Trust Center

Mekari’s infrastructure is hosted on Alibaba Cloud (AliCloud) with server centers located in Jakarta, Indonesia (ap-southeast-5). The Alibaba Cloud Indonesia data center consists of three availability zones within Indonesian jurisdiction (ap-southeast-5a, ap-southeast-5b, and ap-southeast-5c). Customer data is hosted and stored in Indonesia-based data centers in compliance with ISO 27001 security standards and applicable local regulations (UU PDP). Data will not be transferred to other jurisdictions or regions outside of Indonesia without customer consent.

Production workloads are distributed across multiple availability zones within the Alibaba Cloud Indonesia data center to ensure service availability, fault tolerance, and business continuity. This architecture provides data redundancy and supports automated failover in the event of zone-level disruptions, maintaining service resilience with minimal downtime.

A multi-tier network architecture is implemented with Virtual Private Cloud (VPC) isolation, separating components into segmented subnets (public and private). All inbound traffic is filtered through a Web Application Firewall (WAF) for protection against the OWASP Top 10 and serves as a load balancer. Application and database servers are located within isolated private subnets accessible only through specific ports and security groups. Administrative access requires an encrypted VPN connection (AES-256), and the infrastructure is protected by DDoS mitigation services against volumetric attacks.

All Mekari servers are hardened following industry security standards (CIS Benchmarks) with active encryption for data at rest on servers and databases. Unnecessary services, ports, and protocols are disabled by default. Access control is managed through security groups that restrict traffic to authorized protocols only. Administrative access is mandated through encrypted VPN connections to minimize the attack surface and prevent unauthorized access.

Automated and continuous vulnerability scanning is performed across all infrastructure, applications, databases, and source code to identify security gaps. Additionally, annual VAPT is conducted by third-party security firms accredited by BSSN and ASPI, with executive summaries available upon request. Critical vulnerabilities in public assets are remediated within 3 days, while lower-severity vulnerabilities are addressed based on risk-based SLAs. High and critical findings are either remediated or provided with compensatory controls before production implementation.

All customer data is encrypted while in storage using the AES-256 standard, both at the database and storage levels (Full Disk Encryption). Encryption keys are managed via Alibaba Cloud KMS with a centralized key management system, strict access controls, and automated key rotation for maximum security.

All data in transit is encrypted using TLS 1.2 or TLS 1.3 protocols with robust encryption algorithms (ECDHE-RSA-AES-256-GCM). SSL/TLS certificates are managed and renewed automatically to ensure that communication between users and Mekari systems remains continuously encrypted.

Information assets are classified based on value, legal requirements, and sensitivity following the CIA Triad (Confidentiality, Integrity, Availability) principles. Each classification level has predetermined handling procedures, access controls, and protection protocols in accordance with ISO 27001:2022 standards.

Data backups are performed automatically every day with geo-redundant storage across different availability zones in Indonesia. A disaster recovery plan is implemented with a Recovery Time Objective (RTO) and Recovery Point Objective (RPO) of less than 1 hour for critical services. All backup data is encrypted using the AES-256 standard.

Customer data is stored for the duration of the active subscription and complies with applicable local laws and regulatory requirements. Upon service termination or a deletion request, data will be securely erased following documented sanitization procedures to guarantee that data is thoroughly removed and irrecoverable.

All encryption keys are managed centrally through Alibaba Cloud KMS, featuring automated rotation, strict access controls, and comprehensive audit logging.

MFA is mandatory for all users and for administrative access to cloud infrastructure, servers, and internal applications. Mekari Sign systems support TOTP, authenticator apps, and SMS or email verification to provide an additional layer of security beyond passwords.

Access is granted based on job functions and responsibilities using a documented access control matrix. Permissions are granted granularly and enforced across all systems and databases to ensure users only access the data necessary for their specific roles.

Enterprise SSO integration is available via SAML 2.0 and OpenID Connect (OIDC) protocols, with support for various identity providers such as Google Workspace and Azure AD. Centralized identity management simplifies user provisioning, de-provisioning, and the systematic enforcement of authentication policies.

All access follows the principle of least privilege, granting users the minimum permissions required to perform their tasks. Privileged access requires formal approval and undergoes quarterly access reviews to ensure that such rights remain relevant to business needs.

Every user session is secured using OAuth 2.0 tokens with automatic timeouts after a predefined period of inactivity. Administrators can configure concurrent session limits to prevent unauthorized access.

All authentication activities, login attempts, configuration changes, privileged access, and sensitive data access are automatically recorded in tamper-resistant audit trails. Logs are monitored in real-time by the security team and retained for compliance requirements and forensic analysis.

