Identity and access
- Google Workspace with enforced multi-factor authentication and security keys for administrators.
- Single business password manager; shared vault items only where a client requires a shared credential.
- Role-based access, reviewed monthly; leavers removed on their last day.
Devices
- Company-approved laptops with full-disk encryption, automatic updates, screen lock and endpoint protection.
- No client data on personal phones except through managed apps (email, chat) with a passcode.
Website and tools
- mrooi.com is served over HTTPS only, with HSTS, a Content-Security-Policy, X-Content-Type-Options, a strict Referrer-Policy and a Permissions-Policy.
- Forms are protected by Cloudflare Turnstile, server-side validation, rate limiting and spam filtering.
- Dependencies are kept up to date and checked for known vulnerabilities.
Code and changes
- Code for client sites is kept in version control with peer review for production changes.
- Secrets are never stored in code repositories.
- Every live change is logged with date, author, purpose and rollback steps.
Vendors
New vendors that will handle client data are reviewed for security and privacy terms before use and listed on the Sub-processors page.
People
Everyone at Mr.Ooi, including freelancers, signs confidentiality terms and completes security and privacy training when they join and every year.
Backups and continuity
Mr.Ooi's own documents are backed up by our cloud providers. For client sites, we take or confirm a backup before every significant change.