| Question | Answer |
|---|---|
| Do you hold ISO 27001 or SOC 2? | No. See Compliance Status. |
| Do you enforce multi-factor authentication? | Yes, on every Mr.Ooi account. |
| How do you store client credentials? | Only in a business password manager; we prefer named access and never ask for your own login. |
| Do you use subcontractors? | Named freelancers under confidentiality terms; vendors on the Sub-processors page. |
| Where is data stored? | With the providers listed on the Sub-processors page, mainly in the United States and on Cloudflare's global network. |
| Do you train AI on our data? | No. See the AI Use Policy. |
| How fast do you notify breaches? | Within 48 hours to clients. See Incident Response. |
| How long do you keep our data? | See the Retention Schedule. |
| Will you sign our DPA or NDA? | Yes; we also offer our own DPA. |
| Do you carry insurance? | [State professional indemnity and cyber cover, if held] |
For a full questionnaire under NDA, write to security@mrooi.com.