Share Registry and IPO (MY) Security Protocols

Overview

At Share Registry and IPO (MY), we are dedicated to building trust through robust security, privacy, and reliability in our global connectivity platform. Our Trust Center is designed to provide complete transparency into how we protect your data and ensure seamless, secure operations for users worldwide. By adhering to industry-leading standards, implementing stringent security protocols, and maintaining clear data governance policies, Share Registry and IPO (MY) empowers businesses, and security holders to connect confidently across borders. The Trust Center outlines our commitment to safeguarding your information, ensuring compliance, and fostering a trusted environment for international collaboration and communication.

TABLE OF CONTENTS

• What are the certifications of Share Registry and IPO (MY)?  
• What is the Encryption Method?
• What is Security Testing & Risk Management? 
• What is Backup Policy ?
• What are the Access Controls?
• What are Share Registry and IPO (MY) Incident Response Plan?
   

What are the certifications of Share Registry and IPO (MY)?  

Security Certifications at Share Registry and IPO (MY) 

At Share Registry and IPO (MY), we are dedicated to maintaining the highest standards of security and compliance. Our application is designed to support secure and efficient share registry and initial public offering processes, backed by industry-recognized certifications.

Our Certifications

• ISO 27001:2022: Share Registry and IPO (MY) has achieved the ISO 27001:2022 certification, an internationally recognized standard for Information Security Management Systems (ISMS). This certification demonstrates our commitment to systematically managing information security risks, ensuring the confidentiality, integrity, and availability of your data.

Why This Matters

The ISO 27001:2022 certification ensures that our application adheres to rigorous security practices, protecting sensitive share registry and IPO data against unauthorized access and breaches. This certification underscores our dedication to providing a secure and reliable platform for your financial operations.

What is the Encryption Method?
Data Encryption at Share Registry and IPO (MY) 

At Share Registry and IPO (MY), safeguarding your data is a top priority. Our platform, hosted on Microsoft Azure infrastructure, employs robust encryption methods to protect information both at rest and in transit—ensuring your data remains secure throughout its lifecycle. 

Encryption at rest 

Encryption at rest ensures that all stored files and data are encrypted, providing a critical layer of database-level protection. In MongoDB Atlas, customer data is automatically encrypted at rest using AES-256 to protect all volume (disk) data. This process utilizes your cloud provider's transparent disk encryption, with the provider managing the encryption keys. 

Encryption in transit 

Encryption in transit secures data during transmission between clients and servers, preventing unauthorized access or tampering. In MongoDB Atlas, all network traffic to MongoDB clusters is protected by Transport Layer Security (TLS), which is enabled by default and cannot be disabled. The default version is TLS 1.2. Data transmitted to and between MongoDB cluster nodes is encrypted in transit using TLS, ensuring secure communication throughout.

What is Security Testing & Risk Management? 

Penetration Testing and Vulnerability Management 

Share Registry and IPO (MY) conducts annual third-party penetration testing to assess and strengthen the security of our platform and supporting infrastructure. These assessments are performed by independent security experts using industry-standard methodologies. 

 
All critical and high-risk findings are addressed immediately upon discovery. Medium and low-risk vulnerabilities are tracked and resolved as part of our regular release cycles within the same calendar year. We document all findings and remediation steps to ensure full traceability and follow-through. Summary reports are available upon request under a non-disclosure agreement. 

What is Backup Policy ?

All databases on Azure MongoDB Atlas (DBaas) are Geo-redundant, replicating near-real-time data to Azure Southeast AZ2 & AZ3 region from Azure Southeast Asia AZ1.   

The retention policy for Point-In-Time Recovery (PITR) is 7 days to 7 years for the database.

These backups require no manual intervention and are automatically managed, monitored, and retained according to Azure’s high-availability and durability SLAs. 

What are the Access Controls?

Access Management at Share Registry and IPO (MY) 

At Share Registry and IPO (MY), we prioritize secure, scalable, and role-aware access to your data. Our platform is built on secure cloud Microsoft Azure infrastructure and combines modern authentication with robust internal authorization controls to ensure users access only the data they need. 

Authentication with Auth0 

All user login authentication is managed through Auth0, a secure and flexible identity platform that supports enterprise-grade protocols such as SAML and OpenID Connect. This centralized authentication system provides: 

• Secure login experiences 

• Multi-factor authentication (MFA) 

Auth0 ensures consistent, secure access across environments while enforcing strong identity and access management policies. 

Internal Authorization via Azure 

After authentication, access within the application is governed by our Azure-based access control system, which includes: 

• Role-Based Access Control (RBAC): Users are assigned roles that define what actions they can perform and what data they can access. 

Security Tools Supporting Access Management 

Share Registry and IPO (MY)’s access controls are reinforced by leading security tools: 

• Microsoft Defender for Cloud identifies access misconfigurations and enforces security best practices. 

• Microsoft Sentinel detects suspicious login behavior and access anomalies in real time. 

• Cloudflare protects the authentication layer from external threats like DDoS and credential abuse. 

• Wiz highlights identity risks, such as overly broad permissions or exposed credentials. 

These tools work together to secure both the authentication process (via Auth0) and internal access policies (via Azure), ensuring strong, end-to-end protection 

Public Investor User Access 

Public investors can self-register as users on the platform. After registration, Vistra administrators verify the uploaded documents and either approve or reject the user account, ensuring only legitimate users gain access. 

Vistra User Access 

Internal Vistra users are granted access to data based on assigned roles. Access levels are strictly aligned with their job roles and responsibilities, ensuring that users can only interact with the data necessary for their tasks. 

We also conduct ongoing access monitoring and regular reviews to ensure that user roles remain appropriate over time and that access is promptly adjusted as responsibilities change. 

What are Share Registry and IPO (MY) Incident Response Plan?

Disaster Recovery at Share Registry and IPO (MY) 

At Share Registry and IPO (MY), we are committed to ensuring the continuity and security of your operations. Our comprehensive Disaster Recovery (DR) Plan is designed to minimize downtime and data loss in the event of an unplanned incident, enabling rapid restoration of services across both our Azure infrastructure and authentication systems. 

Disaster Recovery Plan 

Our DR Plan outlines well-defined procedures for recovering critical systems and data. Two key metrics guide our response: 

• Recovery Time Objective (RTO): The maximum acceptable downtime for systems, applications, or networks. Share Registry and IPO (MY)’s RTO is 1 hour, ensuring prompt service restoration and minimal disruption to your global operations. 

• Recovery Point Objective (RPO): The maximum acceptable period of data loss during an incident. Share Registry and IPO (MY)’s RPO is no data loss during peak hours and up to 1 hour of data loss during non-peak hours, meaning we aim to limit potential data loss to no more than one hour's worth of activity outside of periods. 

The DR scope includes restoration of both our Azure-hosted platform and the Auth0-based authentication system, ensuring end-to-end service continuity. 

We’re committed to maintaining your trust through transparency and robust security practices. If you have any questions or need further assistance, please raise a ticket, and our support team will respond as soon as possible.