui kontrol otorisasi berbasis peran (RBAC) di lapisan aplikasi, ditambah kebijakan Row-Level Security PostgreSQL sebagai lapisan kedua yang independen.

Enkripsi

  • Lalu lintas jaringan diarahkan melalui HTTPS/TLS.
  • Kredensial sensitif milik penyewa (mis. rahasia SSO, kredensial penyimpanan kustom) dienkripsi dengan kunci data per-organisasi (envelope encryption), bukan disimpan sebagai teks biasa.

Manajemen Kerentanan

Layanan menyertakan modul pemindaian keamanan (VAPT) untuk domain dan aset yang dikonfigurasi organisasi pelanggan sendiri.

Respons Insiden dan Notifikasi Kegagalan Pelindungan Data

Kami memelihara proses penanganan insiden keamanan dan mengikuti kewajiban notifikasi kegagalan Pelindungan Data Pribadi berdasarkan Pasal 46 UU PDP (lihat Pemberitahuan Privasi).

Melaporkan Masalah Keamanan

Untuk melaporkan kerentanan atau masalah keamanan, hubungi [not yet configured -- pending legal/operations review].

English

Security

A summary of the security practices implemented on the myBATI CaaS platform, operated by PT BATI Consulting. This page is not a certification; certification claims are published only once verified against approved evidence.

Tenant isolation

Every request is scoped to the calling organization through application-layer role-based access control (RBAC), plus PostgreSQL Row-Level Security policies as an independent second layer.

Encryption

  • Network traffic is served over HTTPS/TLS.
  • A tenant's sensitive credentials (e.g. SSO secrets, custom storage credentials) are encrypted under a per-organization data key (envelope encryption), not stored as plain text.

Vulnerability management

The Service includes a security-scanning (VAPT) module for domains and assets the customer organization itself configures.

Incident response and breach notification

We maintain a security incident-handling process and follow the personal-data-protection-failure notification duty under Pasal 46 UU PDP (see the Privacy Notice).

Reporting a security issue

To report a vulnerability or security concern, contact [not yet configured -- pending legal/operations review].