In brief
- We work in your systems with named, least-privilege access and remove it within 7 days of the engagement ending.
- Every Mr.Ooi account uses multi-factor authentication; credentials live only in a business password manager.
- Client data is never used to train AI models.
- Breaches affecting client data are reported to you within 48 hours of discovery.
- We do not currently hold ISO 27001 or SOC 2 certification; our roadmap is on the Compliance Status page.
Pages
| Page | What it covers |
|---|---|
| Client Access and Credentials Policy | What access we ask for and how we protect and remove it |
| Security Overview | Accounts, devices, code, hosting, vendors, people |
| Data Retention and Deletion | How long each kind of data is kept |
| Incident Response and Breach Notification | What happens if something goes wrong |
| Vulnerability Disclosure Policy | How to report a security issue |
| Compliance Status | Laws we follow and certifications in progress |
| Tools Status | Uptime of the free tools and the lead form |
| Security Questionnaire Answers | Ready answers for procurement teams |
Security contact: security@mrooi.com.