Security and certification.
Your registers describe your weaknesses. The company that keeps them is audited against the same standard it helps you reach, and the platform enforces the controls below.
Our certifications and partners
ISO/IEC 27001 certified
Whitesec ID is audited and verified by SGS under UKAS accreditation.
Registered with Komdigi
Whitesec ID is registered as a private electronic system operator (PSE Lingkup Privat) with Indonesia's Ministry of Communication and Digital Affairs.
Official PECB partner
Registered partner for internationally recognised professional training and certification.
Certification body partners of Whitesec ID
Certificates are issued by independent certification bodies. We guide the implementation until your organisation is ready to be audited.
Official certification and assurance partners of Whitesec AU
BSI Group · Certification body
PECB · Certification body
Kiwa Compass Assurance Services · Certification body
RSM Australia · Audit & assurance
Certificates and accreditation evidence are available on request.
How the platform is secured
Workspace isolation
Each organisation has its own workspace. Every table that holds workspace data is protected by row-level security policies in the database, so isolation does not depend on the application remembering to filter. A test plants canary records in one workspace and checks that no other workspace can read them.
Access control
Four access levels: Owner, Editor, Auditor and Viewer. For Viewers the database masks emails, phone numbers and data subject names before they leave it. Which dashboards a member can open is enforced on the server, per workspace plan and per member.
Audit trail
Changes to records are logged with who made them and when, for the workspace's own audits and investigations.
Application and browser protections
HTTPS everywhere with HSTS, a Content Security Policy, framing blocked, MIME sniffing disabled, a strict referrer policy and browser features such as camera and microphone switched off.
Secure development
Development, test and production run as separate environments, and production data is not used for testing. Code follows a secure coding checklist, and the application has been reviewed against the OWASP Top 10 (2025).
This website
No analytics load before you allow them. The site has no forms: you contact us on WhatsApp or by email, so it stores nothing you write to us. The same security headers apply here as in the app.
Report a vulnerability
If you believe you have found a security issue in Whitesec One or this website, email the team below with the details and the steps to reproduce it. Please give us reasonable time to fix it before disclosing it.
- Whitesec ID: support@whitesec.id
- Whitesec AU: support@whitesec.au
- security.txt
See your own registers in Whitesec One.
We walk through the workspaces for the frameworks you need, with the team in Jakarta or Perth.