Security is integrated throughout the Software Development Lifecycle with documented policies spanning from development to deployment. Security checks are implemented at every stage using shift-left security practices and quality gates before code reaches production. This includes threat modeling, secure code reviews, and security testing.

Static Application Security Testing (SAST) is integrated into the CI/CD pipeline to detect vulnerabilities at the source code level. Additionally, Dynamic Application Security Testing (DAST) and periodic penetration tests are conducted on running applications to identify runtime vulnerabilities before code is launched into the production environment.

Third-party libraries and dependencies are continuously monitored using automated scanning tools to detect vulnerabilities (CVEs) and prevent the use of vulnerable or outdated components. All dependencies are assessed and updated regularly as part of the secure development process.

All code changes must undergo a peer review process via Request For Change (RFC) mechanisms with active branch protection features. Changes must be reviewed by at least one additional developer to ensure compliance with secure coding standards before being merged into the production branch.

APIs are protected using OAuth 2.0 authentication, API key management, HTTPS/TLS 1.2+ encryption, rate limiting, and input validation. A Web Application Firewall (WAF) provides additional protection against common API attacks, such as those listed in the OWASP API Security Top 10.

A responsible vulnerability disclosure program is established for security findings by both internal and external parties. Security researchers and clients can report vulnerabilities via infosec@mekari.com. Vulnerability assessment results and security summaries are available to clients upon request, subject to NDA terms.

Real-time 24/7 monitoring is applied to all infrastructure and applications using a centralized log management system. All audit logs record login attempts, sensitive data access, and system configuration changes in a tamper-proof format. Automated alerts are triggered upon detection of suspicious activity or security anomalies to ensure a rapid and measured response.

A dedicated Security Operations Center (SOC) operates with a documented Incident Response Plan. The process encompasses identification, triage, escalation, containment, and recovery. Each severity level has a measurable Mean Time to Respond (MTTR) target and clear communication protocols for notifying relevant stakeholders.

All changes in the production environment follow a formal Request For Change (RFC) process. This process includes peer reviews, testing in staging environments, and formal approval prior to deployment. Rollback procedures are documented to ensure rapid recovery in the event of failure and to minimize service disruption.

A Disaster Recovery Plan (DRP) is implemented with daily data replication across multiple separate availability zones in Indonesia. Disaster Recovery drills are conducted annually to validate the effectiveness of recovery procedures. Critical services have a Recovery Time Objective (RTO) and Recovery Point Objective (RPO) of less than 1 hour.

Security awareness training is mandatory for all employees during onboarding and is conducted monthly, covering the current threat landscape and internal security policies. Engineering teams receive additional secure coding training to address application-specific security risks.

Mekari complies with the Personal Data Protection Act (UU PDP) No. 27 of 2022. A Data Protection Officer (DPO) is appointed to ensure compliance regarding data subject rights, data processing governance, and applicable regulatory requirements.

All customer data is processed and stored exclusively in Alibaba Cloud Indonesia data centers. Data is not transferred outside the territory of Indonesia without explicit consent or instruction from the customer.

A DPA is available as part of the service contract and outlines Mekari’s responsibilities as a data processor. This document covers security controls, confidentiality obligations, sub-processor management, and compliance with the customer’s instructions as the data controller.

Data subjects may submit deletion requests in accordance with UU PDP provisions. Once a request is verified, personal data will be permanently deleted from active systems and backups according to documented retention policies and data sanitization procedures.

Privacy principles are implemented from the early stages of development through a Secure SDLC framework. Data minimization, purpose limitation, and access control are core requirements before any feature is released into the production environment.

The consent management mechanism is designed to be transparent, providing clear information regarding the purpose of data processing. Explicit consent is obtained before processing occurs, and users can manage their consent preferences through easily accessible controls.

A background verification process is conducted prior to employee onboarding. These checks include identity verification, employment history, educational background, and professional references to ensure the integrity of personnel handling customer data.

All employees and third-party contractors are required to sign a Non-Disclosure Agreement (NDA) and confidentiality clauses before being granted access to company systems and data. Confidentiality obligations remain in effect even after the employment relationship has ended.

Security awareness training is mandatory during onboarding and is conducted periodically thereafter. The curriculum covers sensitive data management, phishing awareness, password policies, social engineering, and the latest security threats. Regular phishing simulations and security bulletins are utilized to reinforce a strong security culture.

A formal offboarding process ensures that all system access is revoked immediately upon termination or role change. The process includes asset returns, account deactivation, access reviews, and reminders of ongoing confidentiality obligations to mitigate insider threat risks.

A formal offboarding process ensures that all system access is revoked immediately upon termination or role change. The process includes asset returns, account deactivation, access reviews, and reminders of ongoing confidentiality obligations to mitigate insider threat risks.