This compliance checklist explains how Safous supports ASEAN data protection laws when employees and third-party vendors access systems that hold personal data. It is for organizations handling personal data in Singapore, Thailand, Malaysia, Indonesia, Vietnam and the Philippines, and it covers access controls, auditability, retention, vendor oversight and data residency.
Laws named in the checklist: Singapore's PDPA, Thailand's PDPA, Malaysia's PDPA, Indonesia's Personal Data Protection Law, Vietnam's Decree 13/2023 and the Philippines' Data Privacy Act.
| Requirement area | What it requires | How Safous supports it |
|---|---|---|
| Access controls | Least privilege and MFA to prevent unauthorized access or misuse. | Role-based and just-in-time access for employees and third-party vendors. |
| Purpose limitation | Use personal data only for its intended purpose. | Remote access restricted to specific systems or functions. |
| Auditability | Detailed logs and optional recordings. | Logs and recordings kept in your environment through the Safous AppGateway, under your retention and access policies. |
| Security safeguards | Protect data in transit. | TLS encryption for all remote connections. |
| No standing access | Limit persistent access. | Credentials vaulted and injected at session time; users never see passwords. |
| Retention and deletion | Control how long records are kept. | Session recordings and logs retained or purged per your policies. |
| Vendor oversight and breach prevention | Govern third-party access and reduce exposure. | Vendor access brokered without direct VPN or broad network access; no exposed public IPs, VPNs or endpoint agents needed. |
| Data residency and governance | Keep control of personal data. | Sessions, credentials and logs controlled in your environment; the stateless Safous cloud handles routing only and hosts no customer data. |
Singapore's PDPA, Thailand's PDPA, Malaysia's PDPA, Indonesia's Personal Data Protection Law, Vietnam's Decree 13/2023 and the Philippines' Data Privacy Act.
In your own environment through the Safous AppGateway. The checklist states the Safous cloud is stateless and hosts no customer data.
No. Customers remain responsible for compliance; Safous does not establish a lawful basis, satisfy consent or notice, make cross-border transfers lawful, or fulfil breach-notification duties.
Related resources: Regulatory compliance with Safous, Third-party access, Safous Privileged Remote Access at a glance.